PCAP-LINKTYPE(7)

🦋 pcap-linktype — the manual, bestie edition

okay so this is pcap-linktype, from the Miscellaneous Information Manual (section 7, yes she's a section 7 girlie). it's all about the link-layer header types supported by libpcap. buckle up. 💖

---

✨ NAME ✨

pcap-linktype — link-layer header types supported by libpcap

---

🌸 DESCRIPTION 🌸

so here's the tea ☕: when you're doing a live capture or reading a savefile, libpcap hands you back a value from the pcap_datalink(3PCAP) routine, and that value tells you what type of link-layer header is sitting at the very beginning of the packets it's giving you. that's the whole vibe. 💅

and here's the part that lowkey trips people up: that header type is not necessarily the type of link-layer header that the packets being captured actually have on the network they're being captured from. like, packets from an IEEE 802.11 network might get handed to you by libpcap with Ethernet headers — headers that the network adapter or the network adapter driver cooked up from the 802.11 headers. so what you see isn't always what's on the wire, no cap. 😭

the names for those values all start with DLT_, so people sometimes call them "DLT_ values". iconic naming convention tbh.

now, if you ever need to translate back and forth between DLT_ values and their names, you've got:

• pcap_datalink_val_to_name(3PCAP) — value ➡️ name
• pcap_datalink_name_to_val(3PCAP) — name ➡️ value

🫶 super handy.

also!! some capture devices support more than one link-layer header type. so if you want to know what a device can do, use:

• pcap_list_datalinks(3PCAP) — retrieves the supported link-layer header types of a capture device
• pcap_set_datalink(3PCAP) — changes the link-layer header type of a capture device

periodt. you can look at the menu and order something different. 👑

one more thing, and it matters: the values stored in the link-layer header type field in the savefile header are, in most but not all cases, the same as the values returned by pcap_datalink(). most. not all. 🙈 the names for those values start with LINKTYPE_. so like, DLT_ and LINKTYPE_ are cousins, not twins. iykyk.

and if you wanna see the full roster of link-layer header types that libpcap supports, it lives right here:

https://www.tcpdump.org/linktypes.html

go look. it's giving encyclopedia but make it cute. 🎀

---

💜 SEE ALSO 💜

• pcap(3PCAP)

---

and that's the whole page, bestie!! this lil masterpiece is brought to you by the fine folks behind PCAP-LINKTYPE(7), dated 1 October 2024. go forth and sniff responsibly. 🌈✨💖