Packetbeat: af_packet doesn't put interface in promiscuous mode

[tsg]

It seems that the af_packet code from gopacket never puts the interface in promiscuous mode, which results in Packetbeat not seeing any packets when using mirror ports. The workaround is simple, make sure to run this command before starting packetbeat:

 ip link set enp5s0f1 promisc on

We should try to do the same programmatically from the af_packet code, so this is no longer required.

[dedemorton]

If you decide not to do this programmatically, it would be a good candidate to mention in the FAQ tracked by #699

[andrewkroh]

This one gets me every time I use af_packet. +1 on doing it programmatically within Packetbeat.

BTW this command works for me:

ifconfig eth0 promisc

[andrewkroh]

My workaround for this issue was to have systemd put the interface into promisc before it starts the service and stop it afterwards.

ip a
mkdir -p /etc/systemd/system/packetbeat.service.d
cat << EOF >> /etc/systemd/system/packetbeat.service.d/local.conf
[Service]
ExecStartPre=/sbin/ip link set dev eth0 promisc on
ExecStopPost=/sbin/ip link set dev eth0 promisc off
EOF
systemctl daemon-reload
systemctl restart packetbeat
ip a