### Author:  [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)
#### Post date: [March 21, 2016, 9:14am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/1 "2016-03-21T09:14:50Z")
Dear Team,
Basis the link below
>
Packetbeat does not capture packets on TCP port on Windows.
and current issue I am facing on my local instance is that packet beat does not capture TCP port Windows7 64bit
packets e.g. mysql running on port 3306.
Has anyone succefully installed and captured TCP packets on windows?
Kindly guide.
Regards, Chirag Shah
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [March 21, 2016, 11:31am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/2 "2016-03-21T11:31:18Z")
You just trying to sniff mysql? Is mysql client using TCP connection or names pipe (default)?
---
### Author:  [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)
#### Post date: [March 21, 2016, 11:32am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/3 "2016-03-21T11:32:38Z")
Tcp connection!
---
### Author:  [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)
#### Post date: [March 21, 2016, 4:51pm UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/4 "2016-03-21T16:51:21Z")
Guys, has anyone configured packetbeat to listen tcp ports on Windows? or is it a known issue?
Regards, Chirag Shah
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 21, 2016, 11:14pm UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/5 "2016-03-21T23:14:40Z")
WinPcap cannot capture from the loopback device (127.0.0.1 traffic). See my comment [here](https://github.com/elastic/beats/issues/104#issuecomment-199525840) for details on the work around.
---
### Author:  [@White\_Tong](https://discuss.elastic.co/u/White_Tong)
#### Post date: [November 15, 2016, 9:12am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/6 "2016-11-15T09:12:59Z")
Hey andrewkroh.
I tried npcap v0.10-r18 on Windows 7 but the Packetbeat does not capture traffic from the loopback interface.
However, Wrieshar can capture mysql data from Npcap Loopback Adapter such as the icon below.
The following snippet shows my configuration.
> ############################# Sniffer #########################################
> interfaces:
> device: 1
> buffer\_size\_mb: 100
> ############################# Protocols #######################################
> protocols:
> dns:
>
> ```
> ports: [53]
>
> ```
> ```
> include_authorities: true
> include_additionals: true
>
> ```
> ```
> # send_request: true
> # send_response: true
>
> ```
> http:
> ```
> ports: [80, 8080, 8000, 5000, 8002]
>
> ```
> memcache:
> ```
> ports: [11211]
>
> ```
> mysql:
> ```
> ports: [3306]
>
> ```
> pgsql:
> ```
> ports: [5432]
>
> ```
> redis:
> ```
> ports: [6379]
>
> ```
> thrift:
> ```
> ports: [9090]
>
> ```
> mongodb:
>
> ```
> ports: [27017]
>
> ```
> ############################# Processes #######################################
> procs:
> enabled: true
> monitored:
> - process: mysqld
> cmdline\_grep: mysqld
> ```
> - process: app
> cmdline_grep: gunicorn
>
> ```
> ###############################################################################
> ############################# Libbeat Config ##################################
>
> # Base config file used by all other beats for using libbeat features
> ############################# Output ##########################################
> # Configure what outputs to use when sending the data collected by the beat.
>
> # Multiple outputs may be used.
>
> output:
> logstash:
> hosts: ["localhost:5044"]
> ############################# Shipper #########################################
> shipper:
> name: "172.16.7.163"
> ############################# Logging #########################################
> logging:
> files:
> rotateeverybytes: 10485760 # = 10MB # Number of rotated log files to keep. Oldest files will be deleted first.
The following icon shows the MySQL.
```
packetbeat -e -d "publish" -N
select * from XXX;
```
Packetbeat does not capture traffic.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 15, 2016, 3:22pm UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/7 "2016-11-15T15:22:25Z")
Shouldn't the device be called "Npcap Loopback Adapter"? It looks like that is what your Wireshark is reading from based on the Window title. Did you re-run `-devices` after installing the driver? Maybe the machine needs a reboot after installing the driver.
---
### Author:  [@White\_Tong](https://discuss.elastic.co/u/White_Tong)
#### Post date: [November 16, 2016, 2:38am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/8 "2016-11-16T02:38:51Z")
Thanks for your support. I'm sure the machine has been restarted after installing the driver. Unfortunately, the wrieshark can capture the traffic from Npcap Loopback adapter but packetbeat can't. I tried it again, but the result likes before.
I change configuration to “devices:2”，and packetbeat can only capture data type "dns" or "http". But my goal is to get the performance of mysql.
Please guide me about that, thanks!
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 16, 2016, 2:56am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/9 "2016-11-16T02:56:11Z")
Did you install Npcap with "WinPcap Compatible Mode"? Did you uninstall winpcap?
The fact that the interface is called "MS LoopBack Driver" seems to indicate that Packetbeat is not using Npcap.
---
### Author:  [@White\_Tong](https://discuss.elastic.co/u/White_Tong)
#### Post date: [November 16, 2016, 8:00am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/10 "2016-11-16T08:00:35Z")
Thank you very much, I have reinstalled Npcap with "WinPcap Compatible Mode". Now, the packetbeat works well.
Althought the traffics of mysql can be captured, HTTP&DNS are lost.
Do you know how to capture all of them? Thanks!
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 16, 2016, 9:22am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/11 "2016-11-16T09:22:14Z")
Is traffic send on different interfaces? Like HTTP/DNS being accessed from the outside and mysql from the inside, in such a way traffic can only be captured by different interfaces (Sorry, I'm no windows expert). In this case, right now, you have to run 2 packetbeat instances. Also watch this [enhancement request](https://github.com/elastic/beats/issues/263).
---
### Author:  [@White\_Tong](https://discuss.elastic.co/u/White_Tong)
#### Post date: [November 16, 2016, 11:22am UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/12 "2016-11-16T11:22:23Z")
Yeah, you are right.
Thanks for your support!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/packetbeat-for-windows-does-not-capture-tcp-port-data/44965/13 "2017-07-05T21:50:16Z")