The link type in the file header says what every packet in the file starts with: an Ethernet header, an 802.11 frame with a radio header in front, a bare IP packet, and so on. The same numbers are used in pcapng’s Interface Description Blocks. The tcpdump project keeps the register, and an IETF draft is turning it into an IANA registry.
LINKTYPE and DLT
Each value has a name starting LINKTYPE_, which is the number stored in
files. libpcap’s programming interface uses DLT_ names, and on some
systems a DLT_ value differs from the LINKTYPE_ value for
the same link (for example DLT_RAW is 12 or 14 on some BSDs, while
LINKTYPE_RAW is always 101). libpcap converts between them when it reads
and writes files, so a file always holds the LINKTYPE_ value.
Values 147 to 162 are for private use within an organisation and are never assigned.
Values not in the table are unassigned. A few rows have no LINKTYPE_ name
because they were set aside for one product and never given one.
Register
| Value | Name | Packets start with |
|---|---|---|
| 0 | LINKTYPE_NULL | BSD loopback: a 4-byte protocol family in the writer’s byte order, then the packet |
| 1 | LINKTYPE_ETHERNET | IEEE 802.3 Ethernet header (10 Mb/s and faster) |
| 2 | LINKTYPE_EXP_ETHERNET | Experimental 3 Mb/s Ethernet |
| 3 | LINKTYPE_AX25 | AX.25 layer 2 packet (amateur radio) |
| 4 | LINKTYPE_PRONET | Reserved for Proteon ProNET Token Ring |
| 5 | LINKTYPE_CHAOS | Reserved for MIT Chaosnet |
| 6 | LINKTYPE_IEEE802_5 | IEEE 802.5 Token Ring |
| 7 | LINKTYPE_ARCNET_BSD | Reserved for ARCNET with BSD encapsulation |
| 8 | LINKTYPE_SLIP | SLIP, with a header giving the packet’s direction |
| 9 | LINKTYPE_PPP | Point-to-Point Protocol |
| 10 | LINKTYPE_FDDI | FDDI, as in ANSI INCITS 239-1994 |
| 32 | – | Reserved for Redback SmartEdge 400/800 |
| 50 | LINKTYPE_PPP_HDLC | PPP in HDLC-like framing |
| 51 | LINKTYPE_PPP_ETHER | PPPoE session packets |
| 99 | LINKTYPE_SYMANTEC_FIREWALL | Symantec (formerly Axent Raptor) firewall capture format |
| 100 | LINKTYPE_ATM_RFC1483 | LLC/SNAP-encapsulated ATM |
| 101 | LINKTYPE_RAW | A raw IPv4 or IPv6 packet, no link-layer header |
| 102 | LINKTYPE_SLIP_BSDOS | BSD/OS Serial Line IP |
| 103 | LINKTYPE_PPP_BSDOS | BSD/OS Point-to-Point Protocol |
| 104 | LINKTYPE_C_HDLC | Cisco PPP with HDLC framing |
| 105 | LINKTYPE_IEEE802_11 | IEEE 802.11 wireless LAN frame |
| 106 | LINKTYPE_ATM_CLIP | Linux Classical IP over ATM |
| 107 | LINKTYPE_FRELAY | Frame Relay LAPF |
| 108 | LINKTYPE_LOOP | OpenBSD loopback: like 0, but the protocol family is big-endian |
| 109 | LINKTYPE_ENC | Encapsulated packets for IPsec |
| 110 | – | Reserved for ATM LANE with IEEE 802.3 |
| 111 | LINKTYPE_HIPPI | NetBSD HIPPI |
| 112 | LINKTYPE_NETBSD_HDLC | Cisco HDLC as used by NetBSD |
| 113 | LINKTYPE_LINUX_SLL | Linux “cooked” capture header (version 1) |
| 114 | LINKTYPE_LTALK | Apple LocalTalk |
| 115 | – | Reserved for Acorn Econet |
| 116 | – | Reserved for OpenBSD ipfilter |
| 117 | LINKTYPE_PFLOG | OpenBSD pflog header; its layout depends on the host |
| 118 | – | Reserved for Cisco internal use |
