# Packetbeat hardware / software requirements **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [April 30, 2021, 12:59am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729 "2021-04-30T00:59:11Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [April 30, 2021, 12:59am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/1 "2021-04-30T00:59:12Z")
I have a sensor with a i5-4590, 8GB memory running packetbeat and am still getting "dropped\_because\_of\_gaps" I've followed all the directions about enabling af\_packet, etc yet even on a low traffic link (1-5mbps) I still get dropped events - what else can I do? ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [May 1, 2021, 12:06am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/2 "2021-05-01T00:06:22Z")
> [@hilt86](#): > > dropped\_because\_of\_gaps Would you be able to share the packetbeat.yml configuration? Just wanted to check what settings are currently configured. ---
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [May 1, 2021, 12:14am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/3 "2021-05-01T00:14:21Z")
Yep can do 🙂 > ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [May 1, 2021, 12:17am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/4 "2021-05-01T00:17:54Z")
I saw you mentioned that you had enabled af\_packet, but it is currently disabled here: [packetbeat 7.12.0 config template · GitHub](https://gist.github.com/hilt86/590985088908b61f54de1c7d70338e6b#file-packetbeat-yml-L31) Do you know if you had tried to comment that one out? It should commonly resolve the issue. However, if it does not work, and you are still seeing issues, could you try to set this one to false, and just see if it helps, at least then we are able to narrow it down a bit more: > ---
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [May 1, 2021, 12:52am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/5 "2021-05-01T00:52:28Z")
sorry that was a typo - yep I've tried both pcap and af\_packet and get the same result. I want to capture flows so turning that off won't really help. How can I get to the bottom of this? ---
**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\ **Post date:** [May 1, 2021, 6:42am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/6 "2021-05-01T06:42:04Z")
So the above configuration, is af\_packet currently enable, and no other fields are different from the configuration you linked? The reason I wanted to disable it, was not to provide it as a solution, but to try to find out what might cause your issue. Would you be able to share a logfile for example? It might include sensitive information, so if its not from a test environment of some sort, I was just wondering where you found your metrics and if you could grep the logfiles for any "ERROR" or "WARN" as well after restarting it and letting it run for a couple of minutes. ---
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [May 6, 2021, 6:03am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/7 "2021-05-06T06:03:12Z")
Yes that is right. Yes if I disable flows then I get no dropped\_because\_of\_gaps errors but I can only get those if it is monitoring flows! Here is a link to the logs [packetbeat.log · GitHub](https://gist.github.com/hilt86/7a6e903b9b50627a75b8b85cd475a731) There are no errors, just a warning regarding SIP. BTW packetbeat is running in a container ---
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [May 13, 2021, 7:00am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/8 "2021-05-13T07:00:16Z")
any ideas @Marius_Iversen ? should I file a PR as I'd really like to get this working? ---
**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Post date:** [May 20, 2021, 11:20pm UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/9 "2021-05-20T23:20:01Z")
If I am an Elastic cloud client can I get commercial support for this @Marius_Iversen ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 18, 2021, 1:20am UTC](https://discuss.elastic.co/t/packetbeat-hardware-software-requirements/271729/10 "2021-06-18T01:20:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.