# Negative HTTP responsetime

**URL:** <https://discuss.elastic.co/t/negative-http-responsetime/59988>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 7, 2016, 1:37pm UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988 "2016-09-07T13:37:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cikenerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cikenerd/32/26593_2.png) [@cikenerd](https://discuss.elastic.co/u/cikenerd)\
**Post date:** [September 7, 2016, 1:37pm UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988/1 "2016-09-07T13:37:57Z")

</div>

Hi, I install packetbeat 1.3 ,I notice the negative response time in the kibana.

- Version: packetbeat version 1.3.0 (amd64)
- Operating System: CentOS release 6.5 (Final) , 2.6.32-431.23.3.el6.x86\_64

> packetbeat.yml  
> interfaces:  
> device: any  
> type: pcap

> protocols:  
> http:  
> ports: [xxx]  
> real\_ip\_header: "X-Forwarded-For"  
> send\_headers: ["User-Agent"]

> output:  
> redis:  
> host: "xxxx"  
> port: 6379  
> index: "xxxx"

 ![](https://us1.discourse-cdn.com/elastic/original/2X/4/46d71e5a1622f4f40a9d8084d9adb1eec7cdfa63.png)

Any ideas of this?Thanks.

---

<div class="post-metadata">

**Author:** ![monica](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monica/32/3696_2.png) [@monica](https://discuss.elastic.co/u/monica)\
**Post date:** [September 8, 2016, 8:43am UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988/2 "2016-09-08T08:43:51Z")

</div>

The negative value of the response time might be due to packet loss. It would be great if you can send me a small pcap with your traffic (or just upload it here), around the period of time where the response time is negative, so I can investigate the problem.

A similar problem was opened [here](https://github.com/elastic/beats/issues/882).

For recording the traffic, you can use one of your favorite (tcpdump, ngrep, etc) or packetbeat. [Here](https://www.elastic.co/guide/en/beats/packetbeat/current/_recording_a_trace.html) are more details.

---

<div class="post-metadata">

**Author:** ![cikenerd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cikenerd/32/26593_2.png) [@cikenerd](https://discuss.elastic.co/u/cikenerd)\
**Post date:** [September 8, 2016, 1:16pm UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988/3 "2016-09-08T13:16:29Z")

</div>

Hi @monica ,  
Thank you for relply, I sent trace.pcap file to you,please check your message.

Today I found that the http response time had no less than 0 item in kibana,then I restarted packetbeat , but negative HTTP responsetime reappeared.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f4c89be106857f27a2b85f42b81f64b1a14db3a8.png)  
I also noticeed that sometimes the http request.code was 0.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2016, 1:38pm UTC](https://discuss.elastic.co/t/negative-http-responsetime/59988/4 "2016-09-28T13:38:10Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.