Negative HTTP responsetime

[cikenerd]

Hi, I install packetbeat 1.3 ,I notice the negative response time in the kibana.

• Version: packetbeat version 1.3.0 (amd64)
• Operating System: CentOS release 6.5 (Final) , 2.6.32-431.23.3.el6.x86_64

packetbeat.yml
interfaces:
device: any
type: pcap

protocols:
http:
ports: [xxx]
real_ip_header: "X-Forwarded-For"
send_headers: ["User-Agent"]

output:
redis:
host: "xxxx"
port: 6379
index: "xxxx"

Any ideas of this?Thanks.

[monica (Monica Sarbu)]

The negative value of the response time might be due to packet loss. It would be great if you can send me a small pcap with your traffic (or just upload it here), around the period of time where the response time is negative, so I can investigate the problem.

A similar problem was opened here.

For recording the traffic, you can use one of your favorite (tcpdump, ngrep, etc) or packetbeat. Here are more details.

[cikenerd]

Hi @monica ,
Thank you for relply, I sent trace.pcap file to you,please check your message.

Today I found that the http response time had no less than 0 item in kibana,then I restarted packetbeat , but negative HTTP responsetime reappeared.

I also noticeed that sometimes the http request.code was 0.