# Starting packetbeat: 2016/01/08 12:13:43.009060 packetbeat.go:195: CRIT Initializing sniffer failed: Error creating sniffer: Pfring sniffing is not compiled in

**URL:** <https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [January 8, 2016, 12:19pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721 "2016-01-08T12:19:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![slourenco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slourenco/32/5780_2.png) [@slourenco](https://discuss.elastic.co/u/slourenco)\
**Post date:** [January 8, 2016, 12:19pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/1 "2016-01-08T12:19:02Z")

</div>

I've installed the RPM version of packetbeat 1.0.1 (latest) and no pf\_ring module is compiled.  
Do you have a RPM version of it? Do I need to compile the project? If only compiled version is available do I need extra configuration?

Best regards

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 8, 2016, 3:09pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/2 "2016-01-08T15:09:53Z")

</div>

`pf_ring` is a kernel module. So this message is referring to fact that pf\_ring is not compiled in to the kernel.

[http://www.ntop.org/products/packet-capture/pf\_ring/](http://www.ntop.org/products/packet-capture/pf_ring/) has documentation on how to install the module.

---

<div class="post-metadata">

**Author:** ![slourenco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slourenco/32/5780_2.png) [@slourenco](https://discuss.elastic.co/u/slourenco)\
**Post date:** [January 8, 2016, 7:23pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/3 "2016-01-08T19:23:34Z")

</div>

I have it compiled and running 😕

```
[root@]# lsmod
Module Size Used by
iptable_filter 1826 0
ip_tables 17500 1 iptable_filter
x_tables 23371 2 ip_tables,iptable_filter
configfs 25261 0
dca 7178 0
ptp 12547 0
pps_core 8362 1 ptp
pf_ring 704682 0
ipv6 371773 30
binfmt_misc 7136 1
x86_pkg_temp_thermal 5747 0
crc32_pclmul 3109 0
crc32c_intel 13350 0
firmware_class 12818 0
ext4 568296 2
crc16 1723 1 ext4
jbd2 102882 1 ext4
mbcache 9260 1 ext4
aesni_intel 161915 0
aes_x86_64 7843 1 aesni_intel
glue_helper 5424 1 aesni_intel
lrw 4190 1 aesni_intel
gf128mul 7935 1 lrw
ablk_helper 3061 1 aesni_intel
cryptd 10247 2 aesni_intel,ablk_helper
dm_mirror 14078 0
dm_region_hash 11365 1 dm_mirror
dm_log 9515 2 dm_region_hash,dm_mirror
dm_mod 101315 2 dm_log,dm_mirror
```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 8, 2016, 7:56pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/4 "2016-01-08T19:56:20Z")

</div>

I was completely wrong on that one. Sorry. 😞

I should have checked the code first. Packetbeat does need compiled with pf\_ring support and the release build doesn't do this. When [building](https://github.com/elastic/beats/blob/master/CONTRIBUTING.md#setting-up-your-dev-environment) you have set the `havepfring` tag (`go build -tags havepfring`) and need to have the pf\_ring headers installed.

Can you open a bug in the elastic/beats project for this.

---

<div class="post-metadata">

**Author:** ![slourenco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/slourenco/32/5780_2.png) [@slourenco](https://discuss.elastic.co/u/slourenco)\
**Post date:** [January 11, 2016, 2:06pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/5 "2016-01-11T14:06:48Z")

</div>

Thanks !!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/starting-packetbeat-2016-01-08-12-13-43-009060-packetbeat-go-195-crit-initializing-sniffer-failed-error-creating-sniffer-pfring-sniffing-is-not-compiled-in/38721/6 "2017-07-05T21:56:52Z")

</div>