# Packetbeat on windows **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [May 19, 2017, 2:25am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346 "2017-05-19T02:25:18Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Harinagarajan](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Post date:** [May 19, 2017, 2:25am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/1 "2017-05-19T02:25:19Z")
Dears, I am using windows 10 os, I have configured Elasicsearch, kibana and packebeat as per standard I have installed pcapng too In powershell after execute the .\packetbeat.exe -devices command 0: \Device\NPF\_{5BC8D54F-F098-49C3-8D2D-969E839DFA8E} (Intel(R) Ethernet Connection I219-V) (fe80::79b6:7ad7:e5c6:9de9 192.168.2.120) 1: \Device\NPF\_{11FF37BF-069C-481D-8EEE-1E1FB9BD69F6} (Microsoft) (fe80::dfa:60ab:c73d:87c7 2408:210:28ec:b800:9cfb:b3 bd:bf27:b3f8 2408:210:28ec:b800:dfa:60ab:c73d:87c7 192.168.2.100) 2: \Device\NPF\_{AA15BD21-3348-460A-8081-023207EABD27} (MS NDIS 6.0 LoopBack Driver) (fe80::f180:c469:a35a:4b9e 0.0.0.0 ) like devices are displaying so I set packetbeat.interfaces.device: 2 in packbeat.yml file I want to receive packet from PostgreSQL or MySQL so I set packetbeat.flows: timeout: 10s period: 10s packetbeat.protocols.http: ports: [80, 8080, 8000, 5000, 8002, 8099] packetbeat.protocols.mysql: ports: [3306] packetbeat.protocols.pgsql: ports: [5432] output.elasticsearch: hosts: ["127.0.0.1:9200"] after start packetbeat, wireshark also stared I did operations on PostgreSQL/MySQL, I couldn't get any packets in elasticsearch, the same I can able to catch packets in wireshark Is there anything I have missed Thanks & Regards, Nagarajan.H ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [May 19, 2017, 11:06am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/2 "2017-05-19T11:06:28Z")
did you check packetbeat logs? Can you find flows in ES/Kibana? ---
**Author:** ![Harinagarajan](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Post date:** [May 23, 2017, 2:43am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/3 "2017-05-23T02:43:13Z")
Yes, I have checked the log it seams packebeat is running and able to capture others ports packets 2017-05-19T10:34:11+09:00 INFO Resolved device index 2 to device: \Device\NPF\_{AA15BD21-3348-460A-8081-023207EABD27} 2017-05-19T10:34:11+09:00 DBG Sniffer type: pcap device: \Device\NPF\_{AA15BD21-3348-460A-8081-023207EABD27} 2017-05-19T10:34:11+09:00 DBG new flows worker. timeout=10s, period=10s, tick=10s, ticksTO=1, ticksP=1 2017-05-19T10:34:11+09:00 DBG Local IP addresses: [fe80::79b6:7ad7:e5c6:9de9 169.254.157.233 fe80::f180:c469:a35a:4b9e 169.254.75.158 fe80::fdca:b6a4:4ef5:7e66 169.254.126.102 2408:210:28ec:b800:dfa:60ab:c73d:87c7 2408:210:28ec:b800:9cfb:b3bd:bf27:b3f8 fe80::dfa:60ab:c73d:87c7 192.168.2.100 ::1 127.0.0.1 2001:0:4137:9e76:1874:25:c5fe:1fcb fe80::1874:25:c5fe:1fcb fe80::5efe:c0a8:264] 2017-05-19T10:34:11+09:00 DBG tcp%!(EXTRA string=Port map: %v, map[uint16]protos.Protocol=map[8000:http 3306:mysql 5432:pgsql 80:http 8080:http 5000:http 8002:http 8099:http 11211:memcache]) 2017-05-19T10:34:11+09:00 DBG Port map: map[11211:memcache] 2017-05-19T10:34:11+09:00 DBG register flow counter: net\_packets\_total 2017-05-19T10:34:11+09:00 DBG register flow counter: net\_bytes\_total 2017-05-19T10:34:11+09:00 DBG Layer type: Ethernet 2017-05-19T10:34:11+09:00 INFO packetbeat start running. 2017-05-19T10:34:30+09:00 DBG Publish: { "@timestamp": "2017-05-19T01:34:30.001Z", "beat": { "hostname": "DESKTOP-TI70K7V", "name": "DESKTOP-TI70K7V", "version": "5.4.0" }, "dest": { "ip": "239.255.255.250", "mac": "01:00:5e:7f:ff:fa", "port": 1900 }, "final": true, "flow\_id": "EQIA////DP////8U//8BAAEBAF5///oCAExPT1Dv///6qf5LnmwHwtQ", "last\_time": "2017-05-19T01:34:12.390Z", "source": { "ip": "169.254.75.158", "mac": "02:00:4c:4f:4f:50", "port": 54466, "stats": { "net\_bytes\_total": 1276, "net\_packets\_total": 4 } }, "start\_time": "2017-05-19T01:34:12.390Z", "transport": "udp", "type": "flow" } ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 23, 2017, 3:54pm UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/4 "2017-05-23T15:54:47Z")
> [@Harinagarajan](#): > > I did operations on PostgreSQL/MySQL, I couldn't get any packets in elasticsearch, the same I can able to catch packets in wireshark Where are PostgreSQL and MySQL running? How are you performing operations? Since you are listening on the loopback device, are you sure the commands are communicating to the loopback interface and are unencrypted? ---
**Author:** ![Harinagarajan](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Post date:** [May 24, 2017, 1:38am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/5 "2017-05-24T01:38:21Z")
MySQL and PostgreSQL are running in same pc only where the packetbeat, elasticsearch and kibana are configured, Everything is in local(same pc), I tested with Insert/Retriew records(Insert command and Select query) and not encrypted one ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 6, 2017, 8:54am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/6 "2017-06-06T08:54:16Z")
Is it possible, PostgreSQL/MySQL using named pipes instead of a network socket? ---
**Author:** ![Harinagarajan](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Post date:** [June 7, 2017, 1:56am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/7 "2017-06-07T01:56:27Z")
I want to execute in local system only ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 7, 2017, 10:14am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/8 "2017-06-07T10:14:59Z")
have you checked you client is connection to MySql/PostgreSQL via named pipes or network socket? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:15am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346/9 "2017-07-05T10:15:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.