]> Link-Layer Types for PCAP-related Capture File Formats
gharris@sonic.net
Sandelman Software Works Inc
mcr+ietf@sandelman.ca http://www.sandelman.ca/
This document describes a set of Packet CAPture (PCAP)-related LinkType values and creates an IANA registry for those values. These values are used by the PCAP and PCAP-Now-Generic specifications. About This Document Status information for this document may be found at . Discussion of this document takes place on the opsawg Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .
Introduction In the late 1980s, Van Jacobson, Steve McCanne, and others at the Network Research Group at Lawrence Berkeley National Laboratory developed the tcpdump program to capture and dissect network traces. The code to capture traffic, using low-level mechanisms in various operating systems, and to read and write network traces to a file was later put into a library named libpcap . Other documents describe the original (legacy) file format used by tcpdump (PCAP, ), as well as a revised file format , both of which are used by tcpdump and Wireshark . Within those file formats each packet that is captured is indicated by a LinkType value. The LinkType value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet. This document creates an IANA registry for LinkType values, establishing the IANA Considerations by which other uses of the PCAP-related formats may register new LinkType values.
IANA Considerations
PCAP Registry IANA is requested to create a new registry group entitled "The PCAP Registry".
LinkType Registry IANA is also requested to create a registry entitled "PCAP-related LinkType List" under The PCAP registry group (). The registry has the following structure:
  • LinkType Value: Indicates the 16-bit unsigned integer assigned for this LinkType.
  • LinkType Name: Indicates the symbolic name for this LinkType. The name is prefixed with "LINKTYPE_" (i.e., LINKTYPE_something).
  • Change Controller: as per
  • Description: Provides a very short description.
  • Reference: Indicates an authoritative document reference for the LinkType or a requester reference.
The policy allocation for the LinkType values is as follows:
  • Values from 0 to 65000 are allocated following an Expert Review policy (Section 4.5 of ). Values in the ranges 0-10, 50-51, and 98-301 are already assigned; values in the ranges 11-49 and 52-97 are reserved and must not be assigned.
  • Values from 65001 to 65535 are reserved for Experimental Use ().
The initial version of the registry is provided in . The initial contents of the table are based upon the link-layer header type list maintained by libpcap, and published on . The change controller for all initial entries that have no other reference is linktype@tcpdump.org. LinkType values 147 to 162 named LINKTYPE_RESERVED_xx were originally reserved for Experimental/Private Use, and that use continues to be supported. However, new private use cases should use the values in the 65001-65535 range. In general, Experimental Use values should never leak out of the entity that uses it. As the Expert Review range is large and easily obtained, official values are recommended.
  • There is often an associated Data Link Type (DLT) value which is often identical in value, but not universally so. DLT values are associated with specific operating systems, and the numerical values for some of them are operating system specific, and are thus not subject to standardization.
Initial Values This is the initial table for the registry:
LinkType Value
0
LinkType Name
LINKTYPE_NULL
Description
BSD loopback encapsulation
Reference
LinkType Value
1
LinkType Name
LINKTYPE_ETHERNET
Description
IEEE 802.3 Ethernet
Reference
LinkType Value
2
LinkType Name
LINKTYPE_EXP_ETHERNET
Description
Xerox experimental 3Mb Ethernet
Reference
LinkType Value
3
LinkType Name
LINKTYPE_AX25
Description
AX.25 layer 2 packets
Reference
LinkType Value
4
LinkType Name
LINKTYPE_PRONET
Description
Proteon PRONet Token Ring
LinkType Value
5
LinkType Name
LINKTYPE_CHAOS
Description
MIT Chaosnet
Reference
LinkType Value
6
LinkType Name
LINKTYPE_IEEE802_5
Description
IEEE 802.5 Token Ring
LinkType Value
7
LinkType Name
LINKTYPE_ARCNET_BSD
Description
ARCNET Data Packets with BSD encapsulation
LinkType Value
8
LinkType Name
LINKTYPE_SLIP
Description
SLIP, with a direction header
Reference
LinkType Value
9
LinkType Name
LINKTYPE_PPP
Description
PPP
Reference
