]> Link-Layer Types for PCAP-related Capture File Formats
gharris@sonic.net
Sandelman Software Works Inc
mcr+ietf@sandelman.ca http://www.sandelman.ca/
This document describes a set of PCAP-related LINKTYPE values and creates an IANA registry for those values. About This Document Status information for this document may be found at . Discussion of this document takes place on the opsawg Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .
Introduction In the late 1980's, Van Jacobson, Steve McCanne, and others at the Network Research Group at Lawrence Berkeley National Laboratory developed the tcpdump program to capture and dissect network traces. The code to capture traffic, using low-level mechanisms in various operating systems, and to read and write network traces to a file was later put into a library named libpcap . Other documents describe the original (legacy) file format used by tcpdump (PCAP, ), as well as a revised file format , both of which are used by tcpdump and Wireshark . Within those file formats each packet that is captured is indicated by a LINKTYPE value. The LINKTYPE value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet. This document creates an IANA registry for LINKTYPE values, establishing the IANA Considerations by which other uses of the PCAP-related formats may register new LINKTYPE values.
IANA Considerations
PCAP Registry IANA is requested to create a new registry group entitled "The PCAP Registry".
LinkType Registry IANA is also requested to create a registry entitled "PCAP-related LinkType List" under The PCAP registry group (). The registry has the following structure:
  • LINKTYPE Name: Indicates the symbolic name for this LinkType. The name is prefixed with "LINKTYPE_" (i.e., LINKTYPE_something).
  • LINKTYPE Value: Indicates the 16-bit unsigned integer assigned for this LinkType.
  • Description: Provides a very short description.
  • Reference: Indicates an authoritative document reference for the LinkType or a requester reference.
The policy allocation for the LinkType values is as follows:
  • Values from 32768 to 65000 must be allocated via Specification Required (). Guidance for Designated Experts is provided in .
  • Values from 0 to 32767 are allocated following a First-Come First-Served policy (). Note that this category includes the historical allocations which have an uneven level of definition.
  • Values from 65001 to 65535 are reserved for Private Use ().
The initial version of the registry is provided in . In each case here, the reference should be set to and the RFC number to be assigned to this document, which is not repeated each time. The initial contents of the table are based upon the Link type list maintained by libpcap, and published on . Note that historically, values were assigned incrementally following First Come First Served (FCFS) policy, with a preference for a public specification, but with no mandate. Some historical values may have less specification than desired. LinkType values 147 to 162 named LINKTYPE_RESERVED_xx were originally reserved for Private Use. Their use is Deprecated in favour of the values in the 65001-65535 range. In general, Private Use values should never leak out of the entity that uses it. As the FCFS range is large and easily obtained, official values are recommended.
  • There is often an associated Data Link Type (DLT) value which is often identical in value, but not universally so. DLT values are associated with specific operation system captures, and are operating system specific, and are thus not subject to standardization.
Initial Values This is the initial table for the registry:
Name
LINKTYPE_NULL
Number
0
Description
BSD loopback encapsulation
Reference
Name
LINKTYPE_ETHERNET
Number
1
Description
IEEE 802.3 Ethernet
Name
LINKTYPE_EXP_ETHERNET
Number
2
Description
Xerox experimental 3Mb Ethernet
Reference
Name
LINKTYPE_AX25
Number
3
Description
AX.25 layer 2 packets
Reference
Name