| 119 | LINKTYPE_IEEE802_11_PRISM | Prism monitor-mode information, then an 802.11 frame |
| 120 | – | Reserved for Aironet 802.11 cards |
| 122 | LINKTYPE_IP_OVER_FC | IP and ARP over Fibre Channel (RFC 2625) |
| 123 | LINKTYPE_SUNATM | ATM traffic captured from a SunATM device |
| 124 | – | Reserved for RapidIO |
| 125 | – | Reserved for PCI Express |
| 126 | – | Reserved for Xilinx Aurora |
| 127 | LINKTYPE_IEEE802_11_RADIOTAP | A radiotap header, then an 802.11 frame |
| 128 | LINKTYPE_TZSP | Tazmen Sniffer Protocol: generic encapsulation with metadata |
| 129 | LINKTYPE_ARCNET_LINUX | ARCnet data packets with Linux encapsulation |
| 130 | LINKTYPE_JUNIPER_MLPPP | Juniper private link type |
| 131 | LINKTYPE_JUNIPER_MLFR | Juniper private link type |
| 132 | LINKTYPE_JUNIPER_ES | Juniper private link type |
| 133 | LINKTYPE_JUNIPER_GGSN | Juniper private link type |
| 134 | LINKTYPE_JUNIPER_MFR | Juniper private link type |
| 135 | LINKTYPE_JUNIPER_ATM2 | Juniper private link type |
| 136 | LINKTYPE_JUNIPER_SERVICES | Juniper private link type |
| 137 | LINKTYPE_JUNIPER_ATM1 | Juniper private link type |
| 138 | LINKTYPE_APPLE_IP_OVER_IEEE1394 | Apple IP over IEEE 1394 (FireWire) cooked header |
| 139 | LINKTYPE_MTP2_WITH_PHDR | SS7 MTP2 packets with a pseudo-header |
| 140 | LINKTYPE_MTP2 | SS7 MTP2 packets |
| 141 | LINKTYPE_MTP3 | SS7 MTP3 packets |
| 142 | LINKTYPE_SCCP | SS7 SCCP packets |
| 143 | LINKTYPE_DOCSIS | DOCSIS MAC frames |
| 144 | LINKTYPE_LINUX_IRDA | Linux-IrDA packets |
| 145 | LINKTYPE_IBM_SP | Reserved for IBM SP switch |
| 146 | LINKTYPE_IBM_SN | Reserved for IBM Next Federation switch |
| 147–162 | LINKTYPE_USER0 to LINKTYPE_USER15 | Private use; never assigned |
| 163 | LINKTYPE_IEEE802_11_AVS | AVS monitor-mode information, then an 802.11 frame |
| 164 | LINKTYPE_JUNIPER_MONITOR | Juniper private link type |
| 165 | LINKTYPE_BACNET_MS_TP | BACnet MS/TP frames |
| 166 | LINKTYPE_PPP_PPPD | PPP with a direction byte and an HDLC-like control field, as written by pppd |
| 167 | LINKTYPE_JUNIPER_PPPOE | Juniper private link type |
| 168 | LINKTYPE_JUNIPER_PPPOE_ATM | Juniper private link type |
| 169 | LINKTYPE_GPRS_LLC | GPRS Logical Link Control (3GPP TS 04.64) |
| 170 | LINKTYPE_GPF_T | Transparent-mapped generic framing procedure (ITU-T G.7041) |
| 171 | LINKTYPE_GPF_F | Frame-mapped generic framing procedure (ITU-T G.7041) |
| 172 | LINKTYPE_GCOM_T1E1 | Gcom T1/E1 line monitoring equipment |
| 173 | LINKTYPE_GCOM_SERIAL | Gcom serial line monitoring equipment |
| 174 | LINKTYPE_JUNIPER_PIC_PEER | Juniper private link type |
| 175 | LINKTYPE_ERF_ETH | Endace ERF records of the Ethernet type |
| 176 | LINKTYPE_ERF_POS | Endace ERF records of the Packet-over-SONET HDLC type |
| 177 | LINKTYPE_LINUX_LAPD | Linux vISDN LAPD frames |
| 178 | LINKTYPE_JUNIPER_ETHER | Juniper Ethernet frames with metadata in front |
| 179 | LINKTYPE_JUNIPER_PPP | Juniper PPP frames with metadata in front |
| 180 | LINKTYPE_JUNIPER_FRELAY | Juniper Frame Relay frames with metadata in front |
| 181 | LINKTYPE_JUNIPER_CHDLC | Juniper C-HDLC frames with metadata in front |