LinkType Value
10
LinkType Name
LINKTYPE_FDDI
Description
FDDI: per ANSI INCITS 239-1994
LinkType Value
11-49
LinkType Name
Not available for assignment
Description
Do not use these values
LinkType Value
50
LinkType Name
LINKTYPE_PPP_HDLC
Description
PPP in HDLC-like framing
Reference
LinkType Value
51
LinkType Name
LINKTYPE_PPP_ETHER
Description
PPPoE session packets
Reference
LinkType Value
52-98
LinkType Name
Not available for assignment
Description
Used historically by NetBSD
LinkType Value
99
LinkType Name
LINKTYPE_SYMANTEC_FIREWALL
Description
Symantec Enterprise Firewall
LinkType Value
100
LinkType Name
LINKTYPE_ATM_RFC1483
Description
LLC/SNAP-encapsulated ATM
Reference
LinkType Value
101
LinkType Name
LINKTYPE_RAW
Description
IP without link-layer headers
Reference
LinkType Value
102
LinkType Name
LINKTYPE_SLIP_BSDOS
Description
BSD/OS SLIP BPF header
LinkType Value
103
LinkType Name
LINKTYPE_PPP_BSDOS
Description
BSD/OS PPP BPF header
LinkType Value
104
LinkType Name
LINKTYPE_C_HDLC
Description
Cisco PPP with HDLC framing
Reference
LinkType Value
105
LinkType Name
LINKTYPE_IEEE802_11
Description
IEEE 802.11 wireless LAN
LinkType Value
106
LinkType Name
LINKTYPE_ATM_CLIP
Description
ATM Classical IP, with no header preceding IP
LinkType Value
107
LinkType Name
LINKTYPE_FRELAY
Description
Frame Relay LAPF
Reference
LinkType Value
108
LinkType Name
LINKTYPE_LOOP
Description
OpenBSD loopback encapsulation
Reference
LinkType Value
109
LinkType Name
LINKTYPE_ENC
Description
OpenBSD IPsec encapsulation
LinkType Value
110
LinkType Name
LINKTYPE_LANE8023
Description
ATM LANE + 802.3
LinkType Value
111
LinkType Name
LINKTYPE_HIPPI
Description
NetBSD HIPPI
LinkType Value
112
LinkType Name
LINKTYPE_HDLC
Description
NetBSD HDLC framing
LinkType Value
113
LinkType Name
LINKTYPE_LINUX_SLL
Description
Linux "cooked" capture encapsulation
Reference
LinkType Value
114
LinkType Name
LINKTYPE_LTALK
Description
Apple LocalTalk
Reference
LinkType Value
115
LinkType Name
LINKTYPE_ECONET
Description
Acorn Econet
LinkType Value
116
LinkType Name
LINKTYPE_IPFILTER
Description
OpenBSD ipfilter
LinkType Value
117
LinkType Name
LINKTYPE_PFLOG
Description
PF packet filter logging
LinkType Value
118
LinkType Name
LINKTYPE_CISCO_IOS
Description
Cisco-internal use
LinkType Value
119
LinkType Name
LINKTYPE_IEEE802_11_PRISM
Description
IEEE 802.11 wireless LAN, preceded by a Prism monitor mode header
Reference
LinkType Value
120
LinkType Name
LINKTYPE_IEEE802_11_AIRONET
Description
802.11 + FreeBSD Aironet radio metadata
LinkType Value
121
LinkType Name
LINKTYPE_HHDLC
Description
Siemens HiPath HDLC
LinkType Value
122
LinkType Name
LINKTYPE_IP_OVER_FC
Description
IP and ATM over Fibre Channel
Reference
LinkType Value
123
LinkType Name
LINKTYPE_SUNATM
Description
ATM traffic captured from a SunATM device
Reference
LinkType Value
124
LinkType Name
LINKTYPE_RIO
Description
RapidIO
LinkType Value
125
LinkType Name
LINKTYPE_PCI_EXP
Description
PCI Express
LinkType Value
126
LinkType Name
LINKTYPE_AURORA
Description
Xilinx Aurora link layer
LinkType Value
127
LinkType Name
LINKTYPE_IEEE802_11_RADIOTAP
Description
IEEE 802.11 wireless LAN, preceded by a Radiotap header
Reference
LinkType Value
128
LinkType Name
LINKTYPE_TZSP
Description
Tazmen Sniffer Protocol
LinkType Value
129
LinkType Name
LINKTYPE_ARCNET_LINUX
Description
ARCNET Data Packets with Linux encapsulation
LinkType Value
130
LinkType Name
LINKTYPE_JUNIPER_MLPPP
Description
Juniper Networks
LinkType Value
131
LinkType Name
LINKTYPE_JUNIPER_MLFR
Description
Juniper Networks
LinkType Value
132
LinkType Name
LINKTYPE_JUNIPER_ES
Description
Juniper Networks
LinkType Value
133
LinkType Name
LINKTYPE_JUNIPER_GGSN
Description
Juniper Networks
LinkType Value
134
LinkType Name
LINKTYPE_JUNIPER_MFR
Description
Juniper Networks
LinkType Value
135
LinkType Name
LINKTYPE_JUNIPER_ATM2
Description
Juniper Networks
LinkType Value
136
LinkType Name
LINKTYPE_JUNIPER_SERVICES
Description
Juniper Networks
LinkType Value
137
LinkType Name
LINKTYPE_JUNIPER_ATM1
Description
Juniper Networks
LinkType Value
138
LinkType Name
LINKTYPE_APPLE_IP_OVER_IEEE1394
Description
Apple IP-over-IEEE 1394 cooked header
Reference
LinkType Value
139
LinkType Name
LINKTYPE_MTP2_WITH_PHDR
Description
SS7 MTP2 frames, with a pseudo-header
Reference
LinkType Value
140
LinkType Name
LINKTYPE_MTP2
Description
SS7 MTP2 packets
Reference
LinkType Value
141
LinkType Name
LINKTYPE_MTP3
