Packetbeat logging traffic from Ip with different subnet

Elastic Stack Beats
1

Hi,

I'm receiving logs from packetbeat from an IP with different subnet.

Like my ip is 192.168.0.100 on network card index 1 for example, and I'm getting logs from this Ip and 192.168.1.92 which has different subnet.

I can see this would happen if promiscuous mode is enabled, but it is disabled by default as I configured packetbeat.yml to get

packetbeat.interfaces.device: 1

by index (which is 1 in my case) and not (any).

How can I configure the yml to only get logs from the IP assigned on the network card and not other IPs from different subnets?

Any help is really appreciated cause this is causing a lot of log mess.

Regards,

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.