# Sniffer not fully working **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [May 29, 2015, 2:00am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531 "2015-05-29T02:00:28Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![moreno](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@moreno](https://discuss.elastic.co/u/moreno)\ **Post date:** [May 29, 2015, 2:00am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/1 "2015-05-29T02:00:28Z")
I have installed the agent on ubuntu running HAPROXY with multiple ports backends. We have high traffic sites but it looks like nothing is really recording on elastcisearch. sudo packetbeat -e -d "publish" -N does shows traffic just no traffic is being sent out. ---
**Author:** ![moreno](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@moreno](https://discuss.elastic.co/u/moreno)\ **Post date:** [May 29, 2015, 3:59am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/2 "2015-05-29T03:59:24Z")
It looks like its only saving 5 records [http://ip:9200/packetbeat-\*/\_search?pretty](http://ip:9200/packetbeat-*/_search?pretty) Shows { "took" : 4, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 4193, "max\_score" : 1.0, "hits" : [ { "\_index" : "packetbeat-2015.05.29", ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [May 29, 2015, 8:08am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/3 "2015-05-29T08:08:18Z")
Hi, the `-N` disables publishing. What happens when you run it like `packetbeat -e -d "publish"`? Still only 5 records? ---
**Author:** ![ianv](https://avatars.discourse-cdn.com/v4/letter/i/898d66/32.png) [@ianv](https://discuss.elastic.co/u/ianv)\ **Post date:** [June 16, 2015, 11:44pm UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/4 "2015-06-16T23:44:36Z")
I'm having the same issue with capturing HTTP data. I'm running the following command: packetbeat -e -d "Published" -c /etc/packetbeat/packetbeat.yml I am only getting a few entries in my ES index. I see the following entries scrolling through my console window: http.go:730: WARN Response from unknown transaction. Ignoring: TcpTuple src[X.X.X.X:59560] dst[X.X.X.X:80] stream\_id[2743] http.go:647: WARN Two requests without a response. Dropping old request If i run the following I can see the http traffic: packetbeat -e -d "http,httpdetailed" -c /etc/packetbeat/packetbeat.yml http.go:237: DBG Header: Referer http.go:247: DBG HV: [http://z.cdn.turner.com/xslo/cvp/assets/container/2.0.4.0/cvp\_main\_container.swf](http://z.cdn.turner.com/xslo/cvp/assets/container/2.0.4.0/cvp_main_container.swf) http.go:253: DBG Header: 'referer' Value: '[http://z.cdn.turner.com/xslo/cvp/assets/container/2.0.4.0/cvp\_main\_container.swf](http://z.cdn.turner.com/xslo/cvp/assets/container/2.0.4.0/cvp_main_container.swf)' http.go:236: DBG Data: Cookie: IMRID=11880577-4427-4824-b761-5a82e486416f Connection: keep-alive http.go:237: DBG Header: Cookie http.go:247: DBG HV: IMRID=11880577-4427-4824-b761-5a82e486416f http.go:253: DBG Header: 'cookie' Value: 'IMRID=11880577-4427-4824-b761-5a82e486416f' http.go:236: DBG Data: Connection: keep-alive http.go:237: DBG Header: Connection http.go:247: DBG HV: keep-alive http.go:253: DBG Header: 'connection' Value: 'keep-alive' http.go:385: DBG Empty content length, ignore body http.go:647: WARN Two requests without a response. Dropping old request http.go:655: DBG Received request with tuple: TcpTuple src[X.X.X.X:60988] dst[X.X.X.X:80] stream\_id[30] http.go:943: DBG Parameters: ^Csniffer.go:319: INFO Input finish. Processed 3068 packets. Have a nice day! I was able to dump the traffic into a pcap file using the following: packetbeat -e -dump /tmp/packetbeat/trace3.pcap I opened the pcap with wireshark and could see all the traffic. As a side note: The packetbeat server is virtual server connected to a mirrored port on my virtual switch (VMware distributed Switch). I configured it to listen on eth1. Any thoughts as to why it's not sending the data into Elasticsearch (or the log file for that matter). ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [June 17, 2015, 11:18am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/5 "2015-06-17T11:18:20Z")
Can you send me that trace3.pcap file? You can send it to tudor@elastic.co. ---
**Author:** ![ianv](https://avatars.discourse-cdn.com/v4/letter/i/898d66/32.png) [@ianv](https://discuss.elastic.co/u/ianv)\ **Post date:** [June 17, 2015, 1:19pm UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/6 "2015-06-17T13:19:06Z")
Unfortunately I can't send the pcap for security reasons. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [June 17, 2015, 1:45pm UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/7 "2015-06-17T13:45:38Z")
Ok, one thing to check is that in wireshark you don't see any "packet truncated during capture". This would be an indication that the snaplen setting is too low. It could also be that there is some packet loss in the probably large response. Look in wireshark if you seen any notices of "previous tcp packet was not captured" or something like that. ---
**Author:** ![ianv](https://avatars.discourse-cdn.com/v4/letter/i/898d66/32.png) [@ianv](https://discuss.elastic.co/u/ianv)\ **Post date:** [June 17, 2015, 3:42pm UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/8 "2015-06-17T15:42:13Z")
Searched through my pcap file and didn't see any "packet truncated" messages nor "previous tcp packet was not captured" message. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [June 18, 2015, 9:13am UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/9 "2015-06-18T09:13:39Z")
Hmm, then I'm not sure. From the logs you posted already it looks like a request was correctly captured but no response for it. Can you post or send me a larger portion of the log file? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:59pm UTC](https://discuss.elastic.co/t/sniffer-not-fully-working/1531/10 "2017-07-05T21:59:08Z")