Description
SS7 MTP3 packets
Reference
LinkType Value
142
LinkType Name
LINKTYPE_SCCP
Description
SS7 SCCP packets
Reference
LinkType Value
143
LinkType Name
LINKTYPE_DOCSIS
Description
DOCSIS MAC frames
Reference
LinkType Value
144
LinkType Name
LINKTYPE_LINUX_IRDA
Description
Linux-IrDA packets
Reference
LinkType Value
145
LinkType Name
LINKTYPE_IBM_SP
Description
IBM SP switch
LinkType Value
146
LinkType Name
LINKTYPE_IBM_SN
Description
IBM Next Federation switch
LinkType Value
147
LinkType Name
LINKTYPE_RESERVED_01
Description
For private use (deprecated)
LinkType Value
148
LinkType Name
LINKTYPE_RESERVED_02
Description
For private use (deprecated)
LinkType Value
149
LinkType Name
LINKTYPE_RESERVED_03
Description
For private use (deprecated)
LinkType Value
150
LinkType Name
LINKTYPE_RESERVED_04
Description
For private use (deprecated)
LinkType Value
151
LinkType Name
LINKTYPE_RESERVED_05
Description
For private use (deprecated)
LinkType Value
152
LinkType Name
LINKTYPE_RESERVED_06
Description
For private use (deprecated)
LinkType Value
153
LinkType Name
LINKTYPE_RESERVED_07
Description
For private use (deprecated)
LinkType Value
154
LinkType Name
LINKTYPE_RESERVED_08
Description
For private use (deprecated)
LinkType Value
155
LinkType Name
LINKTYPE_RESERVED_09
Description
For private use (deprecated)
LinkType Value
156
LinkType Name
LINKTYPE_RESERVED_10
Description
For private use (deprecated)
LinkType Value
157
LinkType Name
LINKTYPE_RESERVED_11
Description
For private use (deprecated)
LinkType Value
158
LinkType Name
LINKTYPE_RESERVED_12
Description
For private use (deprecated)
LinkType Value
159
LinkType Name
LINKTYPE_RESERVED_13
Description
For private use (deprecated)
LinkType Value
160
LinkType Name
LINKTYPE_RESERVED_14
Description
For private use (deprecated)
LinkType Value
161
LinkType Name
LINKTYPE_RESERVED_15
Description
For private use (deprecated)
LinkType Value
162
LinkType Name
LINKTYPE_RESERVED_16
Description
For private use (deprecated)
LinkType Value
163
LinkType Name
LINKTYPE_IEEE802_11_AVS
Description
IEEE 802.11 wireless LAN, preceded by an AVS header
Reference
LinkType Value
164
LinkType Name
LINKTYPE_JUNIPER_MONITOR
Description
Juniper Networks
LinkType Value
165
LinkType Name
LINKTYPE_BACNET_MS_TP
Description
BACnet MS/TP frames
Reference
LinkType Value
166
LinkType Name
LINKTYPE_PPP_PPPD
Description
PPP preceded by a direction octet and an HDLC-like control field
Reference
LinkType Value
167
LinkType Name
LINKTYPE_JUNIPER_PPPOE
Description
Juniper Networks
LinkType Value
168
LinkType Name
LINKTYPE_JUNIPER_PPPOE_ATM
Description
Juniper Networks
LinkType Value
169
LinkType Name
LINKTYPE_GPRS_LLC
Description
General Packet Radio Service Logical Link Control, as per 3GPP TS 04.64
Reference
LinkType Value
170
LinkType Name
LINKTYPE_GPF_T
Description
Transparent-mapped generic framing procedure
Reference
LinkType Value
171
LinkType Name
LINKTYPE_GPF_F
Description
Frame-mapped generic framing procedure
Reference
LinkType Value
172
LinkType Name
LINKTYPE_GCOM_T1E1
Description
Gcom T1/E1 line monitoring equipment
LinkType Value
173
LinkType Name
LINKTYPE_GCOM_SERIAL
Description
Gcom T1/E1 line monitoring equipment
LinkType Value
174
LinkType Name
LINKTYPE_JUNIPER_PIC_PEER
Description
Juniper Networks
LinkType Value
175
LinkType Name
LINKTYPE_ERF_ETH
Description
Endace TYPE_ETH ERF records
Reference
LinkType Value
176
LinkType Name
LINKTYPE_ERF_POS
Description
Endace TYPE_POS_HDLC ERF records
Reference
LinkType Value
177
LinkType Name
LINKTYPE_LINUX_LAPD
Description
Linux vISDN LAPD frames
Reference
LinkType Value
178
LinkType Name
LINKTYPE_JUNIPER_ETHER
Description
Juniper Networks
LinkType Value
179
LinkType Name
LINKTYPE_JUNIPER_PPP
Description
Juniper Networks
LinkType Value
180
LinkType Name
LINKTYPE_JUNIPER_FRELAY
Description
Juniper Networks
LinkType Value
181
LinkType Name
LINKTYPE_JUNIPER_CHDLC
Description
Juniper Networks
LinkType Value
182
LinkType Name
LINKTYPE_MFR
Description
FRF.16.1 Multi-Link Frame Relay frames
Reference
LinkType Value
183
LinkType Name
LINKTYPE_JUNIPER_VP
Description
Juniper Networks
LinkType Value
184
LinkType Name
LINKTYPE_A429
Description
ARINC 429 frames
LinkType Value
185
LinkType Name
LINKTYPE_A653_ICM
Description
Arinc 653 Interpartition Communication messages
LinkType Value
186
LinkType Name
LINKTYPE_USB_FREEBSD
Description
USB traffic captured on FreeBSD
LinkType Value
187
LinkType Name
