Packetbeat Dashboards in NeQter

Packetbeat data describes observed network transactions. In NeQter, these dashboards are grouped under Packets. Use them to investigate traffic sources and destinations, protocol errors, HTTP and TLS activity, DNS responses, and DHCP exchanges.

Table of contents

• Packetbeat Dashboards in NeQter
  • Packetbeat dashboard set
  • Enable the dashboards
  • Packet overview workflow
  • HTTP and TLS workflow
  • DNS and DHCP workflow
  • Dashboard actions
  • Troubleshooting

Packetbeat dashboard set

These dashboards do not replace full packet capture. Packetbeat records transaction metadata and parsed protocol fields. It does not decrypt encrypted application content.

Enable the dashboards

1. Confirm the NeQter agent is sending packet-inspection data from the intended capture point.
2. Open Logs → Settings. The main navigation’s Settings → Dashboards provides the same dashboard management controls.
3. Enter Packets in Search index labels or dashboards.
4. Turn on Enable index for Packets if it is off.
5. Select Packet overview, Packet HTTP and TLS, and Packet DNS and DHCP as needed.
6. Select Apply changes at the top.
7. Open Logs → Dashboards, enter Packets in Search…, and press Enter.
8. Select the dashboard title you need.

If the dashboards are enabled but empty, check the capture point, selected time range, active filters, and whether the observed traffic includes the expected protocol.

Packet overview workflow

Start here when you know a host or a time window but have not yet isolated the protocol or destination involved.

1. Open Packets - Packet overview and choose Last 24 hours, or use Show dates to set an absolute incident interval.
2. Check the query and filter pills, then select Refresh.
3. Read Top 20 source addresses list to identify busy sources. Scroll through the dashboard to compare destination ports, hosts creating or receiving traffic, and Top 10 network flows between hosts.
4. In Packets - Filter controls, choose a Capture Host when you need to isolate one agent’s observations. Use Source IP or Destination IP to isolate an endpoint; the capture host and traffic endpoints can be different systems.
5. Select Apply changes at the bottom of the controls panel. Scroll inside the panel if necessary, or use its three-dot menu → Maximize panel to reveal all controls.
6. Compare Top 10 protocols with errors count, the corresponding time chart, and Connections over time to find when the activity changed.
7. Scroll to Packet inspection traffic and expand a record using its row arrow to inspect the individual transaction. For a broader field search, open Discover, choose the Packets source, and reproduce the same time range and filters.

To remove a control selection, remove its selected value and select Apply changes. Clear form resets the control selections; review the filter pills afterward. Use the panel menu’s Minimize to return from a maximized panel. The main query, filter pills, and time range remain separate conditions.

An empty country panel can coexist with populated address and traffic panels because private addresses may not have geographic enrichment. Counts, byte totals, and unique-flow counts measure different things; read each panel’s title and units before comparing them.

HTTP and TLS workflow

Use the HTTP/TLS dashboard to review web transactions and TLS negotiation metadata.

1. Open Packets - Packet HTTP and TLS and set the time range.
2. In Packets - Filter controls, choose Capture Host, Source IP, Destination IP, or Destination Port to isolate the relevant traffic.
3. For web-application troubleshooting, use HTTP Domain, HTTP Method, or HTTP Status Code. For TLS negotiation, use TLS Server Name, TLS Version, or TLS Session Established.
4. Select Apply changes. Maximize the controls panel or scroll inside it to reach the lower controls.
5. Compare Total HTTP transactions, HTTP Transactions over time, and Top 10 HTTP status codes for web traffic. For TLS, compare the versions, alerts, established sessions, and server-name panels.
6. Scroll to Packet inspection traffic. Check network.protocol, http.response.status_code, and the source/destination addresses and ports. Expand a row for the complete record.

For example, to review responses with status code 500, select Add filter → http.response.status_code → is, enter 500, and select Save. Remove the filter afterward to compare other response codes. An HTTP transaction can be present even when no response-status field was parsed.

Encrypted application content is not decrypted merely because TLS metadata is present.

DNS and DHCP workflow

Use the DNS/DHCP dashboard to review name-resolution and address-assignment activity.

For DNS investigations:

1. Open Packets - Packet DNS and DHCP and set the time range.
2. Use Protocol, Source IP, or Destination IP to focus on DNS traffic and the relevant client or server.
3. Choose DNS Query Name, DNS Query Type, DNS Response Code, or DNS Resolved IP, then select Apply changes.
4. Review DNS Min/Max/Avg Response Time, the request-status panels, and the DNS client/server panels. The response-time chart labels its values in nanoseconds; do not read those values as milliseconds.
5. Scroll to Packet Inspection DNS traffic and compare dns.response_code, dns.type, dns.question.registered_domain, and dns.resolved_ip. Expand a row to review all parsed fields.

For a failed-name lookup example, use Add filter → dns.response_code → is → NXDOMAIN, then Save. Use a value present in your data; remove the filter afterward to compare the successful responses.

A high query count is not automatically malicious. Confirm repetition, response results, timing, and the host responsible.

For DHCP investigations:

1. In the same dashboard, use DHCP Client MAC, DHCP Assigned IP, or DHCP Message Type to select the client or exchange you need, then select Apply changes.
2. Compare the DHCP transaction count, client count, message-type chart, and data-transfer panels. A unique-transaction count and a unique-client count answer different questions.
3. Review Packet inspection DHCP traffic for dhcpv4.client_mac, dhcpv4.assigned_ip, and the subnet, DNS-server, domain-name, and server-identifier fields.
4. Expand the relevant record to inspect the exchange. Confirm that both the requests and responses were visible from the capture point before concluding that a lease failed.

Packetbeat can only display traffic visible to the capture point.

Dashboard actions

Troubleshooting

For DQL syntax and saved-search instructions, see Discover.

Return to Dashboards