[Snort-users] ERROR: Cannot decode data link type 127

Paul Li paul at ...17768...
Tue Jun 6 23:11:29 EDT 2017

I used mac80211_hwsim create a virtual interface, looks like the following

wlan0     Link encap:UNSPEC  HWaddr
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

When I ran snort as the following

sudo snort -A console -c /etc/snort/snort.conf -i wlan0

After all the information printed out, I've got the following error:
pcap DAQ configured to passive.
Acquiring network traffic from "wlan0".
Reload thread starting...
Reload thread started, thread 0x7ff2ead91700 (11756)
ERROR: Cannot decode data link type 127
Fatal Error, Quitting..

Any thought?


More information about the Snort-users mailing list