| 182 | LINKTYPE_MFR | FRF.16.1 Multi-Link Frame Relay frames |
| 183 | LINKTYPE_JUNIPER_VP | Juniper private link type |
| 184 | LINKTYPE_A429 | ARINC 429 frames, one little-endian 32-bit word each |
| 185 | LINKTYPE_A653_ICM | ARINC 653 interpartition communication messages |
| 186 | LINKTYPE_USB_FREEBSD | USB packets with a FreeBSD header |
| 187 | LINKTYPE_BLUETOOTH_HCI_H4 | Bluetooth HCI UART transport layer packets |
| 188 | LINKTYPE_IEEE802_16_MAC_CPS | IEEE 802.16 MAC Common Part Sublayer |
| 189 | LINKTYPE_USB_LINUX | USB packets with a Linux USB header |
| 190 | LINKTYPE_CAN20B | Controller Area Network 2.0B |
| 191 | LINKTYPE_IEEE802_15_4_LINUX | IEEE 802.15.4 with Linux-padded address fields |
| 192 | LINKTYPE_PPI | Per-Packet Information header, then the packet |
| 193 | LINKTYPE_IEEE802_16_MAC_CPS_RADIO | IEEE 802.16 MAC Common Part Sublayer with a radiotap header |
| 194 | LINKTYPE_JUNIPER_ISM | Juniper private link type |
| 195 | LINKTYPE_IEEE802_15_4_WITHFCS | IEEE 802.15.4 frames with an FCS |
| 196 | LINKTYPE_SITA | Various link types with a pseudo-header, for SITA |
| 197 | LINKTYPE_ERF | Endace ERF records |
| 198 | LINKTYPE_RAIF1 | A header in front of Ethernet frames from a u10 Networks board |
| 199 | LINKTYPE_IPMB_KONTRON | IPMB packets for IPMI, with a 2-byte header |
| 200 | LINKTYPE_JUNIPER_ST | Juniper private link type |
| 201 | LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR | Bluetooth HCI UART packets with a direction pseudo-header |
| 202 | LINKTYPE_AX25_KISS | KISS frames between a host and an AX.25 TNC |
| 203 | LINKTYPE_LAPD | Q.921 LAPD frames |
| 204 | LINKTYPE_PPP_WITH_DIR | PPP with a direction header |
| 205 | LINKTYPE_C_HDLC_WITH_DIR | Cisco PPP with HDLC framing and a direction header |
| 206 | LINKTYPE_FRELAY_WITH_DIR | Frame Relay LAPF with a direction header |
| 207 | LINKTYPE_LAPB_WITH_DIR | X.25 LAPB with a direction header |
| 208 | – | Once reserved, never assigned |
| 209 | LINKTYPE_I2C_LINUX | Linux I2C packets (old name LINKTYPE_IPMB_LINUX, not to be used) |
| 210 | LINKTYPE_FLEXRAY | FlexRay frames or symbols with a pseudo-header |
| 211 | LINKTYPE_MOST | MOST multimedia bus |
| 212 | LINKTYPE_LIN | LIN automotive bus with a metadata header |
| 213 | LINKTYPE_X2E_SERIAL | X2E private link type for serial captures |
| 214 | LINKTYPE_X2E_XORAYA | X2E private link type for Xoraya data loggers |
| 215 | LINKTYPE_IEEE802_15_4_NONASK_PHY | IEEE 802.15.4 frames with the PHY header |
| 216 | LINKTYPE_LINUX_EVDEV | Linux evdev events from /dev/input devices |
| 217 | LINKTYPE_GSMTAP_UM | GSM Um interface, with a gsmtap header in front |
| 218 | LINKTYPE_GSMTAP_ABIS | GSM Abis interface, with a gsmtap header in front |
| 219 | LINKTYPE_MPLS | An MPLS label as the link-layer header |
| 220 | LINKTYPE_USB_LINUX_MMAPPED | USB packets with the extended Linux USB header |
| 221 | LINKTYPE_DECT | DECT packets with a pseudo-header |
| 222 | LINKTYPE_AOS | AOS Space Data Link Protocol |
| 223 | LINKTYPE_WIHART | WirelessHART (IEC/PAS 62591) |
| 224 | LINKTYPE_FC_2 | Fibre Channel FC-2 frames |
| 225 | LINKTYPE_FC_2_WITH_FRAME_DELIMS | Fibre Channel FC-2 frames with start and end delimiters |
