# Packetbeat input from pcap -\> all sniffed field on ELK **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [September 5, 2018, 4:04pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440 "2018-09-05T16:04:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mardux](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mardux](https://discuss.elastic.co/u/mardux)\ **Post date:** [September 5, 2018, 4:04pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/1 "2018-09-05T16:04:38Z")
Hi all. i try to import a pcap file in ELK, using packetbeat. in my pcap file i have about 100k packets (999671 packet are HTTP traffic on port 80, the rest other protocol and port, like TLS/HTTPS on port 443) using this command: .\packetbeat.exe -e -c packetbeat.yml -t -I C:\tmp\my.pcap -d "publish" but in kibana i see only few packets, not HTTP but other protocol. seem that packetbeat (or kibana) filter most packets. below an example of my event my questions is: how export all pcap packet on ELK without filter, and how see all filed of my events? thanks for the support ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [September 5, 2018, 11:12pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/3 "2018-09-05T23:12:14Z")
- Which version of packetbeat are you using? Recently we've fixed a few issues with the HTTP parsing. - Do you see any **ERROR** or **WARN** -ing in packetbeat output? - If you can share the pcap or some part of it, I'll take a look. ---
**Author:** ![mardux](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mardux](https://discuss.elastic.co/u/mardux)\ **Post date:** [September 6, 2018, 9:04am UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/4 "2018-09-06T09:04:02Z")
> [@mardux](#): > > w export all pcap packet on ELK without filter, and how see all filed of my events Hi Adrian. thanks for your response i use the lastest version, packetbeat-6.4.0-windows-x86\_64. i don'see particolar errors on the output, no warn or error, only info or debug; for example, for a PCAP of 4 millions of packets (370 MB, mainly HTTP traffic on port 80): for this case, 0 events uploaded on ELK. this is the output continue later in the next post ---
**Author:** ![mardux](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mardux](https://discuss.elastic.co/u/mardux)\ **Post date:** [September 6, 2018, 9:05am UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/5 "2018-09-06T09:05:21Z")
another example, for a PCAP of 100k events (70 MB, mainly HTTP traffic on port 80): in this case only 8 events was uploaded on ELK (TLS traffic on port 443). the output is little different, i see the event uploaded on the output of the command: output without events: thanks very much for your help ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [September 6, 2018, 1:15pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/6 "2018-09-06T13:15:04Z")
Hi @mardux I've analysed your pcap. There's a couple of issues: - Most of the traffic is a DoS attack to port 80, where there isn't any HTTP protocol transaction, just a flood of random data to the http server. Packetbeat's http protocol will not report anything about this as it is not detected as valid http protocol data. To monitor this kind of packets you should use `packetbeat.flows` (which are currently disabled in your config). - There are two HTTP requests (without a matching response) in the pcap file. However, these are not reported. This is caused by a known problem with pcap file ingestion (and the reason why it is marked as a testing-only feature in the docs): Packetbeat is designed to report unmatched transactions like this when a timeout occurs. If processing of the pcap file terminates before this timeout is reached, the transactions are lost. I've created an issue in our repository to work on improving these shortcomings of the pcap file processor: [https://github.com/elastic/beats/issues/8255](https://github.com/elastic/beats/issues/8255). ---
**Author:** ![mardux](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mardux](https://discuss.elastic.co/u/mardux)\ **Post date:** [September 6, 2018, 3:04pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/7 "2018-09-06T15:04:49Z")
Thanks for your support Adrian. i confirm that it's traffic of DDOS attack, with random Ack packets. it's clear, packetbeat can report only valid session. in any case very compliments for the ELK stack! regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2018, 3:12pm UTC](https://discuss.elastic.co/t/packetbeat-input-from-pcap-all-sniffed-field-on-elk/147440/8 "2018-10-04T15:12:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.