Snort mailing list archives
ERROR: Cannot decode data link type 127
From: Paul Li <paul () scybersecurity com>
Date: Tue, 6 Jun 2017 23:11:29 -0400
I used mac80211_hwsim create a virtual interface, looks like the following wlan0 Link encap:UNSPEC HWaddr 02-00-00-00-00-00-3A-30-00-00-00-00-00-00-00-00 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) When I ran snort as the following sudo snort -A console -c /etc/snort/snort.conf -i wlan0 After all the information printed out, I've got the following error: ... pcap DAQ configured to passive. Acquiring network traffic from "wlan0". Reload thread starting... Reload thread started, thread 0x7ff2ead91700 (11756) ERROR: Cannot decode data link type 127 Fatal Error, Quitting.. Any thought? Thanks, Paul ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- ERROR: Cannot decode data link type 127 Paul Li (Jun 06)