Packet occasionally hung when using sniffer type af_packet

I ran into a weird case that packetbeat not working when i specify using af_packet, after starting seems noting is runing, no cpu consumption, no logs generated, just hung in there, and cannot be stopped using CtrlC

but everything worked fine if i just change sniffer type to pcap

i'm monitoring on a pretty busy interface which is 10g bandwidth, thoughtput 1g data per second

turned out turning on promisc for the interface solved the problem, no idea why

the command i used is
ifconfig eth0 promisc

The sniffer is not setting promisc mode for you. Without promisc mode, the NIC (in hardware) will filter out packets intended for other MAC addresses.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.