Capture network interface device name with Packetbeat

Question

With Packetbeat on Linux, the packetbeat.interfaces.device: any configuration captures all messages sent or received by the server where Packetbeat is installed.

I want to distinguish the messages captured by the interface over which they were exchanged e.g. which messages were exchanged over interface eth0 and which ones were exchanged over wlan0. From the logs, I couldn't find a field with this information.

Is there a way to include the interface device name with Packetbeat logs using some configuration? If not, are there any alternative ways that I could go about capturing the same with the Packetbeat logs?

Answer 1

Packetbeat seems to be more application- or transaction-focused than a classic network analyzer: essentially, it's a network analyzer for application developers, and focuses on Layer-3 and above.

If the IP addresses are not enough to specify the interface, then you are doing bridging or some more advanced Layer-2 manipulations. If you need Layer-2 information (= physical interfaces, MAC addresses, Ethernet frame headers), then Packetbeat seems to be the wrong tool; for low-level details like that, you would need a network analyzer designed for network engineers instead.

It could be argued that the need to figure out whether particular traffic came from eth0 or wlan0 could suggest a possible network design issue: if the IP addresses cannot successfully identify them, then you might be bridging together two network segments with different security postures (bad idea!) or perhaps your hosts and/or routers don't have adequate reverse path filtering (so you should perhaps fix that first).