# New Packetbeat Protocol - accessing lower layer Info

**URL:** <https://discuss.elastic.co/t/new-packetbeat-protocol-accessing-lower-layer-info/154468>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [October 29, 2018, 4:13pm UTC](https://discuss.elastic.co/t/new-packetbeat-protocol-accessing-lower-layer-info/154468 "2018-10-29T16:13:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dhughes](https://avatars.discourse-cdn.com/v4/letter/d/7ab992/32.png) [@dhughes](https://discuss.elastic.co/u/dhughes)\
**Post date:** [October 29, 2018, 4:13pm UTC](https://discuss.elastic.co/t/new-packetbeat-protocol-accessing-lower-layer-info/154468/1 "2018-10-29T16:13:37Z")

</div>

We've created our own UDP protocol in Packetbeat.

We're successfully accessed the payload past UDP using the Payload field within the Packet struct. We see the tuple information as well for IP.

What we're wondering however is how can we access other lower layer information from IP (TTL), or Ethernet (VLAN ID, MAC addresses), etc. Is that possible? If not, is there at least a way to get the entire packet payload (not just past UDP), so that we could parse this ourselves?

Thanks in advance,

- David H.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [October 29, 2018, 6:39pm UTC](https://discuss.elastic.co/t/new-packetbeat-protocol-accessing-lower-layer-info/154468/2 "2018-10-29T18:39:00Z")

</div>

Hi,

Unfortunately, full packet information is not available to protocol processors. As making this information available requires a significant refactor to Packetbeat. Feel free to create an [Enhancement request](https://github.com/elastic/beats/issues/new), or experiment with propagating this information yourself, from the Decoder in decoder.go to the UDP protocol processor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 6:39pm UTC](https://discuss.elastic.co/t/new-packetbeat-protocol-accessing-lower-layer-info/154468/3 "2018-11-26T18:39:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.