elastic / elastic/beats

packetbeat: per-stream interface and procs configuration silently dropped under OTel runtime

Open
#53,010 2 comments 0 reactions 1 assignee Claimed by @efd6 View on GitHub
Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

`packetbeat/beater/packetbeat.go:98-102` selects the config loader on
`b.Manager.Enabled()`. Under the OTel runtime that returns `false`, so
`FromStatic` is used. `FromStatic` reads `interfaces`, `procs`,
`ignore_outgoing` and related keys from the **top level** of the beat config.

`NewAgentConfig` (the process-runtime loader) hoists those keys out of each
stream entry. Under OTel, elastic-agent's `getInputsForUnit` nests streams
under `packetbeat.protocols`; there is no top-level `interfaces` or `procs`
key. `FromStatic` therefore finds nothing and falls back to
`[]InterfaceConfig{{Device: defaultDevice()}}` — `"any"` on Linux, which
works and masks the loss.

The following per-stream keys from the `network_traffic` stream templates are
silently dropped under OTel:

- `interface.device`, `interface.file`, `interface.type`, `interface.with_vlans`
- `interface.bpf_filter`, `interface.snaplen`, `interface.buffer_size_mb`
- `interface.internal_networks`
- `procs.enabled`
- `ignore_outgoing`

In addition, because `packet` lacks `single_receiver: true` in the Agent spec,
16 `network_traffic` datasets each start their own receiver with their own
capture handle on the same device. The interface deduplication, per-protocol
`procs` merge and combined BPF filter that `NewAgentConfig` + `setupSniffer`
provide are all bypassed. The `maxSniffers` cap
(`packetbeat/beater/reloader.go:40`) is also unreachable, as it lives in the
reload path which the OTel runtime does not use.

The fix for the dropped keys is the same as for #52931: the loader selected
under OTel must handle agent-shaped stream entries. `npcap.never_install` is
tracked separately in #53009.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.