[[faq]]
== Common problems

This section describes common problems you might encounter with
{beatname_uc}. Also check out the
https://discuss.elastic.co/c/beats/{beatname_lc}[{beatname_uc} discussion forum].

[[dashboard-fields-incorrect]]
=== Dashboard in {kib} is breaking up data fields incorrectly

The index template might not be loaded correctly. See <<packetbeat-template>>.

[[packetbeat-mirror-ports]]
=== {beatname_uc} doesn't see any packets when using mirror ports

The interface needs to be set to promiscuous mode. Run the following command:

["source","sh",subs="attributes,callouts"]
----
ip link set <device_name> promisc on
----

For example: `ip link set enp5s0f1 promisc on`

[[packetbeat-loopback-interface]]
=== {beatname_uc} can't capture traffic from Windows loopback interface

The Windows TCP/IP stack does not implement a network loopback interface, making
it difficult for Windows packet capture drivers to capture traffic from the
loopback device (127.0.0.1 traffic). To resolve this issue, install
https://nmap.org/npcap/[Npcap] in WinPcap API-compatible mode and select the
option to support loopback traffic. When you restart Windows, Npcap creates an
Npcap Loopback Adapter that you can select to capture loopback traffic.

For the list of devices shown here, you would configure {beatname_uc}
to use device `4`:

["source","sh",subs="attributes"]
----
PS C:\Program Files{backslash}{beatname_uc} .{backslash}{beatname_lc}.exe -devices
0: \Device\NPF_NdisWanBh (NdisWan Adapter)
1: \Device\NPF_NdisWanIp (NdisWan Adapter)
2: \Device\NPF_NdisWanIpv6 (NdisWan Adapter)
3: \Device\NPF_{DD72B02C-4E48-4924-8D0F-F80EA2755534} (Intel(R) PRO/1000 MT Desktop Adapter)
4: \Device\NPF_{77DFFCAF-1335-4B0D-AFD4-5A4685674FAA} (MS NDIS 6.0 LoopBack Driver)
----

[[packetbeat-missing-transactions]]
=== {beatname_uc} is missing long running transactions

{beatname_uc} has an internal timeout that it uses to time out transactions and TCP connections
when no packets have been seen for a long time.

To process long running transactions, you can specify a larger value for the <<transaction-timeout-option,`transaction_timeout`>>
option. However, keep in mind that very large timeout values can increase memory usage if messages are lost or transaction
response messages are not sent.

include::./faq-mysql-ssl.asciidoc[]

include::{libbeat-dir}/faq-limit-bandwidth.asciidoc[]

include::{libbeat-dir}/shared-faq.asciidoc[]

include::{libbeat-dir}/faq-refresh-index.asciidoc[]
