Skip to content

Unknown data-link type (127) (Pcap::PcapError) #8

Description

@brundage

When trying to capture packets from a wireless NIC in monitor mode I get this error

capture/ip.rb:20:in 'each_packet': Unknown data-link type (127) (Pcap::PcapError)

Network configurations:

% ifconfig wlp3s0
wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 169.254.146.135  netmask 255.255.0.0  broadcast 169.254.255.255
        unspec EC-08-6B-43-37-3C-D0-E6-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 208359  bytes 41201859 (39.2 MiB)
        RX errors 0  dropped 205629  overruns 0  frame 0
        TX packets 382  bytes 136999 (133.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

% iwconfig wlp3s0
wlp3s0    IEEE 802.11bgn  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=15 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

Looks like ruby-pcap only understands the first 14 link-layer header types. It appears there are actually 256.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions