Does not capture ICMP traffic

Elastic Stack Beats
1

DNS traffic is displayed in Kiban, and ICMP is not present

 # /etc/packetbeat/packetbeat.yml
    packetbeat.interfaces.device: 1

packetbeat.protocols.dns:
  ports: [53]
  include_authorities: true
  include_additionals: true
  
  packetbeat.protocols.icmp:
  
output.elasticsearch:
  hosts: ["localhost:9200"]
2

You need to enable ICMP by adding enabled: true to the ICMP config section like this...

packetbeat.protocols.icmp:
  # Enable ICMPv4 and ICMPv6 monitoring. Default: false
  enabled: true

Rob

3

Thank you. I tried. I restarted the elastic packetbeat. Does not preserve

4

It looks like the idendation is off in your config for icmp.

5

Tell me please where you can turn it on?

6

The config to enable ICMP is exactly what Rob gave above. If you continue to have problems please provide your complete config file.

7

I apologize. Here is the complete file

# /etc/packetbeat/packetbeat.yml
packetbeat.interfaces.device: 1
    packetbeat.protocols.dns:
      ports: [53]
      include_authorities: true
      include_additionals: true
      
      packetbeat.protocols.icmp:
      enabled: true
      
    output.elasticsearch:
      hosts: ["localhost:9200"]
8

The configuration file is YAML and indentation is critical to proper interpretation of the data. Try it like this:

packetbeat.interfaces.device: 1

packetbeat.protocols.dns:
  ports: [53]
  include_authorities: true
  include_additionals: true
      
packetbeat.protocols.icmp:
  enabled: true
      
output.elasticsearch:
  hosts: ["localhost:9200"]
9

@andrewkroh was a little faster than me. For what it is worth I tested the results with improper indentation as @korsdecaying posted and confirmed that it will cause ICMP to not work as expected.

More about YAML indentation rules here...
http://yaml.org/spec/1.2/2009-07-21/spec.html#id2576668

As you work with Elastic Stack you will likely use YAML in a lot of places. This include configuration files, but also things like Logstash dictionary files use by the translate filter. It is definitely worth familiarizing yourself with the YAML basics.

Rob

10

beats add some features on top of YAML. See Beats Config file format docs.

1 Like
11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.