LINKTYPE_BLUETOOTH_HCI_H4
Description
Bluetooth HCI UART Transport Layer packets
Reference
LinkType Value
188
LinkType Name
LINKTYPE_IEEE802_16_MAC_CPS
Description
IEEE 802.16 MAC Common Part Sublayer
LinkType Value
189
LinkType Name
LINKTYPE_USB_LINUX
Description
USB packets, beginning with a Linux USB header
Reference
LinkType Value
190
LinkType Name
LINKTYPE_CAN20B
Description
Controller Area Network (CAN) v. 2.0B packets
LinkType Value
191
LinkType Name
LINKTYPE_IEEE802_15_4_LINUX
Description
IEEE 802.15.4 with address fields padded by Linux
LinkType Value
192
LinkType Name
LINKTYPE_PPI
Description
Per-Packet Information header preceding packet data
Reference
LinkType Value
193
LinkType Name
LINKTYPE_IEEE802_16_MAC_CPS_RADIO
Description
802.16 MAC Common Part Sublayer plus radio header
LinkType Value
194
LinkType Name
LINKTYPE_JUNIPER_ISM
Description
Juniper Networks
LinkType Value
195
LinkType Name
LINKTYPE_IEEE802_15_4_WITHFCS
Description
IEEE 802.15.4 with FCS
Reference
LinkType Value
196
LinkType Name
LINKTYPE_SITA
Description
Various link-layer types, with a pseudo-header
Reference
LinkType Value
197
LinkType Name
LINKTYPE_ERF
Description
Endace ERF records
Reference
LinkType Value
198
LinkType Name
LINKTYPE_RAIF1
Description
Ethernet packets captured from a u10 Networks board
LinkType Value
199
LinkType Name
LINKTYPE_IPMB_KONTRON
Description
IPMB packet for IPMI, with a 2-octet header
LinkType Value
200
LinkType Name
LINKTYPE_JUNIPER_ST
Description
Juniper Networks
LinkType Value
201
LinkType Name
LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
Description
Bluetooth HCI UART Transport Layer packets with a direction pseudo-header
Reference
LinkType Value
202
LinkType Name
LINKTYPE_AX25_KISS
Description
KISS frames between a host and an AX.25 TNC
Reference
LinkType Value
203
LinkType Name
LINKTYPE_LAPD
Description
Q.921 LAPD frames
Reference
LinkType Value
204
LinkType Name
LINKTYPE_PPP_WITH_DIR
Description
PPP, with a direction header
Reference
LinkType Value
205
LinkType Name
LINKTYPE_C_HDLC_WITH_DIR
Description
Cisco PPP with HDLC framing, with a direction header
Reference
LinkType Value
206
LinkType Name
LINKTYPE_FRELAY_WITH_DIR
Description
Frame Relay LAPF, with a direction header
Reference
LinkType Value
207
LinkType Name
LINKTYPE_LAPB_WITH_DIR
Description
X.25 LAPB, with a direction header
Reference
LinkType Value
208
LinkType Name
WillBarker-Proprietary
Description
Proprietary Link-Layer type
LinkType Value
209
LinkType Name
LINKTYPE_I2C_LINUX
Description
Linux I2C packets
Reference
LinkType Value
210
LinkType Name
LINKTYPE_FLEXRAY
Description
FlexRay frames or symbols, with a pseudo-header
Reference
LinkType Value
211
LinkType Name
LINKTYPE_MOST
Description
Media Oriented Systems Transport (MOST) bus
LinkType Value
212
LinkType Name
LINKTYPE_LIN
Description
Local Interconnect Network (LIN) automotive bus, with a metadata header
Reference
LinkType Value
213
LinkType Name
LINKTYPE_X2E_SERIAL
Description
X2E serial line captures
LinkType Value
214
LinkType Name
LINKTYPE_X2E_XORAYA
Description
X2E Xoraya data loggers
LinkType Value
215
LinkType Name
LINKTYPE_IEEE802_15_4_NONASK_PHY
Description
IEEE 802.15.4 with PHY header
Reference
LinkType Value
216
LinkType Name
LINKTYPE_LINUX_EVDEV
Description
Linux evdev messages
LinkType Value
217
LinkType Name
LINKTYPE_GSMTAP_UM
Description
GSM Um interface, with gsmtap header
LinkType Value
218
LinkType Name
LINKTYPE_GSMTAP_ABIS
Description
GSM Abis interface, with gsmtap header
LinkType Value
219
LinkType Name
LINKTYPE_MPLS
Description
MPLS packets with MPLS label as the header
LinkType Value
220
LinkType Name
LINKTYPE_USB_LINUX_MMAPPED
Description
USB packets, beginning with an extended Linux USB header
Reference
LinkType Value
221
LinkType Name
LINKTYPE_DECT
Description
DECT packets, with a pseudo-header
LinkType Value
222
LinkType Name
LINKTYPE_AOS
Description
OS Space Data Link Protocol
LinkType Value
223
LinkType Name
LINKTYPE_WIHART
Description
Wireless HART (Highway Addressable Remote Transducer)
LinkType Value
224
LinkType Name
LINKTYPE_FC_2
Description
Fibre Channel FC-2 frames
Reference
LinkType Value
225
LinkType Name
LINKTYPE_FC_2_WITH_FRAME_DELIMS
Description
Fibre Channel FC-2 frames with SOF and EOF
Reference
LinkType Value
226
LinkType Name
LINKTYPE_IPNET
Description
Solaris ipnet
Reference
LinkType Value
227
LinkType Name
LINKTYPE_CAN_SOCKETCAN
Description
