Initializing af_packet sniffer failed

[lopaz]

packetbeat.yml:
interfaces:
device: any
type: af_packet

ERROR Log:
2015/12/14 03:35:53.074127 sniffer.go:129: DBG Sniffer type: af_packet device: any
2015/12/14 03:35:53.079966 packetbeat.go:195: CRIT Initializing sniffer failed: Error creating sniffer: setsockopt packet_rx_ring: cannot allocate memory

uname -a output:
Linux testmachine1 2.6.32-504.el6.x86_64 #1 SMP Wed Oct 15 04:27:16 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

packetbeat rpm:
https://download.elastic.co/beats/packetbeat/packetbeat-1.0.0-x86_64.rpm

free output:
total used free shared buffers cached
Mem: 3924628 2014656 1909972 8 176064 1584936
-/+ buffers/cache: 253656 3670972
Swap: 4194300 6196 4188104

[djschny]

FYI - ran into this on darwin as well

2016/03/15 19:15:42.570876 packetbeat.go:215: CRIT Initializing sniffer failed: Error creating decoder: Unsupported link type: UnknownLinkType(12)
Darwin djschny.local 15.3.0 Darwin Kernel Version 15.3.0: Thu Dec 10 18:40:58 PST 2015; root:xnu-3248.30.4~1/RELEASE_X86_64 x86_641

[andrewkroh]

@djschny af_packet isn't available on darwin because it's part of the Linux kernel. https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html#_type

[dberuben]

I have the same issue

interfaces:
device: any
type: af_packet

version
packetbeat-1.1.2-1.x86_64

ERROR
2016/03/23 14:52:15.140040 packetbeat.go:215: CRIT Initializing sniffer failed: Error creating sniffer: setsockopt packet_rx_ring: cannot allocate memory

Memory

[root@localhost packetbeat]# free -om
total used free shared buffers cached
Mem: 4009 3224 785 0 314 773
Swap: 0 0 0

Linux Centos 6.7
uname -a
Linux localhost 2.6.32-431.5.1.el6.x86_64 #1 SMP Wed Feb 12 00:41:43 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

[sysulq]

+1

packetbeat version 5.0.0-SNAPSHOT (amd64), libbeat 5.0.0-SNAPSHOT
CentOS release 6.4 (Final)
2.6.32-431.23.3.el6.x86_64 #1 SMP Thu Jul 31 17:20:51 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

[monicasarbu]

As a temporary workaround, I suggest to set the snaplen configuration option:

packetbeat.interfaces.device: any
packetbeat.interfaces.type: af_packet
packetbeat.interfaces.snaplen: 1500

[EBWi11]

Unfortunately,I also encountered a similar problem...
uname -a:Linux localhost 2.6.32-696.el6.x86_64 #1 SMP Tue Mar 21 19:29:05 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
ser
packetbeat --version:packetbeat version 6.1.1 (amd64), libbeat 6.1.1

and configure is :
packetbeat.interfaces.device: any
packetbeat.interfaces.type: af_packet
packetbeat.interfaces.buffer_size_mb: 200
packetbeat.interfaces.snaplen: 1500

[urso]

Closing. This is an old issue without any progress for a long time. af_packet needs to allocate some continues memory in the kernel as a shared ring buffer. If this fails, or if the user is not allowed to create more RAW sockets, then af_packet initialization will fail.

Feel free to comment if the issue still persists.