Packet occasionally hung when using sniffer type af_packet


(ZHIYU YU) #1

I ran into a weird case that packetbeat not working when i specify using af_packet, after starting seems noting is runing, no cpu consumption, no logs generated, just hung in there, and cannot be stopped using CtrlC

but everything worked fine if i just change sniffer type to pcap

i'm monitoring on a pretty busy interface which is 10g bandwidth, thoughtput 1g data per second


(ZHIYU YU) #2

turned out turning on promisc for the interface solved the problem, no idea why

the command i used is
ifconfig eth0 promisc


(Steffen Siering) #3

The sniffer is not setting promisc mode for you. Without promisc mode, the NIC (in hardware) will filter out packets intended for other MAC addresses.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.