Controller Area Network (CAN) frames, with a metadata header
Reference
LinkType Value
228
LinkType Name
LINKTYPE_IPV4
Description
IPv4 without link-layer headers
Reference
LinkType Value
229
LinkType Name
LINKTYPE_IPV6
Description
IPv6 without link-layer headers
Reference
LinkType Value
230
LinkType Name
LINKTYPE_IEEE802_15_4_NOFCS
Description
IEEE 802.15.4 without FCS
Reference
LinkType Value
231
LinkType Name
LINKTYPE_DBUS
Description
D-Bus messages
Reference
LinkType Value
232
LinkType Name
LINKTYPE_JUNIPER_VS
Description
Juniper Networks
LinkType Value
233
LinkType Name
LINKTYPE_JUNIPER_SRX_E2E
Description
Juniper Networks
LinkType Value
234
LinkType Name
LINKTYPE_JUNIPER_FIBRECHANNEL
Description
Juniper Networks
LinkType Value
235
LinkType Name
LINKTYPE_DVB_CI
Description
DVB-CI messages, with a pseudo-header
Reference
LinkType Value
236
LinkType Name
LINKTYPE_MUX27010
Description
Variant of 3GPP TS 27.010 multiplexing protocol
Reference
LinkType Value
237
LinkType Name
LINKTYPE_STANAG_5066_D_PDU
Description
STANAG 5066 D_PDUs
Reference
LinkType Value
238
LinkType Name
LINKTYPE_JUNIPER_ATM_CEMIC
Description
Juniper Networks
LinkType Value
239
LinkType Name
LINKTYPE_NFLOG
Description
Linux netlink NETLINK NFLOG socket log messages
Reference
LinkType Value
240
LinkType Name
LINKTYPE_NETANALYZER
Description
Ethernet frames with netANALYZER pseudo-header
Reference
LinkType Value
241
LinkType Name
LINKTYPE_NETANALYZER_TRANSPARENT
Description
Ethernet frames with netANALYZER pseudo-header, preamble, and SFD
Reference
LinkType Value
242
LinkType Name
LINKTYPE_IPOIB
Description
IP-over-InfiniBand
Reference
LinkType Value
243
LinkType Name
LINKTYPE_MPEG_2_TS
Description
MPEG-2 Transport Stream transport packets
Reference
LinkType Value
244
LinkType Name
LINKTYPE_NG40
Description
Frames from ng4T GmbH's ng40 protocol tester
Reference
LinkType Value
245
LinkType Name
LINKTYPE_NFC_LLCP
Description
NFC Logical Link Control Protocol frames, with a pseudo-header
Reference
LinkType Value
246
LinkType Name
LINKTYPE_PFSYNC
Description
pfsync output
LinkType Value
247
LinkType Name
LINKTYPE_INFINIBAND
Description
InfiniBand data packets
Reference
LinkType Value
248
LinkType Name
LINKTYPE_SCTP
Description
SCTP packets, with no lower-level protocols such as IPv4 or IPv6
Reference
LinkType Value
249
LinkType Name
LINKTYPE_USBPCAP
Description
USB packets, beginning with a USBPcap header
Reference
LinkType Value
250
LinkType Name
LINKTYPE_RTAC_SERIAL
Description
Serial-line packet from the Schweitzer Engineering Laboratories RTAC product
Reference
LinkType Value
251
LinkType Name
LINKTYPE_BLUETOOTH_LE_LL
Description
Bluetooth Low Energy link-layer packets
Reference
LinkType Value
252
LinkType Name
LINKTYPE_WIRESHARK_UPPER_PDU
Description
Wireshark
LinkType Value
253
LinkType Name
LINKTYPE_NETLINK
Description
Linux Netlink capture encapsulation
Reference
LinkType Value
254
LinkType Name
LINKTYPE_BLUETOOTH_LINUX_MONITOR
Description
Bluetooth Linux Monitor
Reference
LinkType Value
255
LinkType Name
LINKTYPE_BLUETOOTH_BREDR_BB
Description
Bluetooth Basic Rate and Enhanced Data Rate baseband packets
Reference
LinkType Value
256
LinkType Name
LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR
Description
Bluetooth Low Energy link-layer packets
Reference
LinkType Value
257
LinkType Name
LINKTYPE_PROFIBUS_DL
Description
PROFIBUS data link layer packets
Reference
LinkType Value
258
LinkType Name
LINKTYPE_PKTAP
Description
Apple PKTAP capture encapsulation
Reference
LinkType Value
259
LinkType Name
LINKTYPE_EPON
Description
Ethernet-over-passive-optical-network packets, including preamble octets
Reference
LinkType Value
260
LinkType Name
LINKTYPE_IPMI_HPM_2
Description
IPMI HPM.2 trace packets
Reference
LinkType Value
261
LinkType Name
LINKTYPE_ZWAVE_R1_R2
Description
Z-Wave RF profile R1 and R2 packets
Reference
LinkType Value
262
LinkType Name
LINKTYPE_ZWAVE_R3
Description
Z-Wave RF profile R3 packets
Reference
LinkType Value
263
LinkType Name
LINKTYPE_WATTSTOPPER_DLM
Description
WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol packets
Reference
LinkType Value
264
LinkType Name
LINKTYPE_ISO_14443
Description
ISO 14443 contactless smartcard messages
Reference
LinkType Value
265
LinkType Name
LINKTYPE_RDS
Description
IEC 62106 Radio data system (RDS) groups
Reference
LinkType Value
266
LinkType Name
LINKTYPE_USB_DARWIN
Description
USB packets captured on a Darwin-based operating system (macOS, etc.)
