Loading a pcap file

Elastic Stack Beats
1

I'm running packetbeat with my own pcap file.
I have noticed that when I run it without options (just -I file.pcap) it works ok, with the corresponding delays.
When I use -t flag (TopSpeed), i don't see any packet in the console output. However, if besides that, I use the flag -O and i press Enter key until the end of file, the console shows the read packets correctly.

Is it a bug in the output system?
It happens in packetbeat 1.3.1 and 5.1.2

2

Try using the -waitstop <seconds> option to allow Packetbeat to process the data before stopping. For example:

./packetbeat -e -v -waitstop 10 -t -I dns-tunnel-iodine-timeshifted.pcap

Example from https://github.com/elastic/examples/tree/master/packetbeat_dns_tunnel_detection

1 Like
3

Thank you! That's the solution.
I supose the "Top Speed" option speeds up the main thread too much for the output :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.