I am trying to run packetbeat on mac with packetbeat.yml configured to have mac settings and http port changes from default:
# Select the network interfaces to sniff the data. You can use the "any"
# keyword to sniff on all connected interfaces.
interfaces:
device: en0
http:
# Configure the ports where to listen for HTTP traffic. You can disable
# the http protocol by commenting the list of ports.
ports: [8091,8093]
./packetbeat.test -systemTest -c /tmp/packetbeat-1.0.0-beta3-darwin/packetbeat.yml -test.coverprofile coverage.cov
packetbeat.go:208: CRIT Initializing sniffer failed: Error creating sniffer: en0: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permission denied)
Has anyone seen this problem before?
Elasticsearch is running.
The config file is same as the original config file except ports and interface:
############################# Shipper ############################################
shipper:
# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
# If this options is not defined, the hostname is used.
name:
# The tags of the shipper are included in their own field with each
# transaction published. Tags make it easy to group transactions by different
# logical properties.
#tags: ["service1"]
# Uncomment the following if you want to ignore transactions created
# by the server on which the shipper is installed. This option is useful
# to remove duplicates if shippers are installed on multiple servers.
# ignore_outgoing: true
############################# Sniffer ############################################
# Select the network interfaces to sniff the data. You can use the "any"
# keyword to sniff on all connected interfaces.
interfaces:
device: en0
############################# Protocols ######################################
protocols:
dns:
# Configure the ports where to listen for DNS traffic. You can disable
# the DNS protocol by commenting out the list of ports.
ports: [53]
# include_authorities controls whether or not the dns.authorities field
# (authority resource records) is added to messages. The default is false.
include_authorities: true
# include_additionals controls whether or not the dns.additionals field
# (additional resource records) is added to messages. The default is false.
include_additionals: true
# send_request and send_response control whether or not the stringified DNS
# request and response message are added to the result. The default is false.
# Nearly all data about the request/response is available in the dns.*
# fields, but this can be useful if you need visibility specifically
# into the request or the response.
#send_request: true
#send_response: true
http:
# Configure the ports where to listen for HTTP traffic. You can disable
# the http protocol by commenting the list of ports.
ports: [8091,8093]
# Uncomment the following to hide certain parameters in URL or forms attached
# to HTTP requests. The names of the parameters are case insensitive.
# The value of the parameters will be replaced with the 'xxxxx' string.
# This is generally useful for avoiding storing user passwords or other
# sensitive information.
# Only query parameters and top level form parameters are replaced.
# hide_keywords: ['pass', 'password', 'passwd']
memcache:
# Configure the ports where to listen for memcache traffic. You can disable
# the memcache protocol by commenting out the list of ports.
ports: [11211]
# Uncomment the parseunknown option to force the memcache text protocol parse
# to parse unknown commands.
# Default: false
# Note: All unknown commands MUST not contain any data parts!
# parseunknown: true
# Update the maxvalue option to store the values - base64 encoded - in the
# json output.
# possible values:
# maxvalue: -1 # store all values (text based protocol multi-get)
# maxvalue: 0 # store no values at all (default)
# maxvalue: N # store up to N values
# maxvalues: 0
# Use maxbytespervalue to limit the number of bytes to be copied per value element.
# Notes: values will be base64 encoded, so actual size in json document
# will be 4 times maxbytespervalue
#
# Default: unlimited
# maxbytespervalue: 100
# Udp transaction timeout in milliseconds.
# Default: 200
# Note: Quiet messages in UDP binary protocol will get response only in error case.
# The memcached analyzer will wait for udptransactiontimeout
# milliseconds before publishing quiet messages.
# Non quiet messages or quiet requests with error response will not
# have to wait for the timeout
# udptransactiontimeout: 200
mysql:
# Configure the ports where to listen for MySQL traffic. You can disable
# the MySQL protocol by commenting out the list of ports.
ports: [3306]
pgsql:
# Configure the ports where to listen for Pgsql traffic. You can disable
# the Pgsql protocol by commenting out the list of ports.
ports: [5432]
redis:
# Configure the ports where to listen for Redis traffic. You can disable
# the Redis protocol by commenting out the list of ports.
ports: [6379]
thrift:
# Configure the ports where to listen for Thrift traffic. You can disable
# the Thrift protocol by commenting out the list of ports.
ports: [9090]
mongodb:
# Configure the ports where to listen for Mongodb traffic. You can disable
# the Mongodb protocol by commenting out the list of ports.
ports: [27017]
@Prerna_Manaktala, the output you provided looks normal. I suggest you also add the -e flag so that logging continues to go to stderr. So did you not get the CRIT Initializing sniffer failed: Error creating decoder: Unsuported link type: UnknownLinkType(12) error this time?
how to solve this problem? I'm also meeting this problem on osx.
make
./packbeat
and then get the CRIT Initializing sniffer failed: Error creating decoder: Unsuported link type: UnknownLinkType(12) error
looking forward your reply.
hi,
the config is right../packetbeat -e
2016/06/20 05:47:42.127069 beat.go:336: CRIT Exiting: Initializing sniffer failed: Error creating decoder: Unsupported link type: UnknownLinkType(12)
But the in /libbeat/beat/beat.go ，there's only 325 lines codes.Very strange for this problem
Can you please share your config? Would like to start packetbeat using said config, trying to reproduce issue locally.
On OS X I noted LinkType 12 being used (which is even undefined in libpcap) sometimes if the device configured was wrong (like did not really exist or was no ethernet device).
In fact，I use this config to test packetbeat-1.2.3,and the result is ok.like this:
./packetbeat -d "http" -I testhttp.pcap -N -e
and on mac osx , I have modifed the device as "en0"
But,in packetbeat(the source code,and develop myown protocols),the error occurs.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.