Loading a pcap file


(Eloy Brodin) #1

I'm running packetbeat with my own pcap file.
I have noticed that when I run it without options (just -I file.pcap) it works ok, with the corresponding delays.
When I use -t flag (TopSpeed), i don't see any packet in the console output. However, if besides that, I use the flag -O and i press Enter key until the end of file, the console shows the read packets correctly.

Is it a bug in the output system?
It happens in packetbeat 1.3.1 and 5.1.2


(Andrew Kroh) #2

Try using the -waitstop <seconds> option to allow Packetbeat to process the data before stopping. For example:

./packetbeat -e -v -waitstop 10 -t -I dns-tunnel-iodine-timeshifted.pcap

Example from https://github.com/elastic/examples/tree/master/packetbeat_dns_tunnel_detection


(Eloy Brodin) #3

Thank you! That's the solution.
I supose the "Top Speed" option speeds up the main thread too much for the output :slight_smile:


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.