packetbeat 5.x memcache cannot be disabled

[clennpillo]

For confirmed bugs, please report:

• Version:
  packetbeat 5.x
• Operating System:
  macosx, suselinux
• Steps to Reproduce:
  1)annotate memcache's port 11211 in packetbeat.yml
  2)run packetbeat with -d "sniffer" option
  3)you can see the 11211 is still on

[ruflin]

Could you please share your exact packetbeat version and your full packetbeat config file?

[clennpillo]

I tested packetbeat 5.4.0 and 5.2.1 with following command
./packetbeat -N -d "sniffer"

here is packbeat.yml
\#################### Packetbeat Configuration Example #########################

\# This file is an example configuration file highlighting only the most common
\# options. The packetbeat.full.yml file from the same directory contains all the
\# supported options with more comments. You can use it as a reference.
\#
\# You can find the full configuration reference here:
\# https://www.elastic.co/guide/en/beats/packetbeat/index.html

\#============================== Network device ================================

\# Select the network interface to sniff the data. On Linux, you can use the
\# "any" keyword to sniff on all connected interfaces.
packetbeat.interfaces.device: eth0
packetbeat.interfaces.bpf_filter: "net 9.12.203.36"

\#================================== Flows =====================================

\# Set `enabled: false` or comment out all options to disable flows reporting.
packetbeat.flows:
  \# Set network flow timeout. Flow is killed if no packet is received before being
  \# timed out.
  timeout: 30s

  \# Configure reporting period. If set to -1, only killed flows will be reported
  period: 10s
  enabled: false

\#========================== Transaction protocols =============================

packetbeat.protocols.icmp:
  \# Enable ICMPv4 and ICMPv6 monitoring. Default: false
  enabled: false

packetbeat.protocols.amqp:
  \# Configure the ports where to listen for AMQP traffic. You can disable
  \# the AMQP protocol by commenting out the list of ports.
  \#ports: [5672]

packetbeat.protocols.cassandra:
  \#Cassandra port for traffic monitoring.
  \#ports: [9042]

packetbeat.protocols.dns:
  \# Configure the ports where to listen for DNS traffic. You can disable
  \# the DNS protocol by commenting out the list of ports.
  \#ports: [53]

  \# include_authorities controls whether or not the dns.authorities field
  \# (authority resource records) is added to messages.
  \#include_authorities: true

  \# include_additionals controls whether or not the dns.additionals field
  \# (additional resource records) is added to messages.
  \#include_additionals: true

packetbeat.protocols.http:
  \# Configure the ports where to listen for HTTP traffic. You can disable
  \# the HTTP protocol by commenting out the list of ports.
  \#ports: [80, 8080, 8000, 5000, 8002]

packetbeat.protocols.memcache:
  \# Configure the ports where to listen for memcache traffic. You can disable
  \# the Memcache protocol by commenting out the list of ports.
  \#ports: [11211]

packetbeat.protocols.mysql:
  \# Configure the ports where to listen for MySQL traffic. You can disable
  \# the MySQL protocol by commenting out the list of ports.
  \#ports: [3306]

packetbeat.protocols.pgsql:
  \# Configure the ports where to listen for Pgsql traffic. You can disable
  \# the Pgsql protocol by commenting out the list of ports.
  \#ports: [5432]

packetbeat.protocols.redis:
  \# Configure the ports where to listen for Redis traffic. You can disable
  \# the Redis protocol by commenting out the list of ports.
  \#ports: [6379]

packetbeat.protocols.thrift:
  \# Configure the ports where to listen for Thrift-RPC traffic. You can disable
  \# the Thrift-RPC protocol by commenting out the list of ports.
  \#ports: [9090]

packetbeat.protocols.mongodb:
  \# Configure the ports where to listen for MongoDB traffic. You can disable
  \# the MongoDB protocol by commenting out the list of ports.
  \#ports: [27017]

packetbeat.protocols.nfs:
  \# Configure the ports where to listen for NFS traffic. You can disable
  \# the NFS protocol by commenting out the list of ports.
  \#ports: [2049]

\#================================ General =====================================

\# The name of the shipper that publishes the network data. It can be used to group
\# all the transactions sent by a single shipper in the web interface.
\#name:

\# The tags of the shipper are included in their own field with each
\# transaction published.
\#tags: ["service-X", "web-tier"]

\# Optional fields that you can specify to add additional information to the
\# output.
\#fields:
\#  env: staging

\#================================ Outputs =====================================

\# Configure what outputs to use when sending the data collected by the beat.
\# Multiple outputs may be used.

\#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  \# Array of hosts to connect to.
  hosts: ["localhost:9200"]

  \# Optional protocol and basic auth credentials.
  \#protocol: "https"
  \#username: "elastic"
  \#password: "changeme"

\#----------------------------- Logstash output --------------------------------
\#output.logstash:
  \# The Logstash hosts
  \#hosts: ["localhost:5044"]

  \# Optional SSL. By default is off.
  \# List of root certificates for HTTPS server verifications
  \#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  \# Certificate for SSL client authentication
  \#ssl.certificate: "/etc/pki/client/cert.pem"

  \# Client Certificate Key
  \#ssl.key: "/etc/pki/client/cert.key"

\#================================ Logging =====================================

\# Sets log level. The default log level is info.
\# Available log levels are: critical, error, warning, info, debug
\#logging.level: debug

\# At debug level, you can selectively enable logging only for some components.
\# To enable all selectors use ["*"]. Examples of other selectors are "beat",
\# "publish", "service".
\#logging.selectors: ["*"]

[ruflin]

To disable memcache, you have to comment out the complete block:

#packetbeat.protocols.memcache:
  # Configure the ports where to listen for memcache traffic. You can disable
  # the Memcache protocol by commenting out the list of ports.
  #ports: [11211]

Can you please try that?

[clennpillo]

I can do that, while disabling other protocols doesn't need to do so, i can just comment out the list of ports as the instruction says.

[zecke]

Commenting out the line with packetbeat.protocols.memcache: changes the BPF filter to ''.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.