Packet occasionally hung when using sniffer type af_packet


I ran into a weird case that packetbeat not working when i specify using af_packet, after starting seems noting is runing, no cpu consumption, no logs generated, just hung in there, and cannot be stopped using CtrlC

but everything worked fine if i just change sniffer type to pcap

i'm monitoring on a pretty busy interface which is 10g bandwidth, thoughtput 1g data per second


turned out turning on promisc for the interface solved the problem, no idea why

the command i used is
ifconfig eth0 promisc

(Steffen Siering) #3

The sniffer is not setting promisc mode for you. Without promisc mode, the NIC (in hardware) will filter out packets intended for other MAC addresses.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.