Re: [Ethereal-users] pcap: network type 15 unknown or unsupported

[Guy Harris <gharris@xxxxxxxxx>]

diaz_d1@xxxxxx wrote:

> i'm trying to read a file with Ethreal 0.10.11 (Win version) but I get that
> error "pcap: network type 15 unknown or unsupported. The file was captured
> with tcpdump version 3.3, aditional data about interface is:
>
> vpp0c0:  lname vpp0c0
> flags=4f<UP,PHYS_AVAIL,LINK_AVAIL,POINTOPOINT,MULTICAST> encaps chdlc
>         inet mtu 1500 unnumbered (loop0c0)
>
> loop0c0:  lname loop0c0
> flags=57<UP,PHYS_AVAIL,LINK_AVAIL,LOOPBACK,MULTICAST>
>         inet6 mtu 63000 ::1 --> ::1
>         inet mtu 63000
>         inet 127.0.0.1 --> 127.0.0.1
>         inet 10.200.0.21 --> 10.200.0.21
>
> I did:
> tcpdump -i vpp0c0 -s 4096 -w LinkPoCal.cap
>
> Physical interface is ATM, vendor is Nokia and I'm trying to watch
> datagrams about 10.200.0.21 address.
>
> Could anybody tell me if is it possible to use Ethereal with this file?

If I could determine the link-layer header that appears in the file 
(NOTE: there is *NOT* always a simple correlation between the type of 
interface on which the file was captured, due to various additional 
headeers being added, link-layer headers being removed, headers being 
transformed, etc.), I could suggest a command that would read the file 
and write it out with a different link-layer type number.

15, unfortunately, is a type that means different things on different 
platforms, due to a lack of central coordination for assignment of 
values to link-layer types (which is why anybody who wants a link-layer 
type should now go through tcpdump.org - before tcpdump.org existed, 
people often just picked the "next available" number, and unfortunately 
that meant that different people would pick the same number for 
different purposes).  That's why Ethereal doesn't support it.

> (See attached file: LinkPoCal.rar)

I did, but the only software on my machine I know of that can handle 
.rar files - Stuffit Expander - gave an error.

Could you just send LinkPoCal.cap as a binary attachment?