Troubleshooting Filebeat Not Receiving Packets when Replaying PCAP file with Tcpdump

In this article, we will discuss troubleshooting Filebeat not receiving packets while replaying a PCAP file using Tcpdump, focusing on UDP packets and IP address changes.

Prerequisites

Before we dive into the topic, make sure you have:

• A PCAP file containing UDP packets
• Two servers with different IP addresses in the same subnet
• Tcpdump installed on both servers
• Filebeat installed on the server where you want to receive the packets

Understanding the Problem

When replaying a PCAP file using Tcpdump, the destination MAC address and IP address might change. This can cause issues with Filebeat not receiving the packets. The reason behind this is that Filebeat relies on the source and destination IP addresses and MAC addresses to identify and process the packets.

Reproducing the Issue

To reproduce the issue, follow these steps:

1. Transfer the PCAP file to the server where you want to replay it.
2. Run Tcpdump on the source server to replay the PCAP file:

tcpdump -i eth0 -s 0 -r .pcap -w - | tshark -i - -T pdml -e frame.time -e ip.src -e ip.dst -e eth.src -e eth.dst -e data > output.pcap

This command will replay the PCAP file and write the output to a new file called "output.pcap".

2. Transfer the "output.pcap" file to the server where Filebeat is installed.
3. Run Filebeat:

filebeat -c filebeat.yml

If Filebeat does not receive the packets, you will see an error message in the Filebeat logs.

Solution

To resolve the issue, you need to ensure that the MAC and IP addresses in the PCAP file are correct. You can modify the MAC and IP addresses in the PCAP file using Tshark before replaying it.

Follow these steps:

1. Run Tshark to modify the MAC and IP addresses:

tshark -i output.pcap -o -F pcap:.pcap -e frame.time -e ip.src -e ip.dst -e eth.src -e eth.dst -X conversion.raw,, > new-output.pcap

Replace , , and with the desired MAC and IP addresses.

2. Transfer the "new-output.pcap" file to the server where Filebeat is installed.
3. Run Filebeat:

filebeat -c filebeat.yml

Filebeat should now receive the packets.

In this article, we discussed troubleshooting Filebeat not receiving packets while replaying a PCAP file using Tcpdump, focusing on UDP packets and IP address changes. We reproduced the issue and provided a solution by modifying the MAC and IP addresses in the PCAP file using Tshark before replaying it.

References

• Filebeat Troubleshooting Network
• Filebeat Installation on Linux
• Filebeat Network Module
• Tshark User Guide