Packet occasionally hung when using sniffer type af_packet

Elastic Stack Beats
1

I ran into a weird case that packetbeat not working when i specify using af_packet, after starting seems noting is runing, no cpu consumption, no logs generated, just hung in there, and cannot be stopped using CtrlC

but everything worked fine if i just change sniffer type to pcap

i'm monitoring on a pretty busy interface which is 10g bandwidth, thoughtput 1g data per second

2

turned out turning on promisc for the interface solved the problem, no idea why

the command i used is
ifconfig eth0 promisc

3

The sniffer is not setting promisc mode for you. Without promisc mode, the NIC (in hardware) will filter out packets intended for other MAC addresses.