LINKTYPE_PRONET
Number
4
Description
Reserved for Proteon PRONet Token Ring
Name
LINKTYPE_CHAOS
Number
5
Description
Reserved for MIT Chaosnet
Reference
Name
LINKTYPE_IEEE802_5
Number
6
Description
IEEE 802.5 Token Ring
Name
LINKTYPE_ARCNET_BSD
Number
7
Description
Reserved for ARCNET Data Packets with BSD encapsulation
Reference
Name
LINKTYPE_SLIP
Number
8
Description
SLIP, with a direction header
Reference
Name
LINKTYPE_PPP
Number
9
Description
PPP
Reference
Name
LINKTYPE_FDDI
Number
10
Description
FDDI: per ANSI INCITS 239-1994
Name
not to be used
Number
11-49
Description
Do not use these values
Name
LINKTYPE_PPP_HDLC
Number
50
Description
PPP in HDLC-like framing
Reference
Name
LINKTYPE_PPP_ETHER
Number
51
Description
PPPoE session packets
Reference
Name
Reserved
Number
52-98
Description
Do not use these values
Name
LINKTYPE_SYMANTEC_FIREWALL
Number
99
Description
Reserved for Symantec Enterprise Firewall
Name
LINKTYPE_ATM_RFC1483
Number
100
Description
LLC/SNAP-encapsulated ATM
Reference
Name
LINKTYPE_RAW
Number
101
Description
Raw IP; begins with an IPv4 or IPv6 header
Name
LINKTYPE_SLIP_BSDOS
Number
102
Description
Reserved for BSD/OS SLIP BPF header
Name
LINKTYPE_PPP_BSDOS
Number
103
Description
Reserved for BSD/OS PPP BPF header
Name
LINKTYPE_C_HDLC
Number
104
Description
Cisco PPP with HDLC framing
Reference
Name
LINKTYPE_IEEE802_11
Number
105
Description
IEEE 802.11 wireless LAN
Name
LINKTYPE_ATM_CLIP
Number
106
Description
ATM Classical IP, with no header preceding IP
Name
LINKTYPE_FRELAY
Number
107
Description
Frame Relay LAPF
Reference
Name
LINKTYPE_LOOP
Number
108
Description
OpenBSD loopback encapsulation
Reference
Name
LINKTYPE_ENC
Number
109
Description
Reserved for OpenBSD IPSEC encapsulation
Name
LINKTYPE_LANE8023
Number
110
Description
Reserved for ATM LANE + 802.3
Name
LINKTYPE_HIPPI
Number
111
Description
Reserved for NetBSD HIPPI
Name
LINKTYPE_HDLC
Number
112
Description
Reserved for NetBSD HDLC framing
Name
LINKTYPE_LINUX_SLL
Number
113
Description
Linux "cooked" capture encapsulation
Reference
Name
LINKTYPE_LTALK
Number
114
Description
Apple LocalTalk
Reference
Name
LINKTYPE_ECONET
Number
115
Description
Reserved for Acorn Econet
Name
LINKTYPE_IPFILTER
Number
116
Description
Reserved for OpenBSD ipfilter
Name
LINKTYPE_PFLOG
Number
117
Description
Reserved for PF packet filter logging
Name
LINKTYPE_CISCO_IOS
Number
118
Description
Reserved for Cisco-internal use
Name
LINKTYPE_IEEE802_11_PRISM
Number
119
Description
IEEE 802.11 wireless LAN, preceded by a Prism monitor mode header
Reference
Name
LINKTYPE_IEEE802_11_AIRONET
Number
120
Description
Reserved for 802.11 + FreeBSD Aironet radio metadata
Name
LINKTYPE_HHDLC
Number
121
Description
Reserved for Siemens HiPath HDLC
Name
LINKTYPE_IP_OVER_FC
Number
122
Description
IP and ATM over Fibre Channel
Reference
Name
LINKTYPE_SUNATM
Number
123
Description
ATM traffic captured from a SunATM device
Reference
Name
LINKTYPE_RIO
Number
124
Description
Reserved for RapidIO
Name
LINKTYPE_PCI_EXP
Number
125
Description
Reserved for PCI Express
Name
LINKTYPE_AURORA
Number
126
Description
Reserved for Xilinx Aurora link layer
Name
LINKTYPE_IEEE802_11_RADIOTAP
Number
127
Description
IEEE 802.11 wireless LAN, preceded by a Radiotap header
Reference
Name
LINKTYPE_TZSP
Number
128
Description
Reserved for Tazmen Sniffer Protocol
Name
LINKTYPE_ARCNET_LINUX
Number
129
Description
Reserved for ARCNET Data Packets with Linux encapsulation
Reference
Name
LINKTYPE_JUNIPER_MLPPP
Number
130
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_MLFR
Number
131
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_ES
Number
132
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_GGSN
Number
133
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_MFR
Number
134
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_ATM2
Number
135
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_SERVICES
Number
136
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_ATM1
