anchor.diff:  
   Packetbeat supports three sniffer types:
   
  - * `pcap` which uses the libpcap library and works on most platforms, but
  + * `pcap`, which uses the libpcap library and works on most platforms, but
      it's not the fastest option.
  - * `af_paket` which uses memory mapped sniffing. It is faster than libpcap
  -   and doesn't require a kernel module, but it is Linux specific.
  - * `pf_ring` which makes use of an ntop.org
  -   http://www.ntop.org/products/pf_ring/[project]. This will get you the best
  -   sniffing speed but requires a kernel module and is Linux specific.
  -
  -The default sniffer is `pcap`. Here is an example configuration that switches
  -to the `af_packet` sniffing type:
  + * `af_packet`, which uses memory-mapped sniffing. This option is faster than libpcap
  +   and doesn't require a kernel module, but it's Linux-specific.
  + * `pf_ring`, which makes use of an ntop.org
  +   http://www.ntop.org/products/pf_ring/[project]. This setting provides the best
  +   sniffing speed, but it requires a kernel module, and it's Linux-specific.
  +
  +The default sniffer type is `pcap`. 
  +
  +Here is an example configuration that specifies 
  +the `af_packet` sniffing type:
   
   [source,yaml]
   ------------------------------------------------------------------------------
  
positive.code: ===== with_vlans
  
  Packetbeat automatically generates a
  https://en.wikipedia.org/wiki/Berkeley_Packet_Filter[BPF] for capturing only
  the traffic on the ports on which the known protocols are expected to be found.
  For example, if you have configured port 80 for HTTP and port 3306 for MySQL,
  Packetbeat will generate the following BPF filter: `"port 80 or port 3306"`.
  
  However, if the traffic contains https://en.wikipedia.org/wiki/IEEE_802.1Q[VLAN]
  tags, the above filter is ineffective because the offset used are moved with
  four bytes. To fix this, you can enabled the `with_vlans` option, which will
  generate a BPF filter looking like this: `"port 80 or port 3306 or (vlan and (port 80 or port 3306))"`.
  
  ===== bpf_filter
  
  Packetbeat automatically generates a
  https://en.wikipedia.org/wiki/Berkeley_Packet_Filter[BPF] for capturing only
  the traffic on the ports on which the known protocols are expected to be found.
  For example, if you have configured port 80 for HTTP and port 3306 for MySQL,
  Packetbeat will generate the following BPF filter: `"port 80 or port 3306"`.
  
  With this setting, you can overwrite the generated BPF filter. For example:
  
  [source,yaml]
  ------------------------------------------------------------------------------
  
negative.code:   device: eth0
  ------------------------------------------------------------------------------
  
  On Linux, you can specify `any` for the device, and Packetbeat captures all
  messages sent or received by the server where Packetbeat is installed. 
  
  NOTE: When you specify `any` for the device, the interfaces are not set
        to promiscuous mode.
  
  The `device` option also accepts specifying the device by its index in the list of
  devices available for sniffing. To obtain the list of available devices, 
  run Packetbeat with the following command: 
  
  ["source","sh",subs="attributes,callouts"]
  ----------------------------------------------------------------------
  packetbeat -devices
  ----------------------------------------------------------------------
  
  This command returns a list that looks something like the following:
  
  ["source","sh",subs="attributes,callouts"]
  ----------------------------------------------------------------------
  0: en0 (No description available)
  1: awdl0 (No description available)
  2: bridge0 (No description available)
  3: fw0 (No description available)
  4: en1 (No description available)
  5: en2 (No description available)
  6: p2p0 (No description available)
  7: en4 (No description available)
  8: lo0 (No description available)
  ----------------------------------------------------------------------
  
  The following example sets up sniffing on the 
  first interface in the list:
  
  [source,yaml]
  ------------------------------------------------------------------------------
  