elastic / elastic/integrations

[Network Packet Capture] bpf_filter not available

Open
#14,267 3 comments 1 reaction 0 assignees View on GitHub
enhancement Integration:network_traffic needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Network Packet Capture [network_traffic]

### Dataset Name

_No response_

### Integration Version

1.33.0

### Agent Version

8.17.5

### OS Version and Architecture

Ubuntu 18.04 LTS

### User Goal

The Network Packet Capture integration does not allow for specifying addtional bpf_filter. In the [documentation ](https://www.elastic.co/docs/reference/beats/packetbeat/configuration-interfaces#_bpf_filter)for packetbeat, it's referenced that user can set a bpf_filter for specific network and this is not an option through fleet integrations UI in Kibana.

Packetbeat runs with its automatically generated filter from the integration. This forces agents to process all allowed traffic, which:
* produces excess data
* prevents me from narrowing capturing data to to relevant subnets. I.e multiple packetbeats on a host with different datasets

### Existing Features

N/A

### What did you see?

N/A

### Anything else?

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.