Packetbeat quick start: installation and configuration

The best way to understand the value of a network packet analytics system like Packetbeat is to try it on your own traffic.

This guide describes how to get started quickly with network packets analytics. You’ll learn how to:

• install Packetbeat on each system you want to monitor
• specify the network devices and protocols to sniff
• parse the packet data into fields and send it to {es}
• visualize the packet data in {kib}

• You need Elasticsearch for storing and searching your data, and Kibana for visualizing and managing it.

sudo apt-get install libpcap0.8

sudo yum install libpcap

The commands shown are for AMD platforms, but ARM packages are also available. Refer to the download page for the full list of available packages.

• APT or YUM
• Download page
• Docker

Connections to Elasticsearch and Kibana are required to set up Packetbeat.

Set the connection information in packetbeat.yml. To locate this configuration file, see Directory layout.

cloud.id: "staging:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRjZWM2ZjI2MWE3NGJmMjRjZTMzYmI4ODExYjg0Mjk0ZiRjNmMyY2E2ZDA0MjI0OWFmMGNjN2Q3YTllOTYyNTc0Mw=="
cloud.auth: "packetbeat_setup:{pwd}" 1

To learn more about required roles and privileges, see Grant users access to secured resources.

In packetbeat.yml, configure the network devices and protocols to capture traffic from.

1. Set the sniffer type. By default, Packetbeat uses pcap, which uses the libpcap library and works on most platforms.

   On Linux, set the sniffer type to af_packet to use memory-mapped sniffing. This option is faster than libpcap and doesn’t require a kernel module, but it’s Linux-specific:

   packetbeat.interfaces.type: af_packet
   

2. Specify the network device to capture traffic from. For example:

   packetbeat.interfaces.device: eth0
   

   Tip

   On Linux, specify packetbeat.interfaces.device: any to capture all messages sent or received by the server where Packetbeat is installed. The any setting does not work on macOS.

   To see a list of available devices, run:

packetbeat devices
```

packetbeat devices
```

./packetbeat devices
```

./packetbeat devices
```

PS C:\Program Files\Packetbeat> .\packetbeat.exe devices

0: \Device\NPF_{113535AD-934A-452E-8D5F-3004797DE286} (Intel(R) PRO/1000 MT Desktop Adapter)
```

In this example, there’s only one network card, with the index 0, installed on the system. If there are multiple network cards, remember the index of the device you want to use for capturing the traffic.

Modify the `device` setting to point to the index of the device:

```shell
packetbeat.interfaces.device: 0
```

packetbeat setup -e
```

packetbeat setup -e
```

./packetbeat setup -e
```

./packetbeat setup -e
```

PS > .\packetbeat.exe setup -e
```

sudo service packetbeat start

sudo service packetbeat start

sudo chown root packetbeat.yml 1
sudo ./packetbeat -e

sudo chown root packetbeat.yml 1
sudo ./packetbeat -e

PS C:\Program Files\packetbeat> Start-Service packetbeat

Packetbeat should begin streaming data to Elasticsearch.

Packetbeat comes with pre-built Kibana dashboards and UIs for visualizing log data. You loaded the dashboards earlier when you ran the setup command.

To open the dashboards:

1. Launch Kibana:

   <div class="tabs" data-tab-group="host">
   <div role="tablist" aria-label="Open Kibana">
   <button role="tab"
   aria-selected="true"
   aria-controls="cloud-tab-open-kibana"
   id="cloud-open-kibana">
   Elasticsearch Service
   </button>
   <button role="tab"
   aria-selected="false"
   aria-controls="self-managed-tab-open-kibana"
   id="self-managed-open-kibana"
   tabindex="-1">
   Self-managed
   </button>
   </div>
   <div tabindex="0"
   role="tabpanel"
   id="cloud-tab-open-kibana"
   aria-labelledby="cloud-open-kibana">

   1. Log in to your Elastic Cloud account.
   2. Navigate to the Kibana endpoint in your deployment.

   </div>
   <div tabindex="0"
   role="tabpanel"
   id="self-managed-tab-open-kibana"
   aria-labelledby="self-managed-open-kibana"
   hidden="">
   Point your browser to http://localhost:5601, replacing localhost with the name of the Kibana host.

   </div>
   </div>

2. In the side navigation, click Discover. To see Packetbeat data, make sure the predefined packetbeat-* data view is selected.

   Tip

   If you don’t see data in Kibana, try changing the time filter to a larger range. By default, Kibana shows the last 15 minutes.

3. In the side navigation, click Dashboard, then select the dashboard that you want to open.

The dashboards are provided as examples. We recommend that you customize them to meet your needs.

Now that you have your data streaming into Elasticsearch, learn how to unify your logs, metrics, uptime, and application performance data.

1. Ingest data from other sources by installing and configuring other Elastic Beats:

   Elastic Beats	To capture
   Metricbeat	Infrastructure metrics
   Filebeat	Logs
   Winlogbeat	Windows event logs
   Heartbeat	Uptime information
   APM	Application performance metrics
   Auditbeat	Audit events

2. Use the Observability apps in Kibana to search across all your data:

   Elastic apps	Use to
   Metrics app	Explore metrics about systems and services across your ecosystem
   Logs app	Tail related log data in real time
   Uptime app	Monitor availability issues across your apps and services
   APM app	Monitor application performance
   SIEM app	Analyze security events