LINK-LAYER HEADER TYPES

This is a list of link-layer header types used in pcap and pcap-ng capture files. The LINKTYPE_ name is the name given to that link-layer header type, and the LINKTYPE_ value is the numerical value used in capture files. The DLT_ name is the name corresponding to the value returned by pcap_datalink() and pcap_datalink_ex(); in most cases, the LINKTYPE_ value and DLT_ value are the same, but, in some cases, they differ, for reasons of binary compatibility, with the DLT_ value being different on different platforms.

Note that these values correspond to particular header formats; there might be multiple link-layer header types for a given link-layer protocol, as, for a given link-layer header type, the header for the link-layer protocol might be preceded by a pseudo-header giving additional information, or might be transformed in some way from the way it's specified for that link-layer protocol, e.g. fields in the link-layer protocol header might be removed, added, moved, or modified.

Values not listed here are reserved:

  • Values in the range 147 through 162 are reserved for private use; if you have some link-layer header type that you want to use within your organization, with the capture files using that link-layer header type not ever be sent outside your organization, you can use one or more these values. No libpcap release will use these for any purpose, nor will any tcpdump release use them, either.

    Do NOT use these in capture files that you expect anybody not using your private versions of capture-file-reading tools to read; in particular, do NOT use them in products, otherwise you may find that people won't be able to use tcpdump, or snort, or Wireshark, or... to read capture files from your firewall/intrusion detection/traffic monitoring/etc. appliance, or whatever product uses that link-layer header type value, and you may also find that the developers of those applications will not accept patches to let them read those files.

    Also, do not use them if somebody might send you a capture using them for their private type and tools using them for your private type would have to read them.

  • All other values are reserved for current or future uses. If you need a value for a particular set of link-layer headers, you must request one; to do so, send a mail message to tcpdump-workers@lists.tcpdump.org.

    Please include either an indication of the standard that describes the link-layer headers, a link to a page describing the link-layer headers, or a detailed description of the link-layer headers. If the headers do not exactly match the description in a standard or standards - for example, if fields are added, removed, or reordered, or have their size or format changed, please describe the changes in detail.

    Do NOT add new values to this list without asking tcpdump-workers@lists.tcpdump.org for a value. Otherwise, you run the risk of using a value that's already being used for some other purpose, and of having tools that read libpcap-format captures not being able to handle captures with your new link-layer header type value, with no hope that they will ever be changed to do so (as that would destroy their ability to read captures using that value for that other purpose).

    Do NOT use any of these link-layer header type values unless your link-layer headers EXACTLY match the specification. If they do not exactly match, request your own link-layer header type for them.

Link-layer header type values

LINKTYPE_ name LINKTYPE_ value Corresponding DLT_ name Description
LINKTYPE_NULL0DLT_NULL BSD loopback encapsulation; the link layer header is a 4-byte field, in host byte order, containing a value of 2 for IPv4 packets, a value of either 24, 28, or 30 for IPv6 packets, a value of 7 for OSI packets, or a value of 23 for IPX packets. All of the IPv6 values correspond to IPv6 packets; code reading files should check for all of them.

Note that ``host byte order'' is the byte order of the machine on which the packets are captured; if a live capture is being done, ``host byte order'' is the byte order of the machine capturing the packets, but if a ``savefile'' is being read, the byte order is not necessarily that of the machine reading the capture file.

LINKTYPE_ETHERNET1DLT_EN10MB IEEE 802.3 Ethernet (10Mb, 100Mb, 1000Mb, and up); the 10MB in the DLT_ name is historical.
LINKTYPE_AX253DLT_AX25 AX.25 packet, with nothing preceding it.
LINKTYPE_IEEE802_56DLT_IEEE802 IEEE 802.5 Token Ring; the IEEE802, without _5, in the DLT_ name is historical.
LINKTYPE_ARCNET_BSD7DLT_ARCNET ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999, but without the Starting Delimiter, Information Length, or Frame Check Sequence fields, and with only the first ISU of the Destination Identifier. For most packet types, ARCNET Trade Association draft standard ATA 878.2 is also used. See also RFC 1051 and RFC 1201; for RFC 1051 frames, ATA 878.2 is not used.
LINKTYPE_SLIP8DLT_SLIP SLIP, encapsulated with a LINKTYPE_SLIP header.
LINKTYPE_PPP9DLT_PPP PPP, as per RFC 1661 and RFC 1662; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like framing, with the PPP header following those two bytes, otherwise it's PPP without framing, and the packet begins with the PPP header. The data in the frame is not octet-stuffed or bit-stuffed.
LINKTYPE_FDDI10DLT_FDDI FDDI, as specified by ANSI INCITS 239-1994.
LINKTYPE_PPP_HDLC50DLT_PPP_SERIAL PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP with HDLC framing. The data in the frame is not octet-stuffed or bit-stuffed.
LINKTYPE_PPP_ETHER51DLT_PPP_ETHER PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
LINKTYPE_ATM_RFC1483100DLT_ATM_RFC1483 RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an ISO 8802-2 (formerly known as IEEE 802.2) LLC header.
LINKTYPE_RAW101DLT_RAW Raw IP; the packet begins with an IPv4 or IPv6 header, with the "version" field of the header indicating whether it's an IPv4 or IPv6 header.
LINKTYPE_C_HDLC104DLT_C_HDLC Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
LINKTYPE_IEEE802_11105DLT_IEEE802_11 IEEE 802.11 wireless LAN.
LINKTYPE_FRELAY107DLT_FRELAY Frame Relay LAPF frames, beginning with a ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.
LINKTYPE_LOOP108DLT_LOOP OpenBSD loopback encapsulation; the link-layer header is a 4-byte field, in network byte order, containing a value of 2 for IPv4 packets, a value of either 24, 28, or 30 for IPv6 packets, a value of 7 for OSI packets, or a value of 23 for IPX packets. All of the IPv6 values correspond to IPv6 packets; code reading files should check for all of them.
LINKTYPE_LINUX_SLL113DLT_LINUX_SLL Linux "cooked" capture encapsulation.
LINKTYPE_LTALK114DLT_LTALK Apple LocalTalk; the packet begins with an AppleTalk LocalTalk Link Access Protocol header, as described in chapter 1 of Inside AppleTalk, Second Edition.
LINKTYPE_PFLOG117DLT_PFLOG OpenBSD pflog; the link-layer header contains a "struct pfloghdr" structure, as defined by the host on which the file was saved. (This differs from operating system to operating system and release to release; there is nothing in the file to indicate what the layout of that structure is.)
LINKTYPE_IEEE802_11_PRISM119DLT_PRISM_HEADER Prism monitor mode information followed by an 802.11 header.
LINKTYPE_IP_OVER_FC122DLT_IP_OVER_FC RFC 2625 IP-over-Fibre Channel, with the link-layer header being the Network_Header as described in that RFC.
LINKTYPE_SUNATM123DLT_SUNATM ATM traffic, encapsulated as per the scheme used by SunATM devices.
LINKTYPE_IEEE802_11_RADIOTAP127DLT_IEEE802_11_RADIO Radiotap link-layer information followed by an 802.11 header.
