log_unix.go:113: decodePktEth exception - runtime error: index out of range

[sammcj]

Jul  3 11:08:32 int-nginx-02 /usr/bin/packetbeat[20877]: log_unix.go:113: decodePktEth exception. Recovering, but please report this: runtime error: index out of range.
Jul  3 11:08:32 int-nginx-02 /usr/bin/packetbeat[20877]: log_unix.go:114: Stacktrace: /home/vagrant/src/packetbeat/log_unix.go:114 (0x4250ae)#012/usr/local/go/src/pkg/runtime/panic.c:248 (0x452556)#012/usr/local/go/src/pkg/runtime/panic.c:482 (0x452dfd)#012/usr/local/go/src/pkg/runtime/panic.c:433 (0x452c17)#012/home/vagrant/src/packetbeat/main.go:123 (0x425dcd)#012/home/vagrant/src/packetbeat/main.go:339 (0x4274f1)#012/usr/local/go/src/pkg/runtime/proc.c:220 (0x45432f)#012/usr/local/go/src/pkg/runtime/proc.c:1394 (0x456860)

No idea where it's getting 'home/vagrant' from as we don't use vagrant.

Config:

[elasticsearch]
host  = "int-elastic-01"
port  = 9200
index = "packetbeat"

[interfaces]
device = "any"

[agent]
name= "int-nginx-02"

[runoptions]
uid=450
gid=450

[procs]

  [procs.monitored.nginx]
  cmdline_grep = "nginx"

[packetb-old]

Thanks for posting the stacktrace. There seems to be some weird IP header length value causing this (smaller than 20). In any case, we'll fix the stacktrace.

[sammcj]

Thanks @packetbeat , let me know if there is anything I can do to help you.

[packetb-old]

Sorry for following back so late. The only way we could imagine that stacktrace could have been caused is with an IP header length smaller than 20 bytes, but that's invalid according to RFC 791. We're now ignoring packets like this. We'll make a maintenance release to contain this in a week or two.

If you suspect the problem could be something else, it might be useful if you could do a small pcap trace and send it to us. See http://packetbeat.com/docs/troubleshooting.html#recording-a-trace for details.