Number
137
Description
Reserved for Juniper Networks
Name
LINKTYPE_APPLE_IP_OVER_IEEE1394
Number
138
Description
Apple IP-over-IEEE 1394 cooked header
Reference
Name
LINKTYPE_MTP2_WITH_PHDR
Number
139
Description
SS7 MTP2 frames, with a pseudo-header
Reference
Name
LINKTYPE_MTP2
Number
140
Description
SS7 MTP2 packets
Reference
Name
LINKTYPE_MTP3
Number
141
Description
SS7 MTP3 packets
Reference
Name
LINKTYPE_SCCP
Number
142
Description
SS7 SCCP packets
Reference
Name
LINKTYPE_DOCSIS
Number
143
Description
DOCSIS MAC frames
Reference
Name
LINKTYPE_LINUX_IRDA
Number
144
Description
Linux-IrDA packets
Reference
Name
LINKTYPE_IBM_SP
Number
145
Description
Reserved for IBM SP switch
Name
LINKTYPE_IBM_SN
Number
146
Description
Reserved for IBM Next Federation switch
Name
LINKTYPE_RESERVED_01
Number
147
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_02
Number
148
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_03
Number
149
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_04
Number
150
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_05
Number
151
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_06
Number
152
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_07
Number
153
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_08
Number
154
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_09
Number
155
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_10
Number
156
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_11
Number
157
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_12
Number
158
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_13
Number
159
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_14
Number
160
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_15
Number
161
Description
For private use (deprecated)
Name
LINKTYPE_RESERVED_16
Number
162
Description
For private use (deprecated)
Name
LINKTYPE_IEEE802_11_AVS
Number
163
Description
IEEE 802.11 wireless LAN, preceded by an AVS header
Reference
Name
LINKTYPE_JUNIPER_MONITOR
Number
164
Description
Reserved for Juniper Networks
Name
LINKTYPE_BACNET_MS_TP
Number
165
Description
BACnet MS/TP frames
Reference
Name
LINKTYPE_PPP_PPPD
Number
166
Description
PPP preceded by a direction octet and an HDLC-like control field
Reference
Name
LINKTYPE_JUNIPER_PPPOE
Number
167
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_PPPOE_ATM
Number
168
Description
Reserved for Juniper Networks
Name
LINKTYPE_GPRS_LLC
Number
169
Description
General Packet Radio Service Logical Link Control, as per 3GPP TS 04.64
Reference
Name
LINKTYPE_GPF_T
Number
170
Description
Transparent-mapped generic framing procedure
Reference
Name
LINKTYPE_GPF_F
Number
171
Description
Frame-mapped generic framing procedure
Reference
Name
LINKTYPE_GCOM_T1E1
Number
172
Description
Reserved for Gcom T1/E1 line monitoring equipment
Name
LINKTYPE_GCOM_SERIAL
Number
173
Description
Reserved for Gcom T1/E1 line monitoring equipment
Name
LINKTYPE_JUNIPER_PIC_PEER
Number
174
Description
Reserved for Juniper Networks
Name
LINKTYPE_ERF_ETH
Number
175
Description
Endace TYPE_ETH ERF records
Reference
Name
LINKTYPE_ERF_POS
Number
176
Description
Endace TYPE_POS_HDLC ERF records
Reference
Name
LINKTYPE_LINUX_LAPD
Number
177
Description
Linux vISDN LAPD frames
Reference
Name
LINKTYPE_JUNIPER_ETHER
Number
178
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_PPP
Number
179
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_FRELAY
Number
180
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_CHDLC
Number
181
Description
Reserved for Juniper Networks
Name
LINKTYPE_MFR
Number
182
Description
FRF.16.1 Multi-Link Frame Relay frames
Reference
Name
LINKTYPE_JUNIPER_VP
Number
183
Description
Reserved for Juniper Networks
Name
LINKTYPE_A429
Number
184
Description
Reserved for ARINC 429 frames
Name
LINKTYPE_A653_ICM
Number
185
Description
Reserved for Arinc 653 Interpartition Communication messages
Name
LINKTYPE_USB_FREEBSD