Reference
LinkType Value
267
LinkType Name
LINKTYPE_OPENFLOW
Description
OpenBSD DLT_OPENFLOW
LinkType Value
268
LinkType Name
LINKTYPE_SDLC
Description
SNA SDLC packets
Reference
LinkType Value
269
LinkType Name
LINKTYPE_TI_LLN_SNIFFER
Description
Texas Instruments protocol sniffer
LinkType Value
270
LinkType Name
LINKTYPE_LORATAP
Description
LoRaWan packets with a LoRaTap pseudo-header
Reference
LinkType Value
271
LinkType Name
LINKTYPE_VSOCK
Description
Protocol for communication between host and guest machines in VMware and KVM hypervisors
Reference
LinkType Value
272
LinkType Name
LINKTYPE_NORDIC_BLE
Description
Messages to and from a Nordic Semiconductor nRF Sniffer for Bluetooth LE packets
Reference
LinkType Value
273
LinkType Name
LINKTYPE_DOCSIS31_XRA31
Description
DOCSIS packets and bursts, preceded by a pseudo-header
Reference
LinkType Value
274
LinkType Name
LINKTYPE_ETHERNET_MPACKET
Description
IEEE 802.3 mPackets
Reference
LinkType Value
275
LinkType Name
LINKTYPE_DISPLAYPORT_AUX
Description
DisplayPort AUX channel monitoring messages
Reference
LinkType Value
276
LinkType Name
LINKTYPE_LINUX_SLL2
Description
Linux cooked capture encapsulation v2
Reference
LinkType Value
277
LinkType Name
LINKTYPE_SERCOS_MONITOR
Description
Sercos Monitor
LinkType Value
278
LinkType Name
LINKTYPE_OPENVIZSLA
Description
OpenVizsla FPGA-based USB sniffer
Reference
LinkType Value
279
LinkType Name
LINKTYPE_EBHSCR
Description
Elektrobit High Speed Capture and Replay (EBHSCR) format
Reference
LinkType Value
280
LinkType Name
LINKTYPE_VPP_DISPATCH
Description
fd.io VPP graph dispatcher trace records
Reference
LinkType Value
281
LinkType Name
LINKTYPE_DSA_TAG_BRCM
Description
Ethernet frames, with a Broadcom switch tag inserted
Reference
LinkType Value
282
LinkType Name
LINKTYPE_DSA_TAG_BRCM_PREPEND
Description
Ethernet frames, with a Broadcom switch tag prepended
Reference
LinkType Value
283
LinkType Name
LINKTYPE_IEEE802_15_4_TAP
Description
IEEE 802.15.4 with a tap header preceding it
Reference
LinkType Value
284
LinkType Name
LINKTYPE_DSA_TAG_DSA
Description
Ethernet frames, with a Marvell DSA switch tag inserted
Reference
LinkType Value
285
LinkType Name
LINKTYPE_DSA_TAG_EDSA
Description
Ethernet frames, with a Marvell EDSA switch tag inserted
Reference
LinkType Value
286
LinkType Name
LINKTYPE_ELEE
Description
ELEE lawful intercept protocol
LinkType Value
287
LinkType Name
LINKTYPE_Z_WAVE_SERIAL
Description
Serial frames transmitted between a host and a Z-Wave chip over an RS-232 or USB serial connection
Reference
section 5
LinkType Value
288
LinkType Name
LINKTYPE_USB_2_0
Description
USB 2.0, 1.1, or 1.0 packets
Reference
LinkType Value
289
LinkType Name
LINKTYPE_ATSC_ALP
Description
ATSC Link-Layer Protocol frames
Reference
LinkType Value
290
LinkType Name
LINKTYPE_ETW
Description
Event Tracing for Windows messages
Reference
LinkType Value
291
LinkType Name
LINKTYPE_NETANALYZER_NG
Description
Hilscher Gesellschaft fuer Systemautomation mbH netANALYZER NG hardware and software
LinkType Value
292
LinkType Name
LINKTYPE_ZBOSS_NCP
Description
ZBOSS NCP Serial Protocol, with a pseudo-header
Reference
LinkType Value
293
LinkType Name
LINKTYPE_USB_2_0_LOW_SPEED
Description
Low-Speed USB 2.0, 1.1, or 1.0 packets
Reference
LinkType Value
294
LinkType Name
LINKTYPE_USB_2_0_FULL_SPEED
Description
Full-Speed USB 2.0, 1.1, or 1.0 packets
Reference
LinkType Value
295
LinkType Name
LINKTYPE_USB_2_0_HIGH_SPEED
Description
High-Speed USB 2.0 packets
Reference
LinkType Value
296
LinkType Name
LINKTYPE_AUERSWALD_LOG
Description
Auerswald Logger Protocol
Reference
LinkType Value
297
LinkType Name
LINKTYPE_ZWAVE_TAP
Description
Z-Wave packets, with a metadata header
Reference
LinkType Value
298
LinkType Name
LINKTYPE_SILABS_DEBUG_CHANNEL
Description
Silicon Labs debug channel protocol
Reference