LINKTYPE_ARCNET_LINUX129DLT_ARCNET_LINUX ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999, but without the Starting Delimiter, Information Length, or Frame Check Sequence fields, with only the first ISU of the Destination Identifier, and with an extra two-ISU "offset" field following the Destination Identifier. For most packet types, ARCNET Trade Association draft standard ATA 878.2 is also used; however, no exception frames are supplied, and reassembled frames, rather than fragments, are supplied. See also RFC 1051 and RFC 1201; for RFC 1051 frames, ATA 878.2 is not used.
LINKTYPE_APPLE_IP_OVER_IEEE1394138DLT_APPLE_IP_OVER_IEEE1394 Apple IP-over-IEEE 1394 cooked header.
LINKTYPE_MTP2_WITH_PHDR139DLT_MTP2_WITH_PHDR Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703, preceded by a pseudo-header.
LINKTYPE_MTP2140DLT_MTP2 Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703.
LINKTYPE_MTP3141DLT_MTP3 Signaling System 7 Message Transfer Part Level 3, as specified by ITU-T Recommendation Q.704, with no MTP2 header preceding the MTP3 packet.
LINKTYPE_SCCP142DLT_SCCP Signaling System 7 Signalling Connection Control Part, as specified by ITU-T Recommendation Q.711, ITU-T Recommendation Q.712, ITU-T Recommendation Q.713, and ITU-T Recommendation Q.714, with no MTP3 or MTP2 headers preceding the SCCP packet.
LINKTYPE_DOCSIS143DLT_DOCSIS DOCSIS MAC frames, as described by the DOCSIS 3.1 MAC and Upper Layer Protocols Interface Specification or earlier specifications for MAC frames.
LINKTYPE_LINUX_IRDA144DLT_LINUX_IRDA Linux-IrDA packets, with a LINKTYPE_LINUX_IRDA header, with the payload for IrDA frames beginning with by the IrLAP header as defined by IrDA Data Specifications, including the IrDA Link Access Protocol specification.
LINKTYPE_USER0-LINKTYPE-USER15147-162DLT_USER0-DLT_USER15 Reserved for private use; see above.
LINKTYPE_IEEE802_11_AVS163DLT_IEEE802_11_RADIO_AVS AVS monitor mode information followed by an 802.11 header.
LINKTYPE_BACNET_MS_TP165DLT_BACNET_MS_TP BACnet MS/TP frames, as specified by section 9.3 MS/TP Frame Format of ANSI/ASHRAE Standard 135, BACnet® - A Data Communication Protocol for Building Automation and Control Networks, including the preamble and, if present, the Data CRC.
LINKTYPE_PPP_PPPD166DLT_PPP_PPPD PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC, but with the 0xff address byte replaced by a direction indication - 0x00 for incoming and 0x01 for outgoing.
LINKTYPE_GPRS_LLC169DLT_GPRS_LLC General Packet Radio Service Logical Link Control, as defined by 3GPP TS 04.64.
LINKTYPE_GPF_T170DLT_GPF_T Transparent-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.
LINKTYPE_GPF_F171DLT_GPF_F Frame-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.
LINKTYPE_LINUX_LAPD177DLT_LINUX_LAPD Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, captured via vISDN, with a LINKTYPE_LINUX_LAPD header, followed by the Q.921 frame, starting with the address field.
LINKTYPE_MFR182DLT_MFR FRF.16.1 Multi-Link Frame Relay frames, beginning with an FRF.12 Interface fragmentation format fragmentation header.
LINKTYPE_BLUETOOTH_HCI_H4187DLT_BLUETOOTH_HCI_H4 Bluetooth HCI UART transport layer; the frame contains an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.
LINKTYPE_USB_LINUX189DLT_USB_LINUX USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. Only the first 48 bytes of that header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file's magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block.