Number
186
Description
Reserved for USB traffic captured on FreeBSD
Name
LINKTYPE_BLUETOOTH_HCI_H4
Number
187
Description
Bluetooth HCI UART Transport Layer packets
Reference
Name
LINKTYPE_IEEE802_16_MAC_CPS
Number
188
Description
Reserved for IEEE 802.16 MAC Common Part Sublayer
Name
LINKTYPE_USB_LINUX
Number
189
Description
USB packets, beginning with a Linux USB header
Reference
Name
LINKTYPE_CAN20B
Number
190
Description
Reserved for Controller Area Network (CAN) v. 2.0B packets
Name
LINKTYPE_IEEE802_15_4_LINUX
Number
191
Description
Reserved for IEEE 802.15.4 with address fields padded by Linux
Name
LINKTYPE_PPI
Number
192
Description
Per-Packet Information header preceding packet data
Reference
Name
LINKTYPE_IEEE802_16_MAC_CPS_RADIO
Number
193
Description
Reserved for 802.16 MAC Common Part Sublayer plus radio header
Name
LINKTYPE_JUNIPER_ISM
Number
194
Description
Reserved for Juniper Networks
Name
LINKTYPE_IEEE802_15_4_WITHFCS
Number
195
Description
IEEE 802.15.4 with FCS
Reference
Name
LINKTYPE_SITA
Number
196
Description
Various link-layer types, with a pseudo-header
Reference
Name
LINKTYPE_ERF
Number
197
Description
Endace ERF records
Reference
Name
LINKTYPE_RAIF1
Number
198
Description
Reserved for Ethernet packets captured from a u10 Networks board
Name
LINKTYPE_IPMB_KONTRON
Number
199
Description
Reserved for IPMB packet for IPMI, with a 2-octet header
Name
LINKTYPE_JUNIPER_ST
Number
200
Description
Reserved for Juniper Networks
Name
LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
Number
201
Description
Bluetooth HCI UART Transport Layer packets with a direction pseudo-header
Reference
Name
LINKTYPE_AX25_KISS
Number
202
Description
KISS frames between a host and an AX.25 TNC
Reference
Name
LINKTYPE_LAPD
Number
203
Description
Q.921 LAPD frames
Reference
Name
LINKTYPE_PPP_WITH_DIR
Number
204
Description
PPP, with a direction header
Reference
Name
LINKTYPE_C_HDLC_WITH_DIR
Number
205
Description
Cisco PPP with HDLC framing, with a direction header
Reference
Name
LINKTYPE_FRELAY_WITH_DIR
Number
206
Description
Frame Relay LAPF, with a direction header
Reference
Name
LINKTYPE_LAPB_WITH_DIR
Number
207
Description
X.25 LAPB, with a direction header
Reference
Name
Reserved
Number
208
Description
Reserved for an unspecified link-layer type
Name
LINKTYPE_I2C_LINUX
Number
209
Description
Linux I2C packets
Reference
Name
LINKTYPE_FLEXRAY
Number
210
Description
FlexRay frames or symbols, with a pseudo-header
Reference
Name
LINKTYPE_MOST
Number
211
Description
Reserved for Media Oriented Systems Transport (MOST) bus
Name
LINKTYPE_LIN
Number
212
Description
Local Interconnect Network (LIN) automotive bus, with a metadata header
Reference
Name
LINKTYPE_X2E_SERIAL
Number
213
Description
Reserved for X2E serial line captures
Name
LINKTYPE_X2E_XORAYA
Number
214
Description
Reserved for X2E Xoraya data loggers
Name
LINKTYPE_IEEE802_15_4_NONASK_PHY
Number
215
Description
IEEE 802.15.4 with PHY header
Reference
Name
LINKTYPE_LINUX_EVDEV
Number
216
Description
Reserved for Linux evdev messages
Name
LINKTYPE_GSMTAP_UM
Number
217
Description
Reserved for GSM Um interface, with gsmtap header
Name
LINKTYPE_GSMTAP_ABIS
Number
218
Description
Reserved for GSM Abis interface, with gsmtap header
Name
LINKTYPE_MPLS
Number
219
Description
MPLS packets with MPLS label as the header
Name
LINKTYPE_USB_LINUX_MMAPPED
Number
220
Description
USB packets, beginning with an extended Linux USB header
Reference
Name
LINKTYPE_DECT
Number
221
Description
Reserved for DECT packets, with a pseudo-header
Name
LINKTYPE_AOS
Number
222
Description
Reserved for OS Space Data Link Protocol
Name
LINKTYPE_WIHART
Number
223
Description
Reserved for Wireless HART (Highway Addressable Remote Transducer)
Name
LINKTYPE_FC_2
Number
224
Description
Fibre Channel FC-2 frames
Reference
Name
LINKTYPE_FC_2_WITH_FRAME_DELIMS
Number
225
Description
Fibre Channel FC-2 frames with SOF and EOF
Reference
Name
LINKTYPE_IPNET
Number
226
Description
