search

cisco / joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Other
1.31k stars 329 forks source link

Error: could not parse filter ip or vlan: no VLAN support for data link type 113 #196

Closed decaby7e closed 6 years ago

decaby7e commented 6 years ago

After passing a pcap file through joy, I am returned with this error:

error: could not parse filter ip or vlan: no VLAN support for data link type 113

Any help would be appreciated. I can submit further information if needed.

bhudson33 commented 6 years ago

This error comes from the libpcap library and not the joy code base itself. It appears you have a data link type that isn't supported by libpcap. I would look into the libpcap documentation and see if there is something there that can help you get past this error.

bhudson33 commented 6 years ago

closing issues due to libpcap limitation and work around discovered.

shaw827 commented 5 years ago

I get the same issue. I will appreciate if you could post the workaround.

gproman commented 4 years ago

I too have the same issue and would appreciate if someone could post the workaround.

decaby7e commented 4 years ago

I cannot recall the exact steps that I took to resolve this but I would like to say that I was passing Joy the incorrect file format. So I was saving a PCAPNG rather than a PCAP. I would recommend trying the tool with sample PCAPs from online somewhere and seeing if that causes the same error to be thrown.