Create a proper ICMP only BPF filter

CHANGELOG.asciidoc

@@ -37,6 +37,7 @@ https://github.com/elastic/beats/compare/1.0.0...master[Check the HEAD diff]
 *Packetbeat*
 - Fix setting direction to out and use its value to decide when dropping events if ignore_outgoing is enabled {pull}557[557]
 - Allow PF_RING sniffer type to be configured using pf_ring or pfring {pull}671[671]
+- Create a proper BPF filter when ICMP is the only enabled protocol {issue}757[757]
 
 *Topbeat*
 

packetbeat/protos/protos.go

@@ -219,10 +219,11 @@ func (protocols ProtocolsStruct) BpfFilter(with_vlans bool, with_icmp bool) stri
 		}
 	}
 
-	filter := strings.Join(expressions, " or ")
 	if with_icmp {
-		filter = fmt.Sprintf("%s or icmp or icmp6", filter)
+		expressions = append(expressions, "icmp", "icmp6")
 	}
+
+	filter := strings.Join(expressions, " or ")
 	if with_vlans {
 		filter = fmt.Sprintf("%s or (vlan and (%s))", filter, filter)
 	}

packetbeat/protos/protos_test.go

@@ -114,6 +114,16 @@ func newProtocols() Protocols {
 	return p
 }
 
+func TestBpfFilterWithoutVlanOnlyIcmp(t *testing.T) {
+	p := ProtocolsStruct{}
+	p.all = make(map[Protocol]ProtocolPlugin)
+	p.tcp = make(map[Protocol]TcpProtocolPlugin)
+	p.udp = make(map[Protocol]UdpProtocolPlugin)
+
+	filter := p.BpfFilter(false, true)
+	assert.Equal(t, "icmp or icmp6", filter)
+}
+
 func TestBpfFilterWithoutVlanWithoutIcmp(t *testing.T) {
 	p := newProtocols()
 	filter := p.BpfFilter(false, false)