Solaris ipnet
Reference
Name
LINKTYPE_CAN_SOCKETCAN
Number
227
Description
Controller Area Network (CAN) frames, with a metadata header
Reference
Name
LINKTYPE_IPV4
Number
228
Description
Raw IPv4; the packet begins with an IPv4 header
Name
LINKTYPE_IPV6
Number
229
Description
Raw IPv6; the packet begins with an IPv6 header
Name
LINKTYPE_IEEE802_15_4_NOFCS
Number
230
Description
IEEE 802.15.4 without FCS
Reference
Name
LINKTYPE_DBUS
Number
231
Description
D-Bus messages
Reference
Name
LINKTYPE_JUNIPER_VS
Number
232
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_SRX_E2E
Number
233
Description
Reserved for Juniper Networks
Name
LINKTYPE_JUNIPER_FIBRECHANNEL
Number
234
Description
Reserved for Juniper Networks
Name
LINKTYPE_DVB_CI
Number
235
Description
DVB-CI messages, with a pseudo-header
Reference
Name
LINKTYPE_MUX27010
Number
236
Description
Variant of 3GPP TS 27.010 multiplexing protocol
Reference
Name
LINKTYPE_STANAG_5066_D_PDU
Number
237
Description
STANAG 5066 D_PDUs
Reference
Name
LINKTYPE_JUNIPER_ATM_CEMIC
Number
238
Description
Reserved for Juniper Networks
Name
LINKTYPE_NFLOG
Number
239
Description
Linux netlink NETLINK NFLOG socket log messages
Reference
Name
LINKTYPE_NETANALYZER
Number
240
Description
Ethernet frames with netANALYZER pseudo-header
Reference
Name
LINKTYPE_NETANALYZER_TRANSPARENT
Number
241
Description
Ethernet frames with netANALYZER pseudo-header, preamble, and SFD
Reference
Name
LINKTYPE_IPOIB
Number
242
Description
IP-over-InfiniBand
Reference
Name
LINKTYPE_MPEG_2_TS
Number
243
Description
MPEG-2 Transport Stream transport packets
Reference
Name
LINKTYPE_NG40
Number
244
Description
Frames from ng4T GmbH's ng40 protocol tester
Reference
Name
LINKTYPE_NFC_LLCP
Number
245
Description
NFC Logical Link Control Protocol frames, with a pseudo-header
Reference
Name
LINKTYPE_PFSYNC
Number
246
Description
Reserved for pfsync output
Name
LINKTYPE_INFINIBAND
Number
247
Description
InfiniBand data packets
Reference
Name
LINKTYPE_SCTP
Number
248
Description
SCTP packets, with no lower-level protocols such as IPv4 or IPv6
Reference
Name
LINKTYPE_USBPCAP
Number
249
Description
USB packets, beginning with a USBPcap header
Reference
Name
LINKTYPE_RTAC_SERIAL
Number
250
Description
Serial-line packet from the Schweitzer Engineering Laboratories RTAC product
Reference
Name
LINKTYPE_BLUETOOTH_LE_LL
Number
251
Description
Bluetooth Low Energy link-layer packets
Reference
Name
LINKTYPE_WIRESHARK_UPPER_PDU
Number
252
Description
Reserved for Wireshark
Name
LINKTYPE_NETLINK
Number
253
Description
Linux Netlink capture encapsulation
Reference
Name
LINKTYPE_BLUETOOTH_LINUX_MONITOR
Number
254
Description
Bluetooth Linux Monitor
Reference
Name
LINKTYPE_BLUETOOTH_BREDR_BB
Number
255
Description
Bluetooth Basic Rate and Enhanced Data Rate baseband packets
Reference
Name
LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR
Number
256
Description
Bluetooth Low Energy link-layer packets
Reference
Name
LINKTYPE_PROFIBUS_DL
Number
257
Description
PROFIBUS data link layer packets
Reference
Name
LINKTYPE_PKTAP
Number
258
Description
Apple PKTAP capture encapsulation
Reference
Name
LINKTYPE_EPON
Number
259
Description
Ethernet-over-passive-optical-network packets, including preamble octets
Reference
Name
LINKTYPE_IPMI_HPM_2
Number
260
Description
IPMI HPM.2 trace packets
Reference
Name
LINKTYPE_ZWAVE_R1_R2
Number
261
Description
Z-Wave RF profile R1 and R2 packets
Reference
Name
LINKTYPE_ZWAVE_R3
Number
262
Description
Z-Wave RF profile R3 packets
Reference
Name
LINKTYPE_WATTSTOPPER_DLM
Number
263
Description
WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol packets
Reference
Name
LINKTYPE_ISO_14443
Number
264
Description
ISO 14443 contactless smartcard messages
Reference
Name
LINKTYPE_RDS
Number
265
Description
IEC 62106 Radio data system (RDS) groups
Reference
Name
LINKTYPE_USB_DARWIN
Number
266
Description
USB packets captured on a Darwin-based operating system (macOS, etc.)
