# Unable to start packetbeat
**URL:** https://discuss.elastic.co/t/unable-to-start-packetbeat/25676
**Category:** Beats
**Tags:** packetbeat
**Created:** [July 15, 2015, 11:30pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676 "2015-07-15T23:30:01Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)
#### Post date: [July 15, 2015, 11:30pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/1 "2015-07-15T23:30:01Z")
I am unable to start packetbeat and getting below error
> /packetbeat: error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory
but I am using different version of libpcap.so. So how can I force packetbeat to pickup my libpcap file?
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [July 16, 2015, 10:10am UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/2 "2015-07-16T10:10:10Z")
Hi, what OS are you using? The current binaries depend on the shared libpcap library, so I'm afraid you need that libpcap version. The good news is that we're working on a new build system that will statically compile libpcap in the binary, so this will no longer be an issue with beta3.
You have two options:
- compile it yourself against your libpcap version by following the steps [here](https://github.com/elastic/packetbeat/blob/master/CONTRIBUTING.md)
- I can send you a static binary built with the new system if you are willing to test it before it's released.
Let me know.
---
### Author:  [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)
#### Post date: [July 16, 2015, 6:18pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/3 "2015-07-16T18:18:31Z")
Hi Tudor,
Thank you for your reply.
I think second option looks great for me. Can you please share me the static binary? Looking forward for your reply.
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [July 16, 2015, 8:23pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/4 "2015-07-16T20:23:38Z")
You can find the statically compiled binary [here](https://s3.amazonaws.com/beats-nightlies/packetbeat-linux-amd64). It's really just the binary which you can execute directly, not in a packaged form yet. But you can use the configuration file and the template from the regular [zip](https://download.elastic.co/beats/packetbeat/packetbeat-1.0.0-beta2-x86_64.tar.gz). Let me know if you have issues with it.
---
### Author:  [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)
#### Post date: [July 16, 2015, 9:15pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/5 "2015-07-16T21:15:19Z")
Thank you very much. I will keep you posted on my status 😄
---
### Author:  [@putztzu](https://discuss.elastic.co/u/putztzu)
#### Post date: [August 22, 2015, 8:46pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/6 "2015-08-22T20:46:20Z")
I'm also seeing this odd error... Why would anything complain about loading shared libraries nowadays? AFAIK the distinction between a "Shared Library" and normal "library" was deprecated more than 5 yrs ago, so today there is no need for things like specifying a "Shared Library Path" In any case, this error results from trying to run packetbeat from an extracted TAR. Was surprised that the TAR contains only a couple binaries, a YML file and a JSON file.
In any case, on my system the following is installed from the current libpcap stable package (omitting licenses and other text files)
/usr/lib64/libpcap.so.1
/usr/lib64/libpcap.so.1.6.2
/usr/share/doc/packages/libpcap1
/usr/share/man/man7/pcap-filter.7.gz
/usr/share/man/man7/pcap-linktype.7.gz
/usr/share/man/man7/pcap-tstamp.7.gz
Also, I downloaded your compiled binary but am perplexed about your binary's name. I doubt "packetbeat-linux-amd64" is the proper name but tried it anyway after also changing the name to "libpcap.so.0.8" and placing that file in the same folder as the packetbeat executable. Neither works and continues to fail with the same error.
---
### Author:  [@rfplourenco](https://discuss.elastic.co/u/rfplourenco)
#### Post date: [August 25, 2015, 12:44pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/7 "2015-08-25T12:44:33Z")
Hi Tudor,
Could you upload that statically compiled binary again?
I'm POC'ing beats on our elastic stack and I can't 'mess around' with the current libpcap version under /lib64
Would be really thankful for that!
cheers
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [August 25, 2015, 3:49pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/8 "2015-08-25T15:49:31Z")
Sure, in the meantime we have OS packages (that's why the link is broken). Here is the [DEB amd64](https://s3.amazonaws.com/beats-nightlies/packetbeat/packetbeat_1.0.0-nightly.150824171100_amd64.deb) and the [RPM amd64](https://s3.amazonaws.com/beats-nightlies/packetbeat/packetbeat-1.0.0-nightly.150824181108-x86_64.rpm). If you prefer some other package, let me know (or you can get the listing [here](https://s3.amazonaws.com/beats-nightlies/)). Note that these links might also go 404 in a few days because we're actively changing the way we're handling nightlies.
Also note that this is unreleased software :-). Let us know if you hit any issues.
---
### Author:  [@rfplourenco](https://discuss.elastic.co/u/rfplourenco)
#### Post date: [August 26, 2015, 10:51am UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/9 "2015-08-26T10:51:42Z")
Thanks a lot, but I need the ELF 64-bit executable with libpcap statically compiled.
This is for a Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Current packetbeat binary downloaded from elasticsearch:
_POC:~/elk/elasticsearch-1.4.4/packetbeat-1.0.0~Beta1\> file packetbeat_
packetbeat: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.18, dynamically linked (uses shared libs), for GNU/Linux 2.6.18, not stripped\*
_POC\_:~/elk/elasticsearch-1.4.4/packetbeat-1.0.0~Beta1\> ldd packetbeat_
_linux-vdso.so.1 =\> (0x00007fff73dfd000)_
**_libpcap.so.0.8 =\> not found_**
_libpthread.so.0 =\> /lib64/libpthread.so.0 (0x0000003b84200000)_
_libc.so.6 =\> /lib64/libc.so.6 (0x0000003b83600000)_
_/lib64/ld-linux-x86-64.so.2 (0x0000003b83200000)_
_POC\_:~/elk/elasticsearch-1.4.4/packetbeat-1.0.0~Beta1\> ./packetbeat_
_./packetbeat: error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory_
Sorry for the trouble!
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [August 27, 2015, 10:26am UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/10 "2015-08-27T10:26:40Z")
Try this [one](https://beats-nightlies.s3.amazonaws.com/packetbeat/packetbeat-1.0.0-nightly.150826174057-x86_64.tar.gz). That's a full statically linked binary, let us know if it works or not, pls.
---
### Author:  [@rfplourenco](https://discuss.elastic.co/u/rfplourenco)
#### Post date: [August 27, 2015, 1:17pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/11 "2015-08-27T13:17:04Z")
It works. I already see a new index called '.packetbeat-topology' in Marvel.
_./packetbeat -c packetbeat.yml_
_main.go:158: CRIT Initializing sniffer failed: Error creating sniffer: any: You don't have permission to capture on that device (socket: Operation not permitted)_
I have to struggle further now because of the lack of permissions to sniff traffic.
Using 'af\_packet' doesn't seem to help either so I'll have to resort to the sysadmins now.
_# Select the network interfaces to sniff the data. You can use the "any"_
_# keyword to sniff on all connected interfaces._
_interfaces:_
_# device: any_
_device: bond0_
_type: af\_packet_
_buffer\_size\_mb: 100_
Thanks for the assistance. I'll follow up once I get the permissions issue sorted...
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [August 27, 2015, 1:30pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/12 "2015-08-27T13:30:44Z")
You'll need to either start the process as root or set the packet capture capability on the binary, see this [thread](https://discuss.elastic.co/t/install-from-source-and-run-as-non-root/26430/3).
---
### Author:  [@MartinG](https://discuss.elastic.co/u/MartinG)
#### Post date: [September 4, 2015, 2:35pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/13 "2015-09-04T14:35:43Z")
Hello tudor!
I have also several problems to make packetbeats run on my Linux system:
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.0 (Maipo)
First I started with packetbeat-1.0.0-beta2-x86\_64.tar.gz but it refused to run with error:
./packetbeat: error while loading shared libraries: libpcap.so.0.8: cannot open shared object file: No such file or directory
But libpcap is installed:
yum list|grep libpcap
libpcap.x86\_64 14:1.5.3-4.el7\_1.2 @rhel-x86\_64-server-7
The I tried with packetbeat-1.0.0-nightly.150826174057-x86\_64.tar.gz as recommended. I also set the CAP\_NET\_RAW capability: sudo setcap cap\_net\_raw=ep /usr/bin/packetbeat
packetbeats starts without problems if elasticsearch output isn't used. E.g. file output works!
But when I use elasticsearch output (E.g. the default packetbeat.yml file) the following error occurs:
fatal error: unexpected signal during runtime execution
[signal 0xb code=0x1 addr=0x63 pc=0x7fa585d2357c]
runtime stack:
runtime.gothrow(0xa7b3d0, 0x2a)
/usr/local/go/src/runtime/panic.go:503 +0x8e
runtime.sigpanic()
/usr/local/go/src/runtime/sigpanic\_unix.go:14 +0x5e
goroutine 12 [syscall, locked to thread]:
runtime.cgocall\_errno(0x401ab0, 0xc20801acd0, 0x0)
/usr/local/go/src/runtime/cgocall.go:130 +0xf5 fp=0xc20801ac90 sp=0xc20801ac68
net.\_C2func\_getaddrinfo(0x7fa5800008c0, 0x0, 0xc20801adc8, 0xc20801ad18, 0xc200000000, 0x0, 0x0)
/usr/local/go/src/net/:26 +0x55 fp=0xc20801acd0 sp=0xc20801ac90
net.cgoLookupIPCNAME(0xc208040f07, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc208050400)
/usr/local/go/src/net/cgo\_unix.go:96 +0x1c5 fp=0xc20801ae00 sp=0xc20801acd0
net.cgoLookupIP(0xc208040f07, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc2090d7b37)
/usr/local/go/src/net/cgo\_unix.go:148 +0x65 fp=0xc20801ae58 sp=0xc20801ae00
net.lookupIP(0xc208040f07, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0)
/usr/local/go/src/net/lookup\_unix.go:64 +0x5f fp=0xc20801aea0 sp=0xc20801ae58
net.func·026(0x0, 0x0, 0x0, 0x0)
/usr/local/go/src/net/lookup.go:79 +0x55 fp=0xc20801af08 sp=0xc20801aea0
net.(\*singleflight).doCall(0xe99970, 0xc2091343c0, 0xc208040f07, 0x9, 0xc209115cf0)
/usr/local/go/src/net/singleflight.go:91 +0x2f fp=0xc20801afb8 sp=0xc20801af08
runtime.goexit()
/usr/local/go/src/runtime/asm\_amd64.s:2232 +0x1 fp=0xc20801afc0 sp=0xc20801afb8
created by net.(\*singleflight).DoChan
/usr/local/go/src/net/singleflight.go:84 +0x42b
...
I truncated the output due to restriction to 5000 characters.
Could you please check?
Thank you in advance!
---
### Author:  [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [September 4, 2015, 7:24pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/14 "2015-09-04T19:24:41Z")
@MartinG we've just released beta3. Can you try with it, please? [https://www.elastic.co/downloads/beats/packetbeat](https://www.elastic.co/downloads/beats/packetbeat)
---
### Author:  [@MartinG](https://discuss.elastic.co/u/MartinG)
#### Post date: [September 11, 2015, 8:15am UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/15 "2015-09-11T08:15:51Z")
Hello Todur,
Beta3 works as expected. Thanks a lot!
I have an idea for an improvement: is it possible to provide more detailed Information regading the response time? Commercial tools like Oracle Real User Experience Insight are able to differentiate between server, client and network time.
Greetings,
Martin
---
### Author:  [@rfplourenco](https://discuss.elastic.co/u/rfplourenco)
#### Post date: [September 15, 2015, 2:53pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/16 "2015-09-15T14:53:45Z")
Just as a follow up: Everything is working fine once the capabilities are set up.
Thanks once more.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/unable-to-start-packetbeat/25676/17 "2017-07-05T21:58:47Z")