# Network Packet Capture integration stuck in a FAILED state

**URL:** <https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767>\
**Category:** Elastic Agent\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [February 19, 2025, 1:34pm UTC](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767 "2025-02-19T13:34:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pok\_lehbim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pok_lehbim/32/140579_2.png) [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\
**Post date:** [February 19, 2025, 1:34pm UTC](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767/1 "2025-02-19T13:34:29Z")

</div>

I am trying to add the Network Packet Capture integration to an agent but it's not working at all.

The machine is a windows host, and it's managed from a fleet. I've looked into the logs but there isn't any pertinent information that could help me solve this.

Here's what the cli shows:

```auto
PS C:\WINDOWS\system32> & 'C:\Program Files\Elastic\Agent\elastic-agent.exe' status
┌─ fleet
│ └─ status: (HEALTHY) Connected
└─ elastic-agent
	├─ status: (DEGRADED) 1 or more components/units in a failed state
	└─ packet-default
		├─ status: (FAILED) Failed: pid '12060' exited with code '1'
		├─ packet-default
		│ └─ status: (FAILED) Failed: pid '12060' exited with code '1'
		└─ packet-default-packet-network-3b488958-d190-450e-97a4-4237a3b2444d
			└─ status: (FAILED) Failed: pid '12060' exited with code '1'

```

And here's a log entry (they all give the same level of information):

```auto
{"log.level":"error","@timestamp":"2025-02-19T09:08:31.943Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":645},"message":"Component state changed packet-default (STARTING->FAILED): Failed: pid '28532' exited with code '1'","log":{"source":"elastic-agent"},"component":{"id":"packet-default","state":"FAILED","old_state":"STARTING"},"ecs.version":"1.6.0"}

```

Has anyone dealt with this before? Is there anything else I can do to troubleshoot this? Are there more detailed logs somewhere?

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![pok\_lehbim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pok_lehbim/32/140579_2.png) [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\
**Post date:** [February 20, 2025, 10:59am UTC](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767/2 "2025-02-20T10:59:17Z")

</div>

The problem was the fact that I didn't have npcap installed on my machine.

I went into the logs in kibana and looked at the informational ones to find this entry `no version available for npcap` right before getting things like `Unit state changed packet-default (STARTING->FAILED): Failed: pid '26188' exited with code '1'` which led me to believe that this was the root cause of it all.

So if you're experiencing this issue, make sure to check for that in your logs as well!