LINKTYPE_PPI192DLT_PPI Per-Packet Information information, as specified by the Per-Packet Information Header Specification, followed by a packet with the LINKTYPE_ value specified by the pph_dlt field of that header.
LINKTYPE_IEEE802_15_4_WITHFCS195DLT_IEEE802_15_4_WITHFCS IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame.
LINKTYPE_SITA196DLT_SITA Various link-layer types, with a pseudo-header, for SITA.
LINKTYPE_ERF197DLT_ERF Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF records.
LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR201DLT_BLUETOOTH_HCI_H4_WITH_PHDR Bluetooth HCI UART transport layer; the frame contains a 4-byte direction field, in network byte order (big-endian), the low-order bit of which is set if the frame was sent from the host to the controller and clear if the frame was received by the host from the controller, followed by an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.
LINKTYPE_AX25_KISS202DLT_AX25_KISS AX.25 packet, with a 1-byte KISS header containing a type indicator.
LINKTYPE_LAPD203DLT_LAPD Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, starting with the address field, with no pseudo-header.
LINKTYPE_PPP_WITH_DIR204DLT_PPP_WITH_DIR PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" and a non-zero value meaning "sent by this host"; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like framing, with the PPP header following those two bytes, otherwise it's PPP without framing, and the packet begins with the PPP header. The data in the frame is not octet-stuffed or bit-stuffed.
LINKTYPE_C_HDLC_WITH_DIR205DLT_C_HDLC_WITH_DIR Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" and a non-zero value meaning "sent by this host".
LINKTYPE_FRELAY_WITH_DIR206DLT_FRELAY_WITH_DIR Frame Relay LAPF frames, beginning with a one-byte pseudo-header with a zero value meaning "received by this host" (DCE->DTE) and a non-zero value meaning "sent by this host" (DTE->DCE), followed by an ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.
LINKTYPE_LAPB_WITH_DIR207DLT_LAPB_WITH_DIR Link Access Procedure, Balanced (LAPB), as specified by ITU-T Recommendation X.25, preceded with a one-byte pseudo-header with a zero value meaning "received by this host" (DCE->DTE) and a non-zero value meaning "sent by this host" (DTE->DCE).
LINKTYPE_IPMB_LINUX209DLT_IPMB_LINUX IPMB over an I2C circuit, with a Linux-specific pseudo-header.
LINKTYPE_IEEE802_15_4_NONASK_PHY215DLT_IEEE802_15_4_NONASK_PHY IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame, and with the PHY-level data for the O-QPSK, BPSK, GFSK, MSK, and RCC DSS BPSK PHYs (4 octets of 0 as preamble, one octet of SFD, one octet of frame length + reserved bit) preceding the MAC-layer data (starting with the frame control field).
LINKTYPE_USB_LINUX_MMAPPED220DLT_USB_LINUX_MMAPPED USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. All 64 bytes of the header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file's magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block. For isochronous transfers, the ndesc field specifies the number of isochronous descriptors that follow.
LINKTYPE_FC_2224DLT_FC_2 Fibre Channel FC-2 frames, beginning with a Frame_Header.
LINKTYPE_FC_2_WITH_FRAME_DELIMS225DLT_FC_2_WITH_FRAME_DELIMS Fibre Channel FC-2 frames, beginning an encoding of the SOF, followed by a Frame_Header, and ending with an encoding of the SOF.