Reference
Name
LINKTYPE_OPENFLOW
Number
267
Description
Reserved for OpenBSD DLT_OPENFLOW
Name
LINKTYPE_SDLC
Number
268
Description
SNA SDLC packets
Reference
Name
LINKTYPE_TI_LLN_SNIFFER
Number
269
Description
Reserved for Texas Instruments protocol sniffer
Name
LINKTYPE_LORATAP
Number
270
Description
LoRaWan packets with a LoRaTap pseudo-header
Reference
Name
LINKTYPE_VSOCK
Number
271
Description
Protocol for communication between host and guest machines in VMware and KVM hypervisors
Reference
Name
LINKTYPE_NORDIC_BLE
Number
272
Description
Messages to and from a Nordic Semiconductor nRF Sniffer for Bluetooth LE packets
Reference
Name
LINKTYPE_DOCSIS31_XRA31
Number
273
Description
DOCSIS packets and bursts, preceded by a pseudo-header
Reference
Name
LINKTYPE_ETHERNET_MPACKET
Number
274
Description
IEEE 802.3 mPackets
Reference
Name
LINKTYPE_DISPLAYPORT_AUX
Number
275
Description
DisplayPort AUX channel monitoring messages
Reference
Name
LINKTYPE_LINUX_SLL2
Number
276
Description
Linux cooked capture encapsulation v2
Reference
Name
LINKTYPE_SERCOS_MONITOR
Number
277
Description
Reserved for Sercos Monitor
Name
LINKTYPE_OPENVIZSLA
Number
278
Description
OpenVizsla FPGA-based USB sniffer
Reference
Name
LINKTYPE_EBHSCR
Number
279
Description
Elektrobit High Speed Capture and Replay (EBHSCR) format
Reference
Name
LINKTYPE_VPP_DISPATCH
Number
280
Description
fd.io VPP graph dispatcher trace records
Reference
Name
LINKTYPE_DSA_TAG_BRCM
Number
281
Description
Ethernet frames, with a Broadcom switch tag inserted
Reference
Name
LINKTYPE_DSA_TAG_BRCM_PREPEND
Number
282
Description
Ethernet frames, with a Broadcom switch tag prepended
Reference
Name
LINKTYPE_IEEE802_15_4_TAP
Number
283
Description
IEEE 802.15.4 with a tap header preceding it
Reference
Name
LINKTYPE_DSA_TAG_DSA
Number
284
Description
Ethernet frames, with a Marvell DSA switch tag inserted
Reference
Name
LINKTYPE_DSA_TAG_EDSA
Number
285
Description
Ethernet frames, with a Marvell EDSA switch tag inserted
Reference
Name
LINKTYPE_ELEE
Number
286
Description
Reserved for ELEE lawful intercept protocol
Name
LINKTYPE_Z_WAVE_SERIAL
Number
287
Description
Serial frames transmitted between a host and a Z-Wave chip over an RS-232 or USB serial connection
Reference
section 5
Name
LINKTYPE_USB_2_0
Number
288
Description
USB 2.0, 1.1, or 1.0 packets
Reference
Name
LINKTYPE_ATSC_ALP
Number
289
Description
ATSC Link-Layer Protocol frames
Reference
Name
LINKTYPE_ETW
Number
290
Description
Event Tracing for Windows messages
Reference
Name
LINKTYPE_NETANALYZER_NG
Number
291
Description
Reserved for Hilscher Gesellschaft fuer Systemautomation mbH netANALYZER NG hardware and software
Name
LINKTYPE_ZBOSS_NCP
Number
292
Description
ZBOSS NCP Serial Protocol, with a pseudo-header
Reference
Name
LINKTYPE_USB_2_0_LOW_SPEED
Number
293
Description
Low-Speed USB 2.0, 1.1, or 1.0 packets
Reference
Name
LINKTYPE_USB_2_0_FULL_SPEED
Number
294
Description
Full-Speed USB 2.0, 1.1, or 1.0 packets
Reference
Name
LINKTYPE_USB_2_0_HIGH_SPEED
Number
295
Description
High-Speed USB 2.0 packets
Reference
Name
LINKTYPE_AUERSWALD_LOG
Number
296
Description
Auerswald Logger Protocol
Reference
Name
LINKTYPE_ZWAVE_TAP
Number
297
Description
Z-Wave packets, with a metadata header
Reference
Name
LINKTYPE_SILABS_DEBUG_CHANNEL
Number
298
Description
Silicon Labs debug channel protocol
Reference
Name
LINKTYPE_FIRA_UCI
Number
299
Description
Ultra-wideband (UWB) controller interface protocol (UCI)
Reference
Name
LINKTYPE_MDB
Number
300
Description
MDB (Multi-Drop Bus) protocol
Reference
Name
LINKTYPE_DECT_NR
Number
301
Description
DECT-2020 New Radio (NR) MAC layer
Reference
Guidance for Designated Experts When processing a request for a Specification Required allocation the Designated Experts are expected to be able to find the relevant specification at a clearly stable URL. It is noted that many enterprise web sites do not maintain URLs over a long period of time, and a document in a "wp-uploaded" section is highly likely to disappear. In addition specifications that require a reader to click through any kind of marketing or legal agreement are not considered public. The specification needs to be clearly written, and when the contents of the link type can contain an IPv4 or IPv6 header, then the octets between the beginning of the link type and the IP header needs to be very clearly specified in that document. Specifications that are not publicly available, but which may be obtained via liaison agreements (such as to ITU-T, 3GPP, IEEE, etc.) are acceptable particularly if the specification document will be public eventually, but are discouraged. For other documents, the Designated Expert will need use their judgement, or consult the OPSAWG or an Area Director. Linktypes may be allocated for specifications not publicly available may be made within the FCFS range. This includes specifications that might be classified. The minimal requirement is to provide a contact person for that link type.
