# Packetbeat have problems with sniffer.go:297: DBG Interrupted

**URL:** <https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [March 10, 2016, 4:35pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054 "2016-03-10T16:35:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![daguero](https://avatars.discourse-cdn.com/v4/letter/d/b5e925/32.png) [@daguero](https://discuss.elastic.co/u/daguero)\
**Post date:** [March 10, 2016, 4:35pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/1 "2016-03-10T16:35:21Z")

</div>

I tried to use Packetbeat for network monitoring and have problems. I followed the recommended configuration on the official site, but when you run:

> ok@ok-VirtualBox1:~/Desktop/packetbeat$ packetbeat -e -c packetbeat.yml -d "\*"

The result shown in console is:

> ........  
> 2016/03/10 15:44:26.637344 packetbeat.go:244: DBG Waiting for the sniffer to finish  
> 2016/03/10 15:44:27.138116 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:27.638974 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:28.139709 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:28.640423 sniffer.go:297: DBG Interrupted

Please any idea how to resolve????  
thanks

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 11, 2016, 10:51am UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/2 "2016-03-11T10:51:58Z")

</div>

- Can you share your config file?
- Which OS are you running on?
- What network interfaces do you have enabled?

---

<div class="post-metadata">

**Author:** ![daguero](https://avatars.discourse-cdn.com/v4/letter/d/b5e925/32.png) [@daguero](https://discuss.elastic.co/u/daguero)\
**Post date:** [March 11, 2016, 1:30pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/3 "2016-03-11T13:30:31Z")

</div>

Hello ruflin:  
This is my config file:

> ################### Sniffer ###########################

> interfaces:  
> device: any

> ############################# Protocols #######################################  
> protocols:  
> dns:  
> ports: [53]  
> include\_authorities: true  
> include\_additionals: true  
> http:  
> ports: [80, 8080, 8000, 5000, 8002]  
> memcache:  
> ports: [11211]  
> mysql:  
> ports: [3306]

> pgsql:  
> ports: [5432]

> redis:  
> ports: [6379]

> thrift:  
> ports: [9090]

> mongodb:  
> ports: [27017]

> ################# Output ########################

> output:
> 
> ### Logstash as output
> 
> logstash:  
> # The Logstash hosts  
> hosts: ["172.23.10.14:5044"]  
> index: packetbeat

> ################## Shipper #######################

> shipper:  
> name: "daj3"

> ############################# Logging #########################################

> logging:  
> files:  
> rotateeverybytes: 10485760 # = 10MB

My SO is Ubuntu 15.04, I am using containers docker...

Greetings and thank you very much in advance

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 11, 2016, 9:38pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/4 "2016-03-11T21:38:38Z")

</div>

> [@daguero](#):
>
> 2016/03/10 15:44:26.637344 packetbeat.go:244: DBG Waiting for the sniffer to finish  
> 2016/03/10 15:44:27.138116 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:27.638974 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:28.139709 sniffer.go:297: DBG Interrupted  
> 2016/03/10 15:44:28.640423 sniffer.go:297: DBG Interrupted

Those are not errors. That's just normal debug output.

Once you have Packetbeat started, try running a `nslookup google.com` to generate some traffic.

Make sure you are running packetbeat as root so that it can capture in promiscuous mode. And if none of that works, instead of using the `any` interface call out a specific interface like `eth0`.

---

<div class="post-metadata">

**Author:** ![daguero](https://avatars.discourse-cdn.com/v4/letter/d/b5e925/32.png) [@daguero](https://discuss.elastic.co/u/daguero)\
**Post date:** [March 14, 2016, 2:01pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/5 "2016-03-14T14:01:03Z")

</div>

Thank Andrew, but the real problem I had was I'm running pacetbeat within a docker container and can not see traffic. I imagine it has to do with how I share the resources between the container and the local pc.

Best regards

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 17, 2016, 9:25pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/6 "2016-03-17T21:25:08Z")

</div>

If you are running Packetbeat inside a container then I would _think_ you would need to start that container with `docker run --net=host` and then configure `device: docker0`. The `--net=host` part makes it possible to sniff the traffic from other containers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/packetbeat-have-problems-with-sniffer-go-297-dbg-interrupted/44054/7 "2017-07-05T21:54:34Z")

</div>


