diff --git a/docs/gettingstarted.asciidoc b/docs/gettingstarted.asciidoc index 13207b4420a7..0f6241a1a9fb 100644 --- a/docs/gettingstarted.asciidoc +++ b/docs/gettingstarted.asciidoc @@ -135,9 +135,9 @@ Before starting the shipper, edit the configuration file. For rpm and deb the configuration file is `/etc/packetbeat/packetbeat.yml`. For mac the configuration file is found in the archive you just downloaded. -First, select the network interface from which to capture the traffic. Packetbeat -supports capturing all messages sent or received by the server on which it is -installed. For this, use `any` as the device: +First, select the network interface from which to capture the traffic. On +Linux, Packetbeat supports capturing all messages sent or received by the +server on which it is installed. For this, use `any` as the device: [source,yaml] ---------------------------------------------------------------------- @@ -147,6 +147,10 @@ interfaces: device: any ---------------------------------------------------------------------- +Note that on OS X, capturing from the `any` device doesn't work. You would +typically use either `lo0` or `en0` depending on which traffic you want to +capture. + In the next section, configure the ports on which Packetbeat can find each protocol. If you use any non-standard ports, add them here. Otherwise, the default values should do just fine. diff --git a/docs/gettingstarted.in.asciidoc b/docs/gettingstarted.in.asciidoc index 1f17b77257a9..be5e25a6fa87 100644 --- a/docs/gettingstarted.in.asciidoc +++ b/docs/gettingstarted.in.asciidoc @@ -126,9 +126,9 @@ Before starting the shipper, edit the configuration file. For rpm and deb the configuration file is `/etc/packetbeat/packetbeat.yml`. For mac the configuration file is found in the archive you just downloaded. -First, select the network interface from which to capture the traffic. Packetbeat -supports capturing all messages sent or received by the server on which it is -installed. For this, use `any` as the device: +First, select the network interface from which to capture the traffic. On +Linux, Packetbeat supports capturing all messages sent or received by the +server on which it is installed. For this, use `any` as the device: [source,yaml] ---------------------------------------------------------------------- @@ -138,6 +138,10 @@ interfaces: device: any ---------------------------------------------------------------------- +Note that on OS X, capturing from the `any` device doesn't work. You would +typically use either `lo0` or `en0` depending on which traffic you want to +capture. + In the next section, configure the ports on which Packetbeat can find each protocol. If you use any non-standard ports, add them here. Otherwise, the default values should do just fine.