Security Considerations This document describes the IANA registration rules for the LINKTYPE encapsulations. PCAP-related packet file formats use this value to determine what kind of headers precede network packet captures. Many of these formats can contain IPv4 and IPv6 packets. A system reading PCAP-related format captures can be subject to arbitrary inputs that may be controlled by malicious entities, so utmost caution is required. Many LINKTYPE formats include a "snapshot" length, which may be smaller than the actual packet. It is therefore very likely that trailing parts of a packet capture may be omitted, yet internal length fields in the packets will claim the packet is bigger than the capture. This leads to trivial buffer overreads, and systems interpreting the packets need to carefully scrutinize all attempts to read data from a capture.
Contributors PCAP has been developed over three and half decades by a variety of developers, including: Bill Fenner, Denis Ovsienko, Francois-Xavier Le Bail, Fulvio Risso, Gerald Combs, Gianluca Varenni, Gisle Vanem, Hannes Gredler, Joerg Mayer, Michal Sekletar, Stephen Donnelly, Torsten Landschoff, and Jun-ichiro itojun Hagino. PCAP was originally created at LBL by Steve McCanne, Craig Leres, and Van Jacobson.
Acknowledgments The authors wish to thank: Michael Tuexen, Mohamed Boucadair, Carsten Bormann, Henk Birkholtz, and Robert Wilton their invaluable comments and encouragement.
References Normative References Guidelines for Writing an IANA Considerations Section in RFCs Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. Informative References LINK-LAYER HEADER TYPES libpcap Homepage of Wireshark Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Mobile Station - Serving GPRS Support Node (MS-SGSN) Logical Link Control (LLC) layer specification 3GPP TS 04.64 Chaosnet MIT Artificial Intelligence Laboratory MIT A.I. Memo No. 628 ATA 878.1 - 1999 Local Area Network - Token Bus ARCNET Trade Association standard 878.1-1999 Packet structure n.d. AVS Capture Frame Format Version 2 DOCSIS 4.0 MAC and Upper Layer Protocols Interface Specification Excentis XRA Header Definition Draft ATA 878.2 ARCNET Packet Fragmentation Standard Version 1.4 ARCNET Trade Association draft standard 878.2 PCAP format for DVB-CI Documentation EBHSCR IEEE 802.15.4 TAP Link Type Specification VNET (VPP Network Stack) Generic Framing Procedure ITU-T Recommendation G.7041/Y.1303 PCAP format for ISO14443 LINKTYPE_APPLE_IP_OVER_IEEE1394 LINKTYPE_ATM_RFC1483 LINKTYPE_ATSC_ALP LINKTYPE_AX25 LINKTYPE_AX25_KISS LINKTYPE_BACNET_MS_TP LINKTYPE_BLUETOOTH_BREDR_BB LINKTYPE_BLUETOOTH_HCI_H4 LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR LINKTYPE_BLUETOOTH_LE_LL LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR LINKTYPE_BLUETOOTH_LINUX_MONITOR LINKTYPE_C_HDLC LINKTYPE_C_HDLC_WITH_DIR LINKTYPE_CAN_SOCKETCAN LINKTYPE_DBUS LINKTYPE_DECT_NR LINKTYPE_DISPLAYPORT_AUX LINKTYPE_DSA_TAG_BRCM LINKTYPE_DSA_TAG_BRCM_PREPEND LINKTYPE_DSA_TAG_DSA LINKTYPE_DSA_TAG_EDSA LINKTYPE_EPON LINKTYPE_ERF LINKTYPE_ETW LINKTYPE_ETHERNET_MPACKET LINKTYPE_FC_2 LINKTYPE_FC_2_WITH_FRAME_DELIMS LINKTYPE_FIRA_UCI LINKTYPE_FLEXRAY LINKTYPE_FRELAY LINKTYPE_FRELAY_WITH_DIR LINKTYPE_I2C_LINUX LINKTYPE_IEEE802_11_PRISM LINKTYPE_IEEE802_15_4_NOFCS LINKTYPE_IEEE802_15_4_NONASK_PHY LINKTYPE_IEEE802_15_4_WITHFCS LINKTYPE_IPOIB LINKTYPE_IP_OVER_FC LINKTYPE_INFINIBAND LINKTYPE_IPMI_HPM_2 LINKTYPE_IPNET LINKTYPE_LAPB_WITH_DIR LINKTYPE_LAPD LINKTYPE_LIN LINKTYPE_LINUX_IRDA LINKTYPE_LINUX_LAPD