# Packetbeat.yml with\_vlans **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [September 1, 2015, 10:31am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420 "2015-09-01T10:31:07Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 1, 2015, 10:31am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/1 "2015-09-01T10:31:07Z")
Hello there, How do I enable the option to packetbeat with\_vlans. Can you help? ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 1, 2015, 11:24am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/2 "2015-09-01T11:24:41Z")
Hi, the `with_vlans` option was added after our last release. We're working right now on releasing beta3, should come out in the next couple of days. ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 1, 2015, 12:44pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/3 "2015-09-01T12:44:36Z")
thanks for the reply **with\_vlans: true** will use my right in this way. beta3 released after ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 4, 2015, 7:28pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/4 "2015-09-04T19:28:29Z")
Beta3 is now available: [https://www.elastic.co/downloads/beats/packetbeat](https://www.elastic.co/downloads/beats/packetbeat) ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 4, 2015, 9:46pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/5 "2015-09-04T21:46:09Z")
Thank you for the reply How to enable with\_vlans ? [root@packtbeat ~]$packetbeat -version packetbeat version 1.0.0-beta3 ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 7, 2015, 3:22pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/6 "2015-09-07T15:22:06Z")
You need to add the option to the interfaces section, something like this: ``` interfaces: device: eth0 with_vlans=true ``` ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 8, 2015, 6:26am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/7 "2015-09-08T06:26:17Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/0/0d7d5b6fe4e4548e8ddabcfe5f214fd29a646821.png) not running ☹ ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 8, 2015, 7:23am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/8 "2015-09-08T07:23:28Z")
Oops, sorry, I meant `with_vlans: true`, i.e. `:` instead of `=`. ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 8, 2015, 11:05am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/9 "2015-09-08T11:05:15Z")
I can see the traffic with tcpdump, but the results could not Kibana screen ![](https://us1.discourse-cdn.com/elastic/original/2X/5/598220e76608bc9932879030793382e1bfabf780.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4350db2a20bc263a1ed4308185ffe7ccdce768c3.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/5/50505a3e053182baab396931c26105744422eb7b.png) ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 8, 2015, 11:55am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/10 "2015-09-08T11:55:07Z")
What protocols do you want to monitor? In the screenshot I see some ICMP (which we Packetbeat doesn't support) and some DNS requests? ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 8, 2015, 12:16pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/11 "2015-09-08T12:16:16Z")
protocols:dns,http,mysql,mongodb,psql ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 10, 2015, 1:57pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/12 "2015-09-10T13:57:39Z")
Can you help? ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [September 10, 2015, 4:12pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/13 "2015-09-10T16:12:45Z")
Please try to run Packetbeat in foreground like this: ``` packetbeat -e -d "sniffer,publish" ``` And check from the output if packetbeat seems to be receiving packets and if it sends it to Elasticsearch. ---
**Author:** ![omeroner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omeroner/32/4610_2.png) [@omeroner](https://discuss.elastic.co/u/omeroner)\ **Post date:** [September 11, 2015, 6:33am UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/14 "2015-09-11T06:33:06Z")
> [@tudor](#): > > packetbeat -e -d "sniffer,publish" hi, eth3; fibre channel port my packetbeat.yml: #Sniffer interfaces: device: eth3 with\_vlans: true output: [root@ntop ~]$ packetbeat -e -d "sniffer,publish" geolite.go:61: INFO Loaded GeoIP data from: /usr/share/GeoIP/GeoIP.dat output.go:80: INFO [ElasticsearchOutput] Using Elasticsearch [[http://10.10.11.232:9200](http://10.10.11.232:9200)] output.go:81: INFO [ElasticsearchOutput] Using index pattern [packetbeat-]YYYY.MM.DD output.go:82: INFO [ElasticsearchOutput] Topology expires after 15s output.go:84: INFO [ElasticsearchOutput] Insert events in batches. Flush interval is 1s. Bulk size is 10000. publish.go:250: INFO Using elasticsearch to store the topology publish.go:285: INFO Topology map refreshed every 10s publish.go:211: DBG Add topology entry for ntop: [10.10.11.232 fe80::21c:c4ff:fedd:d9e0 fe80::200:c9ff:fecd:78dc] sniffer.go:234: DBG BPF filter: tcp port 80 or tcp port 8080 or tcp port 8000 or tcp port 5000 or tcp port 8002 or tcp port 3306 or tcp port 6379 or tcp port 5432 or tcp port 9090 or tcp port 27017 or udp port 53 or port 11211 or (vlan and (tcp port 80 or tcp port 8080 or tcp port 8000 or tcp port 5000 or tcp port 8002 or tcp port 3306 or tcp port 6379 or tcp port 5432 or tcp port 9090 or tcp port 27017 or udp port 53 or port 11211)) sniffer.go:119: DBG Sniffer type: pcap device: eth3 sniffer.go:280: DBG Interrupted sniffer.go:337: DBG Packet number: 1 " " " sniffer.go:337: DBG Packet number: 194 sniffer.go:280: DBG Interrupted sniffer.go:280: DBG Interrupted sniffer.go:280: DBG Interrupted sniffer.go:337: DBG Packet number: 195 sniffer.go:337: DBG Packet number: 196 sniffer.go:337: DBG Packet number: 197 sniffer.go:337: DBG Packet number: 198 sniffer.go:337: DBG Packet number: 199 sniffer.go:337: DBG Packet number: 200 sniffer.go:337: DBG Packet number: 201 sniffer.go:337: DBG Packet number: 202 sniffer.go:337: DBG Packet number: 203 sniffer.go:337: DBG Packet number: 204 sniffer.go:337: DBG Packet number: 205 sniffer.go:337: DBG Packet number: 206 sniffer.go:337: DBG Packet number: 207 publish.go:211: DBG Add topology entry for ntop: [10.10.11.232 fe80::21c:c4ff:fedd:d9e0 fe80::200:c9ff:fecd:78dc] sniffer.go:280: DBG Interrupted sniffer.go:280: DBG Interrupted ^Csniffer.go:280: DBG Interrupted sniffer.go:342: INFO Input finish. Processed 207 packets. Have a nice day! [root@ntop ~]$ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/packetbeat-yml-with-vlans/28420/15 "2017-07-05T21:58:49Z")