Does not capture ICMP traffic

Elastic Stack Beats
#1

DNS traffic is displayed in Kiban, and ICMP is not present

 # /etc/packetbeat/packetbeat.yml
    packetbeat.interfaces.device: 1

packetbeat.protocols.dns:
  ports: [53]
  include_authorities: true
  include_additionals: true
  
  packetbeat.protocols.icmp:
  
output.elasticsearch:
  hosts: ["localhost:9200"]
#2

You need to enable ICMP by adding enabled: true to the ICMP config section like this...

packetbeat.protocols.icmp:
  # Enable ICMPv4 and ICMPv6 monitoring. Default: false
  enabled: true

Rob

#3

Thank you. I tried. I restarted the elastic packetbeat. Does not preserve

#4

It looks like the idendation is off in your config for icmp.

#5

Tell me please where you can turn it on?

#6

The config to enable ICMP is exactly what Rob gave above. If you continue to have problems please provide your complete config file.

#7

I apologize. Here is the complete file

# /etc/packetbeat/packetbeat.yml
packetbeat.interfaces.device: 1
    packetbeat.protocols.dns:
      ports: [53]
      include_authorities: true
      include_additionals: true
      
      packetbeat.protocols.icmp:
      enabled: true
      
    output.elasticsearch:
      hosts: ["localhost:9200"]
#8

The configuration file is YAML and indentation is critical to proper interpretation of the data. Try it like this:

packetbeat.interfaces.device: 1

packetbeat.protocols.dns:
  ports: [53]
  include_authorities: true
  include_additionals: true
      
packetbeat.protocols.icmp:
  enabled: true
      
output.elasticsearch:
  hosts: ["localhost:9200"]
#9

@andrewkroh was a little faster than me. For what it is worth I tested the results with improper indentation as @korsdecaying posted and confirmed that it will cause ICMP to not work as expected.

More about YAML indentation rules here...
http://yaml.org/spec/1.2/2009-07-21/spec.html#id2576668

As you work with Elastic Stack you will likely use YAML in a lot of places. This include configuration files, but also things like Logstash dictionary files use by the translate filter. It is definitely worth familiarizing yourself with the YAML basics.

Rob

#10

beats add some features on top of YAML. See Beats Config file format docs.

1 Like
#11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.