packetbeat 抓取vpn tun网卡流量问题

通过ifconfig 查看网卡信息 如下

[root@vpn-master ~]# ifconfig 

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  

          inet addr:10.222.0.1  P-t-P:10.222.0.2  Mask:255.255.255.255

          UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST  MTU:1500  Metric:1

          RX packets:18267421 errors:0 dropped:0 overruns:0 frame:0

          TX packets:18199244 errors:0 dropped:2008 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:3884372772 (3.6 GiB)  TX bytes:14385587546 (13.3 GiB)

packetbeat版本

[root@vpn-master ~]# /usr/bin/packetbeat -version

packetbeat version 6.0.1 (amd64), libbeat 6.0.1

 
packetbeat.yml

#============================== Network device ================================



# Select the network interface to sniff the data. On Linux, you can use the

# "any" keyword to sniff on all connected interfaces.

packetbeat.interfaces.device: tun0

packetbeat.interfaces.type: af_packet

packetbeat.interfaces.buffer_size_mb: 100

packetbeat.interfaces.snaplen: 1514

我是想通过packetbeat抓取用户的http流量的，通过tcpdump 是OK的  
讲道理 底层都是通过libpcap  packetbeat就抓不到，