LinkType Value
299
LinkType Name
LINKTYPE_FIRA_UCI
Description
Ultra-wideband (UWB) controller interface protocol (UCI)
Reference
LinkType Value
300
LinkType Name
LINKTYPE_MDB
Description
MDB (Multi-Drop Bus) protocol
Reference
LinkType Value
301
LinkType Name
LINKTYPE_DECT_NR
Description
DECT-2020 New Radio (NR) MAC layer
Reference
Guidance for Designated Experts When processing a request for an allocation, the Designated Experts will encourage the requester to provide a specification at a stable URL. There is no requirement for a specification, but often review of the specification allows the Designated Expert to determine if the allocation actually is a duplicate of another specification. When the contents of the link type can contain an IPv4 or IPv6 header, then the octets between the beginning of the link type and the IP header needs to be clearly specified. Registrations for specifications that are not publicly available are acceptable. This includes specifications obtained via liaison agreements (such as to ITU-T, drafts, IEEE, etc.), those that may eventually be made public, or those for which no public document will be available. The minimal requirement is to provide a contact for that link type. For other documents, the Designated Expert will need use their judgement, or consult the OPSAWG or an Area Director.
Security Considerations This document describes the IANA registration rules for the LinkType encapsulations. PCAP-related packet file formats use this value to determine what kind of headers precede network packet captures. Many of these formats can contain IPv4 and IPv6 packets. A system reading PCAP-related format captures can be subject to arbitrary inputs that may be controlled by malicious entities, so utmost caution is required. Many LinkType formats include a "snapshot" length, which may be smaller than the actual packet. It is therefore very likely that trailing parts of a packet capture may be omitted, yet internal length fields in the packets will claim the packet is bigger than the capture. This leads to trivial buffer overreads, and systems interpreting the packets need to carefully scrutinize all attempts to read data from a capture.
Contributors PCAP has been developed over three and half decades by a variety of developers, including: Bill Fenner, Denis Ovsienko, Francois-Xavier Le Bail, Fulvio Risso, Gerald Combs, Gianluca Varenni, Gisle Vanem, Hannes Gredler, Joerg Mayer, Michal Sekletar, Stephen Donnelly, Torsten Landschoff, and Jun-ichiro itojun Hagino. PCAP was originally created at LBL by Steve McCanne, Craig Leres, and Van Jacobson.
Acknowledgments The authors wish to thank: Michael Tuexen, Mohamed Boucadair, Carsten Bormann, Henk Birkholtz, and Robert Wilton their invaluable comments and encouragement.
References Normative References Guidelines for Writing an IANA Considerations Section in RFCs Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. Informative References LINK-LAYER HEADER TYPES PCAP Library Homepage of Wireshark Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Mobile Station - Serving GPRS Support Node (MS-SGSN) Logical Link Control (LLC) layer specification 3GPP TS 04.64 Chaosnet MIT Artificial Intelligence Laboratory MIT A.I. Memo No. 628 Packet structure n.d. AVS Capture Frame Format Version 2 DOCSIS 4.0 MAC and Upper Layer Protocols Interface Specification Excentis XRA Header Definition PCAP format for DVB-CI Documentation EBHSCR IEEE 802.15.4 TAP Link Type Specification VNET (VPP Network Stack) Generic Framing Procedure ITU-T Recommendation G.7041/Y.1303 PCAP format for ISO14443 LINKTYPE_APPLE_IP_OVER_IEEE1394 LINKTYPE_ATM_RFC1483 LINKTYPE_ATSC_ALP LINKTYPE_AX25 LINKTYPE_AX25_KISS LINKTYPE_BACNET_MS_TP LINKTYPE_BLUETOOTH_BREDR_BB LINKTYPE_BLUETOOTH_HCI_H4 LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR LINKTYPE_BLUETOOTH_LE_LL LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR LINKTYPE_BLUETOOTH_LINUX_MONITOR LINKTYPE_C_HDLC LINKTYPE_C_HDLC_WITH_DIR LINKTYPE_CAN_SOCKETCAN LINKTYPE_DBUS LINKTYPE_DECT_NR LINKTYPE_DISPLAYPORT_AUX LINKTYPE_DSA_TAG_BRCM LINKTYPE_DSA_TAG_BRCM_PREPEND LINKTYPE_DSA_TAG_DSA LINKTYPE_DSA_TAG_EDSA IEEE 802.3 Ethernet LINKTYPE_EPON LINKTYPE_ERF LINKTYPE_ETW LINKTYPE_ETHERNET_MPACKET LINKTYPE_FC_2 LINKTYPE_FC_2_WITH_FRAME_DELIMS LINKTYPE_FIRA_UCI LINKTYPE_FLEXRAY LINKTYPE_FRELAY LINKTYPE_FRELAY_WITH_DIR LINKTYPE_I2C_LINUX LINKTYPE_IEEE802_11_PRISM LINKTYPE_IEEE802_15_4_NOFCS LINKTYPE_IEEE802_15_4_NONASK_PHY LINKTYPE_IEEE802_15_4_WITHFCS LINKTYPE_IPV4 LINKTYPE_IPV6 LINKTYPE_IPOIB LINKTYPE_IP_OVER_FC LINKTYPE_INFINIBAND LINKTYPE_IPMI_HPM_2 LINKTYPE_IPNET LINKTYPE_LAPB_WITH_DIR LINKTYPE_LAPD LINKTYPE_LIN LINKTYPE_LINUX_IRDA LINKTYPE_LINUX_LAPD LINKTYPE_LINUX_SLL LINKTYPE_LINUX_SLL2 LINKTYPE_LOOP LINKTYPE_LORATAP LINKTYPE_LTALK LINKTYPE_MFR LINKTYPE_MPEG_2_TS LINKTYPE_MTP2 LINKTYPE_MTP2_WITH_PHDR LINKTYPE_MTP3 LINKTYPE_SCCP LINKTYPE_MUX27010 LINKTYPE_NETANALYZER LINKTYPE_NETANALYZER_TRANSPARENT LINKTYPE_NETLINK LINKTYPE_NFC_LLCP LINKTYPE_NFLOG LINKTYPE_NG40 LINKTYPE_NORDIC_BLE LINKTYPE_NULL LINKTYPE_PKTAP LINKTYPE_PPI LINKTYPE_PPP LINKTYPE_PPP_ETHER LINKTYPE_PPP_HDLC LINKTYPE_PPP_PPPD LINKTYPE_PPP_WITH_DIR LINKTYPE_PROFIBUS_DL LINKTYPE_RAW LINKTYPE_RDS LINKTYPE_RTAC_SERIAL LINKTYPE_SDLC LINKTYPE_SITA LINKTYPE_SLIP LINKTYPE_STANAG_5066_D_PDU LINKTYPE_SUNATM LINKTYPE_USB_2_0 LINKTYPE_USB_2_0_FULL_SPEED LINKTYPE_USB_2_0_HIGH_SPEED LINKTYPE_USB_2_0_LOW_SPEED LINKTYPE_USB_DARWIN LINKTYPE_USB_LINUX LINKTYPE_USB_LINUX_MMAPPED LINKTYPE_VSOCK LINKTYPE_WATTSTOPPER_DLM LINKTYPE_ZBOSS_NCP LINKTYPE_ZWAVE_R1_R2 LINKTYPE_ZWAVE_R3 LINKTYPE_ZWAVE_TAP PCAP format for MDB OpenVizsla protocol description Practical Considerations in Ethernet Local Network Design Xerox Palo Alto Research Center Xerox Palo Alto Research Center Radiotap Web site radiotap.org Silabs Debug Channel Format n.d. USBPcap Capture format specification Z-Wave Serial API Host Application Programming Guide PCAP Capture File Format Sandelman Software Works Inc This document describes the format used by the libpcap library to record captured packets to a file. Programs using the libpcap library to read and write those files, and thus reading and writing files in that format, include tcpdump. PCAP Now Generic (pcapng) Capture File Format Muenster University of Applied Sciences Politecnico di Torino Airbus Defence and Space CyberSecurity Wireshark Foundation Red Hat Sandelman Software Works This document describes a format to record captured packets to a file. This format is extensible; Wireshark can currently read and write it, and libpcap can currently read some pcapng files. Internet Protocol Internet Protocol, Version 6 (IPv6) Specification This document specifies version 6 of the Internet Protocol (IPv6). It obsoletes RFC 2460. Stream Control Transmission Protocol This document describes the Stream Control Transmission Protocol (SCTP) and obsoletes RFC 4960. It incorporates the specification of the chunk flags registry from RFC 6096 and the specification of the I bit of DATA chunks from RFC 7053. Therefore, RFCs 6096 and 7053 are also obsoleted by this document. In addition, RFCs 4460 and 8540, which describe errata for SCTP, are obsoleted by this document. SCTP was originally designed to transport Public Switched Telephone Network (PSTN) signaling messages over IP networks. It is also suited to be used for other applications, for example, WebRTC. SCTP is a reliable transport protocol operating on top of a connectionless packet network, such as IP. It offers the following services to its users: The design of SCTP includes appropriate congestion avoidance behavior and resistance to flooding and masquerade attacks.