search

ahobson / ruby-pcap

Ruby interface to LBL Packet Capture library.
http://www.goto.info.waseda.ac.jp/~fukusima/ruby/pcap-e.html
GNU General Public License v2.0
76 stars 32 forks source link

Unknown data-link type (127) (Pcap::PcapError) #8

Open brundage opened 8 years ago

brundage commented 8 years ago

When trying to capture packets from a wireless NIC in monitor mode I get this error

capture/ip.rb:20:in 'each_packet': Unknown data-link type (127) (Pcap::PcapError)

Network configurations:

% ifconfig wlp3s0
wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 169.254.146.135  netmask 255.255.0.0  broadcast 169.254.255.255
        unspec EC-08-6B-43-37-3C-D0-E6-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 208359  bytes 41201859 (39.2 MiB)
        RX errors 0  dropped 205629  overruns 0  frame 0
        TX packets 382  bytes 136999 (133.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

% iwconfig wlp3s0
wlp3s0    IEEE 802.11bgn  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=15 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

Looks like ruby-pcap only understands the first 14 link-layer header types. It appears there are actually 256.