Using packetbeat with pf_ring

Elastic Stack Beats
1

Hello,

Testing packetbeat with af_packet and pcap. getting an error when testing with pf_ring. I have 10 GB NIC and trying to capture DNS traffic over that nic.

ERROR instance/beat.go:906 Exiting: Unknown sniffer type: pf_ring

I've installed pfring-7.4.0-2736.x86_64.rpm; pfring-dkms-7.4.0-2700.noarch.rpm and dependency packages. I've added the mgmt interface and capture_interfaces in the interfaces.conf. Can someone please help me?

  • packetbeat.interfaces.device: 0
  • packetbeat.interfaces.type: pf_ring
  • packetbeat.interfaces.snaplen: 65535
  • packetbeat.ignore_outgoing: true
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.