# Minimize Packet loss with af\_packet

**URL:** <https://discuss.elastic.co/t/minimize-packet-loss-with-af-packet/218976>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [February 12, 2020, 12:40pm UTC](https://discuss.elastic.co/t/minimize-packet-loss-with-af-packet/218976 "2020-02-12T12:40:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![interestinelk](https://avatars.discourse-cdn.com/v4/letter/i/e9a140/32.png) [@interestinelk](https://discuss.elastic.co/u/interestinelk)\
**Post date:** [February 12, 2020, 12:40pm UTC](https://discuss.elastic.co/t/minimize-packet-loss-with-af-packet/218976/1 "2020-02-12T12:40:00Z")

</div>

I try to use Packetbeat for network monitoring.  
If I use Packetbeat with pcap, I get network traffic successfully  
but some packets dropped. When I check the logs I see "Fail to parse HTTP parameters"

If I add af\_packet instead of pcap, the logs do not show any errors.  
but I start debug logging, I see that:  
2020-02-12T09:35:08.778+0300 DEBUG [sniffer] sniffer/sniffer.go:185 Interrupted  
2020-02-12T09:35:09.278+0300 DEBUG [sniffer] sniffer/sniffer.go:185 Interrupted  
And I cannot see trafic. How can I resolve this?

I aim to minimize packet loss.

Here is my config:

```
setup.template.name: "packetbeat"
setup.template.pattern: "packetbeat-*"

packetbeat.interfaces.device: ens224
packetbeat.interfaces.type: af_packet
packetbeat.interfaces.buffer_size_mb: 2048
packetbeat.interfaces.ignore_outgoing: true
packetbeat.interfaces.snaplen: 1514
packetbeat.interfaces.with_vlans: true

packetbeat.protocols:

- type: http
  ports: [9000]
  hide_keywords: ["pass", "password", "passwd"]
  send_headers: ["User-Agent", "Cookie", "Set-Cookie"]
  send_all_headers: true
  split_cookie: true
  real_ip_header: "X-Forwarded-For"
  send_request: true
  send_response: true
  include_body_for: ["text/html", "application/json"]
  decode_body: true

output.elasticsearch:
  hosts: ["http://127.0.0.1:9200"]
  index: "packetbeat-%{[agent.version]}-%{+yyyy.MM.dd}"

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/packetbeat
  name: packetbeat.log
  keepfiles: 7
  permissions: 0644
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 12:40pm UTC](https://discuss.elastic.co/t/minimize-packet-loss-with-af-packet/218976/2 "2020-03-11T12:40:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.