LINKTYPE_LINUX_SLL LINKTYPE_LINUX_SLL2 LINKTYPE_LOOP LINKTYPE_LORATAP LINKTYPE_LTALK LINKTYPE_MFR LINKTYPE_MPEG_2_TS LINKTYPE_MTP2 LINKTYPE_MTP2_WITH_PHDR LINKTYPE_MTP3 LINKTYPE_SCCP LINKTYPE_MUX27010 LINKTYPE_NETANALYZER LINKTYPE_NETANALYZER_TRANSPARENT LINKTYPE_NETLINK LINKTYPE_NFC_LLCP LINKTYPE_NFLOG LINKTYPE_NG40 LINKTYPE_NORDIC_BLE LINKTYPE_NULL LINKTYPE_PKTAP LINKTYPE_PPI LINKTYPE_PPP LINKTYPE_PPP_ETHER LINKTYPE_PPP_HDLC LINKTYPE_PPP_PPPD LINKTYPE_PPP_WITH_DIR LINKTYPE_PROFIBUS_DL LINKTYPE_RDS LINKTYPE_RTAC_SERIAL LINKTYPE_SDLC LINKTYPE_SITA LINKTYPE_SLIP LINKTYPE_STANAG_5066_D_PDU LINKTYPE_SUNATM LINKTYPE_USB_2_0 LINKTYPE_USB_2_0_FULL_SPEED LINKTYPE_USB_2_0_HIGH_SPEED LINKTYPE_USB_2_0_LOW_SPEED LINKTYPE_USB_DARWIN LINKTYPE_USB_LINUX LINKTYPE_USB_LINUX_MMAPPED LINKTYPE_VSOCK LINKTYPE_WATTSTOPPER_DLM LINKTYPE_ZBOSS_NCP LINKTYPE_ZWAVE_R1_R2 LINKTYPE_ZWAVE_R3 LINKTYPE_ZWAVE_TAP PCAP format for MDB OpenVizsla protocol description Practical Considerations in Ethernet Local Network Design Xerox Palo Alto Research Center Xerox Palo Alto Research Center Radiotap Web site radiotap.org Silabs Debug Channel Format n.d. Profile for Maritime High Frequency (HF) Radio Data Communications STANAG 5066 USBPcap Capture format specification Z-Wave Serial API Host Application Programming Guide PCAP Capture File Format Sandelman Software Works Inc This document describes the format used by the libpcap library to record captured packets to a file. Programs using the libpcap library to read and write those files, and thus reading and writing files in that format, include tcpdump. PCAP Next Generation (pcapng) Capture File Format Muenster University of Applied Sciences Politecnico di Torino Airbus Defence and Space CyberSecurity Wireshark Foundation Red Hat Sandelman Software Works This document describes a format to record captured packets to a file. This format is extensible; Wireshark can currently read and write it, and libpcap can currently read some pcapng files. Standard for the transmission of IP datagrams and ARP packets over ARCNET networks This memo specifies a standard method of encapsulating Internet Protocol (IP) and Address Resolution Protocol (ARP) datagrams on an ARCNET. This RFC is a standard protocol for the Internet community. Transmitting IP traffic over ARCNET networks This memo defines a protocol for the transmission of IP and ARP packets over the ARCnet Local Area Network.This memo specifies a method of encapsulating Internet Protocol (IP) and Address Resolution Protocol (ARP) datagrams for transmission across ARCNET using the "ARCNET Packet Header Definition Standard". [STANDARDS-TRACK] Stream Control Transmission Protocol This document describes the Stream Control Transmission Protocol (SCTP) and obsoletes RFC 4960. It incorporates the specification of the chunk flags registry from RFC 6096 and the specification of the I bit of DATA chunks from RFC 7053. Therefore, RFCs 6096 and 7053 are also obsoleted by this document. In addition, RFCs 4460 and 8540, which describe errata for SCTP, are obsoleted by this document. SCTP was originally designed to transport Public Switched Telephone Network (PSTN) signaling messages over IP networks. It is also suited to be used for other applications, for example, WebRTC. SCTP is a reliable transport protocol operating on top of a connectionless packet network, such as IP. It offers the following services to its users: The design of SCTP includes appropriate congestion avoidance behavior and resistance to flooding and masquerade attacks.