# Windows 10 - Not capturing HTTP traffic

**URL:** https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896
**Category:** Beats
**Tags:** packetbeat
**Created:** [June 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896 "2017-06-19T08:16:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [June 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896/1 "2017-06-19T08:16:59Z")

</div>

Dears,

I have successfully installed packetbeat-5.4.0 and pointing to Elastic search. I kept the default configs as it is. However I'm getting "INFO No non-zero metrics in the last 30s" in the log. My intention is to get detailed data for request,response from IIS. I'm using Windows 10.

.\packetbeat.exe -devices

0: \Device\NPF\_{1BD2422B-42C7-4784-98AA-79A5E8331995} (Microsoft) (fe80::605a:ec2a:d949:6722 192.168.0.162)  
1: \Device\NPF\_{E444EFCA-F2AF-44BE-8E82-2F98CA25A097} (Intel(R) Ethernet Connection I219-LM) (fe80::b47e:2b92:2901:f158 192.168.2.93)  
2: \Device\NPF\_{9416A212-8190-45CE-8C7B-DDF589A50ABE} (Microsoft) (fe80::848d:618:238b:dc50 fe80::848d:618:238b:dc50)

I have configured to device 0. I have no clues why its not sending data. please help me..

Thanks a lot,..

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [June 19, 2017, 12:50pm UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896/2 "2017-06-19T12:50:01Z")

</div>

Is the traffic HTTP? Or is it HTTPS?

On what interface does the HTTP traffic pass through? Does incoming traffic arrive at the `192.168.0.162` address or the `192.168.2.93` address (or maybe is ipv6 traffic on device 3)?

---

<div class="post-metadata">

### Author: ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [June 20, 2017, 3:03pm UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896/3 "2017-06-20T15:03:06Z")

</div>

Hi Andrew,

Thanks for the response.

It's for HTTP. My incoming traffic arrive at 192.168.2.93. I have changed interface to 1 and I can see logs for dns and other information. However, no logs appeared from my application running under port 80 which I'm expecting. sample log as below

2017-06-21T15:38:04+08:00 INFO Non-zero metrics in the last 30s: libbeat.es.call\_count.PublishEvents=49 libbeat.es.publish.read\_bytes=239086 libbeat.es.publish.write\_bytes=832418 libbeat.es.published\_and\_acked\_events=1421 libbeat.publisher.messages\_in\_worker\_queues=53 libbeat.publisher.published\_events=1421

Please advise.

---

<div class="post-metadata">

### Author: ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)
#### Post date: [June 21, 2017, 9:27am UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896/4 "2017-06-21T09:27:17Z")

</div>

To add to the above...  
I'm trying in my localhost.. Googled and installed npcap. after I install npcap, I can see devices like this... Irrespective of changing the interfaces.device 1 or 2 unable to see my app logs

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f07f6c90c0e81a795138c3f3e1961e5cfea42991.png)

Highly appreciated your prompt response.. Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2017, 9:27am UTC](https://discuss.elastic.co/t/windows-10-not-capturing-http-traffic/89896/5 "2017-07-19T09:27:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.