Skip to content

Unknown data-link type (127) (Pcap::PcapError) #8

@brundage

Description

@brundage

When trying to capture packets from a wireless NIC in monitor mode I get this error

capture/ip.rb:20:in 'each_packet': Unknown data-link type (127) (Pcap::PcapError)

Network configurations:

% ifconfig wlp3s0
wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 169.254.146.135  netmask 255.255.0.0  broadcast 169.254.255.255
        unspec EC-08-6B-43-37-3C-D0-E6-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 208359  bytes 41201859 (39.2 MiB)
        RX errors 0  dropped 205629  overruns 0  frame 0
        TX packets 382  bytes 136999 (133.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

% iwconfig wlp3s0
wlp3s0    IEEE 802.11bgn  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=15 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

Looks like ruby-pcap only understands the first 14 link-layer header types. It appears there are actually 256.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions