[[faq]]
== Frequently Asked Questions

This section contains frequently asked questions about Packetbeat. Also check out the
https://discuss.elastic.co/c/beats/packetbeat[Packetbeat discussion forum].

[float]
[[client-server-fields-empty]]
=== Client_server and server fields are empty?

The `client_server` and `server` fields are empty when Packetbeat is not configured
to capture information about the network topology.

To capture information about the network topology, set the `save_topology` configuration option to true and make sure that
you are sending the output to Elasticsearch.

[float]
[[dashboard-fields-incorrect]]
=== Dashboard in Kibana is breaking up data fields incorrectly?

The index template might not be loaded correctly. See <<packetbeat-template>>.

[float]
[[packetbeat-mirror-ports]]
=== Packetbeat doesn't see any packets when using mirror ports?

The interface needs to be set to promiscuous mode. Run the following command:

["source","sh",subs="attributes,callouts"]
----------------------------------------------------------------------
ip link set <device_name> promisc on
----------------------------------------------------------------------

For example: `ip link set enp5s0f1 promisc on`

[float]
[[packetbeat-loopback-interface]]
=== Packetbeat can't capture traffic from Windows loopback interface?

Packetbeat is unable to capture traffic from the loopback device (127.0.0.1 traffic)
because the Windows TCP/IP stack does not implement a network loopback interface, 
making it difficult for Windows packet capture drivers like WinPcap to sniff traffic. 

As a workaround, you can try installing https://github.com/nmap/npcap/releases[Npcap],
an update of WinPcap. Make sure that you restart Windows after installing Npcap.
Npcap creates an Npcap Loopback Adapter that you can select if you want to capture
loopback traffic.

For the list of devices shown here, you would configure Packetbeat
to use device `4`:

["source","sh"]
----------------------------------------------------------------------
PS C:\Users\vagrant\Desktop\packetbeat-1.2.0-windows> .\packetbeat.exe -devices
0: \Device\NPF_NdisWanBh (NdisWan Adapter)
1: \Device\NPF_NdisWanIp (NdisWan Adapter)
2: \Device\NPF_NdisWanIpv6 (NdisWan Adapter)
3: \Device\NPF_{DD72B02C-4E48-4924-8D0F-F80EA2755534} (Intel(R) PRO/1000 MT Desktop Adapter)
4: \Device\NPF_{77DFFCAF-1335-4B0D-AFD4-5A4685674FAA} (MS NDIS 6.0 LoopBack Driver)
----------------------------------------------------------------------

[float]
[[packetbeat-missing-transactions]]
=== Packetbeat is missing long running transactions?

Packetbeat has an internal timeout that it uses to time out transactions and TCP connections
when no packets have been seen for a long time. 

To process long running transactions, you can specify a larger value for the <<transaction-timeout-option,`transaction_timeout`>>
option. However, keep in mind that very large timeout values can increase memory usage if messages are lost or transaction
response messages are not sent. 

include::../../libbeat/docs/faq-limit-bandwidth.asciidoc[]
include::../../libbeat/docs/shared-faq.asciidoc[]
include::../../libbeat/docs/faq-refresh-index.asciidoc[]
