Project

General

Profile

Actions
Copy link

Feature #4951

open
PP CT

decode: datalink type 276 not yet supported

Feature #4951: decode: datalink type 276 not yet supported

Added by Peter Pan almost 5 years ago. Updated 4 months ago.

Status:
Triaged
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:
Beginner, C, Good First Issue, Protocol

Description

<Error> - [ERRCODE: SC_ERR_UNIMPLEMENTED(88)] - datalink type 276 not (yet) supported in module PcapFile.

Suricata 6.0.4 not supporting datalink type 276 yet? Would it be supported in the future or any possible workaround?

Thank you.

Files

linux_dlt_sll2.pcap (672 Bytes) linux_dlt_sll2.pcap Phil Rzewski, 01/17/2024 01:39 AM

VJ Updated by Victor Julien almost 5 years ago Actions
Copy link
 #1

Are you able to provide a (public) pcap?

AH Updated by Andreas Herz almost 5 years ago Actions
Copy link
 #2

  • Tracker changed from Support to Feature
  • Status changed from New to Assigned
  • Assignee set to Peter Pan
  • Target version set to TBD

PC Updated by Pablo Catalina about 4 years ago Actions
Copy link
 #3

Victor Julien wrote in #note-1:

Are you able to provide a (public) pcap?

It is easy to reproduce:

On a linux (tested on Kali linux) sniff using the options -s0 -i any -w filename.pcap, tcpdump will store the data using LINKTYPE_LINUX_SLL2 (which contains the name of the network interface in the headers). More info: https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html

PR Updated by Phil Rzewski almost 3 years ago Actions
Copy link
 #4

We recently had a user bump into this problem as well so I happened to find this issue. Per the request in the most recent comment for a public pcap, I've attached one that reproduces with current GA Suricata v7.0.2.

$ suricata -V
This is Suricata version 7.0.2 RELEASE

$ suricata -r linux_dlt_sll2.pcap 
i: suricata: This is Suricata version 7.0.2 RELEASE running in USER mode
E: pcap: datalink type 276 not (yet) supported in module PcapFile.
W: pcap: Failed to init pcap file linux_dlt_sll2.pcap, skipping
E: pcap: pcap file reader thread failed to initialize
i: threads: Threads created -> RX: 1 W: 12 FM: 1 FR: 1   Engine started.
i: suricata: Signal Received.  Stopping engine.

That example pcap happens to be https://github.com/zeek/zeek/blob/master/testing/btest/Traces/linux_dlt_sll2.pcap that's used in tesing the Zeek project, as they added support for this format in https://github.com/zeek/zeek/pull/2340. Perhaps adding support in Suricata could be aided by borrowing from another open source project.

SS Updated by steve smoot almost 3 years ago Actions
Copy link
 #5

I looked through the zeek diff (https://github.com/zeek/zeek/pull/2340/files)
Basically it copies out a header:
struct SLL2Header {
uint16_t protocol_type;
uint16_t reserved;
uint32_t interface_index;
uint16_t arphrd_type;
uint8_t packet_type;
uint8_t addr_len;
uint64_t addr;
} attribute((packed));
};
sets a field that zeek depends on (l2_dst), advances the pointer, and just uses normal processing thereafter.
so it's likely a similarly trivial change.

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #6

  • Subject changed from datalink type 276 not yet supported to decode: datalink type 276 not yet supported
  • Assignee changed from Peter Pan to Community Ticket
  • Label Beginner, C, Good First Issue, Protocol added

PA Updated by Philippe Antoine 4 months ago Actions
Copy link
 #7

  • Status changed from Assigned to Triaged
Actions
Copy link

Also available in: PDF Atom