The encodings represent the frame delimiters as 4-byte sequences representing the corresponding ordered sets, with K28.5 represented as 0xBC, and the D symbols as the corresponding byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, is represented as 0xBC 0xB5 0x55 0x55.

LINKTYPE_IPNET226DLT_IPNET Solaris ipnet pseudo-header, followed by an IPv4 or IPv6 datagram.
LINKTYPE_CAN_SOCKETCAN227DLT_CAN_SOCKETCAN CAN (Controller Area Network) frames, with a pseudo-header followed by the frame payload.
LINKTYPE_IPV4228DLT_IPV4 Raw IPv4; the packet begins with an IPv4 header.
LINKTYPE_IPV6229DLT_IPV6 Raw IPv6; the packet begins with an IPv6 header.
LINKTYPE_IEEE802_15_4_NOFCS230DLT_IEEE802_15_4_NOFCS IEEE 802.15.4 Low-Rate Wireless Network, without the FCS at the end of the frame.
LINKTYPE_DBUS231DLT_DBUS Raw D-Bus messages, starting with the endianness flag, followed by the message type, etc., but without the authentication handshake before the message sequence.
LINKTYPE_DVB_CI235DLT_DVB_CI DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver), with the message format specified by the PCAP format for DVB-CI specification.
LINKTYPE_MUX27010236DLT_MUX27010 Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but not the same as, 27.010).
LINKTYPE_STANAG_5066_D_PDU237DLT_STANAG_5066_D_PDU D_PDUs as described by NATO standard STANAG 5066, starting with the synchronization sequence, and including both header and data CRCs. The current version of STANAG 5066 is backwards-compatible with the 1.0.2 version, although newer versions are classified.
LINKTYPE_NFLOG239DLT_NFLOG Linux netlink NETLINK NFLOG socket log messages.
LINKTYPE_NETANALYZER240DLT_NETANALYZER Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the MAC header and ending with the FCS.
LINKTYPE_NETANALYZER_TRANSPARENT241DLT_NETANALYZER_TRANSPARENT Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the preamble, SFD, and MAC header, and ending with the FCS.
LINKTYPE_IPOIB242DLT_IPOIB IP-over-InfiniBand, as specified by RFC 4391 section 6.
LINKTYPE_MPEG_2_TS243DLT_MPEG_2_TS MPEG-2 Transport Stream transport packets, as specified by ISO 13818-1/ITU-T Recommendation H.222.0 (see table 2-2 of section 2.4.3.2 "Transport Stream packet layer").
LINKTYPE_NG40244DLT_NG40 Pseudo-header for ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40 protocol tester, followed by frames for the Frame Protocol as specified by 3GPP TS 25.427 for dedicated channels and 3GPP TS 25.435 for common/shared channels in the case of ATM AAL2 or UDP traffic, by SSCOP packets as specified by ITU-T Recommendation Q.2110 for ATM AAL5 traffic, and by NBAP packets for SCTP traffic.
LINKTYPE_NFC_LLCP245DLT_NFC_LLCP Pseudo-header for NFC LLCP packet captures, followed by frame data for the LLCP Protocol as specified by NFCForum-TS-LLCP_1.1.
LINKTYPE_INFINIBAND247DLT_INFINIBAND Raw InfiniBand frames, starting with the Local Routing Header, as specified in Chapter 5 "Data packet format" of InfiniBand™ Architectural Specification Release 1.2.1 Volume 1 - General Specifications.
LINKTYPE_SCTP248DLT_SCTP SCTP packets, as defined by RFC 4960, with no lower-level protocols such as IPv4 or IPv6.
LINKTYPE_USBPCAP249DLT_USBPCAP USB packets, beginning with a USBPcap header.
LINKTYPE_RTAC_SERIAL250DLT_RTAC_SERIAL Serial-line packet header for the Schweitzer Engineering Laboratories "RTAC" product, followed by a payload for one of a number of industrial control protocols.
LINKTYPE_BLUETOOTH_LE_LL251DLT_BLUETOOTH_LE_LL Bluetooth Low Energy air interface Link Layer packets, in the format described in section 2.1 "PACKET FORMAT" of volume 6 of the Bluetooth Specification Version 4.0 (see PDF page 2200), but without the Preamble.
LINKTYPE_NETLINK253DLT_NETLINK Linux Netlink capture encapsulation.
LINKTYPE_BLUETOOTH_LINUX_MONITOR254DLT_BLUETOOTH_LINUX_MONITOR Bluetooth Linux Monitor encapsulation of traffic for the BlueZ stack.
LINKTYPE_BLUETOOTH_BREDR_BB255DLT_BLUETOOTH_BREDR_BB Bluetooth Basic Rate and Enhanced Data Rate baseband packets.
LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR256DLT_BLUETOOTH_LE_LL_WITH_PHDR Bluetooth Low Energy link-layer packets.
LINKTYPE_PROFIBUS_DL257DLT_PROFIBUS_DL PROFIBUS data link layer packets, as specified by IEC standard 61158-4-3, beginning with the start delimiter, ending with the end delimiter, and including all octets between them.
LINKTYPE_PKTAP258DLT_PKTAP Apple PKTAP capture encapsulation.
LINKTYPE_EPON259DLT_EPON Ethernet-over-passive-optical-network packets, starting with the last 6 octets of the modified preamble as specified by 65.1.3.2 "Transmit" in Clause 65 of Section 5 of IEEE 802.3, followed immediately by an Ethernet frame.
LINKTYPE_IPMI_HPM_2260DLT_IPMI_HPM_2 IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" in the PICMG HPM.2 specification. The time stamps for packets in this format must match the time stamps in the Trace Data Blocks.
LINKTYPE_ZWAVE_R1_R2261DLT_ZWAVE_R1_R2 Z-Wave RF profile R1 and R2 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.
LINKTYPE_ZWAVE_R3262DLT_ZWAVE_R3 Z-Wave RF profile R3 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.
LINKTYPE_WATTSTOPPER_DLM263DLT_WATTSTOPPER_DLM Formats for WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol common packet structure captures.
LINKTYPE_ISO_14443264DLT_ISO_14443 Messages between ISO 14443 contactless smartcards (Proximity Integrated Circuit Card, PICC) and card readers (Proximity Coupling Device, PCD), with the message format specified by the PCAP format for ISO14443 specification.
LINKTYPE_RDS265DLT_RDS Radio data system (RDS) groups, as per IEC 62106, encapsulated in this form.
LINKTYPE_USB_DARWIN266DLT_USB_DARWIN USB packets, beginning with a Darwin (macOS, etc.) USB header.
LINKTYPE_SDLC268DLT_SDLC SDLC packets, as specified by section 1.2 Synchronous Data Link Control (SDLC) of SNA Formats, GA27-3136-20, without the flag fields, zero-bit insertion, or Frame Check Sequence field, containing SNA path information units (PIUs) as the payload.
LINKTYPE_LORATAP270DLT_LORATAP LoRaTap pseudo-header, followed by the payload, which is typically the PHYPayload from the LoRaWan specification.
LINKTYPE_VSOCK271DLT_VSOCK Protocol for communication between host and guest machines in VMware and KVM hypervisors.
LINKTYPE_NORDIC_BLE272DLT_NORDIC_BLE Messages to and from a Nordic Semiconductor nRF Sniffer for Bluetooth LE packets, beginning with a pseudo-header.
LINKTYPE_DOCSIS31_XRA31273DLT_DOCSIS31_XRA31 DOCSIS packets and bursts, preceded by a pseudo-header giving metadata about the packet.
LINKTYPE_ETHERNET_MPACKET274DLT_ETHERNET_MPACKET mPackets, as specified by IEEE 802.3br Figure 99-4, starting with the preamble and always ending with a CRC field.
LINKTYPE_DISPLAYPORT_AUX275DLT_DISPLAYPORT_AUX DisplayPort AUX channel monitoring data as specified by VESA DisplayPort(DP) Standard preceeded by a pseudo-header.
LINKTYPE_LINUX_SLL2276DLT_LINUX_SLL2 Linux "cooked" capture encapsulation v2.
LINKTYPE_OPENVIZSLA278DLT_OPENVIZSLA Openvizsla FPGA-based USB sniffer.
LINKTYPE_EBHSCR279DLT_EBHSCR Elektrobit High Speed Capture and Replay (EBHSCR) format.
LINKTYPE_VPP_DISPATCH280DLT_VPP_DISPATCH Records in traces from the http://fd.io VPP graph dispatch tracer, in the the graph dispatcher trace format.
LINKTYPE_DSA_TAG_BRCM281DLT_DSA_TAG_BRCM Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.
LINKTYPE_DSA_TAG_BRCM_PREPEND282DLT_DSA_TAG_BRCM_PREPEND Ethernet frames, with a switch tag inserted before the destination address in the Ethernet header.
LINKTYPE_IEEE802_15_4_TAP283DLT_IEEE802_15_4_TAP IEEE 802.15.4 Low-Rate Wireless Networks, with a pseudo-header containing TLVs with metadata preceding the 802.15.4 header.
LINKTYPE_DSA_TAG_DSA284DLT_DSA_TAG_DSA Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.
LINKTYPE_DSA_TAG_EDSA285DLT_DSA_TAG_EDSA Ethernet frames, with a programmable Ethernet type switch tag inserted between the source address field and the type/length field in the Ethernet header.