| 226 | LINKTYPE_IPNET | Solaris ipnet pseudo-header |
| 227 | LINKTYPE_CAN_SOCKETCAN | CAN frames with a SocketCAN metadata header |
| 228 | LINKTYPE_IPV4 | A raw IPv4 packet, no link-layer header |
| 229 | LINKTYPE_IPV6 | A raw IPv6 packet, no link-layer header |
| 230 | LINKTYPE_IEEE802_15_4_NOFCS | IEEE 802.15.4 frames without an FCS |
| 231 | LINKTYPE_DBUS | Raw D-Bus messages |
| 232 | LINKTYPE_JUNIPER_VS | Juniper private link type |
| 233 | LINKTYPE_JUNIPER_SRX_E2E | Juniper private link type |
| 234 | LINKTYPE_JUNIPER_FIBRECHANNEL | Juniper private link type |
| 235 | LINKTYPE_DVB_CI | DVB-CI messages with a pseudo-header |
| 236 | LINKTYPE_MUX27010 | A variant of the 3GPP TS 27.010 multiplexing protocol |
| 237 | LINKTYPE_STANAG_5066_D_PDU | STANAG 5066 D_PDUs |
| 238 | LINKTYPE_JUNIPER_ATM_CEMIC | Juniper private link type |
| 239 | LINKTYPE_NFLOG | Linux netlink NFLOG socket log messages |
| 240 | LINKTYPE_NETANALYZER | Ethernet with a Hilscher netANALYZER pseudo-header |
| 241 | LINKTYPE_NETANALYZER_TRANSPARENT | Ethernet with a netANALYZER pseudo-header, preamble and start-of-frame delimiter |
| 242 | LINKTYPE_IPOIB | IP over InfiniBand |
| 243 | LINKTYPE_MPEG_2_TS | MPEG-2 Transport Stream packets |
| 244 | LINKTYPE_NG40 | Frames from ng4T’s ng40 protocol tester |
| 245 | LINKTYPE_NFC_LLCP | NFC LLCP frames with a pseudo-header |
| 246 | LINKTYPE_PFSYNC | Packet filter state synchronisation |
| 247 | LINKTYPE_INFINIBAND | InfiniBand data packets |
| 248 | LINKTYPE_SCTP | SCTP packets with no lower-level protocols |
| 249 | LINKTYPE_USBPCAP | USB packets with a USBPcap header (Windows) |
| 250 | LINKTYPE_RTAC_SERIAL | Serial-line packets from an SEL RTAC product |
| 251 | LINKTYPE_BLUETOOTH_LE_LL | Bluetooth Low Energy link-layer packets |
| 252 | LINKTYPE_WIRESHARK_UPPER_PDU | Upper-layer protocol data saved by Wireshark, described by tags in front |
| 253 | LINKTYPE_NETLINK | Linux Netlink capture encapsulation |
| 254 | LINKTYPE_BLUETOOTH_LINUX_MONITOR | Bluetooth Linux Monitor |
| 255 | LINKTYPE_BLUETOOTH_BREDR_BB | Bluetooth BR/EDR baseband packets |
| 256 | LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR | Bluetooth Low Energy link-layer packets with a pseudo-header |
| 257 | LINKTYPE_PROFIBUS_DL | PROFIBUS data link layer packets |
| 258 | LINKTYPE_PKTAP | Apple PKTAP capture header |
| 259 | LINKTYPE_EPON | Ethernet over a passive optical network, with its preamble |
| 260 | LINKTYPE_IPMI_HPM_2 | IPMI HPM.2 trace packets |
| 261 | LINKTYPE_ZWAVE_R1_R2 | Z-Wave RF profile R1 and R2 packets |
| 262 | LINKTYPE_ZWAVE_R3 | Z-Wave RF profile R3 packets |
| 263 | LINKTYPE_WATTSTOPPER_DLM | WattStopper Digital Lighting Management and Legrand Nitoo packets |
| 264 | LINKTYPE_ISO_14443 | Messages between ISO 14443 contactless smartcards and readers |
| 265 | LINKTYPE_RDS | IEC 62106 Radio Data System groups |
| 266 | LINKTYPE_USB_DARWIN | USB packets captured on Darwin systems (macOS) |
| 267 | LINKTYPE_OPENFLOW | OpenFlow messages with a 12-byte extra header |
| 268 | LINKTYPE_SDLC | SNA SDLC packets |
| 269 | LINKTYPE_TI_LLN_SNIFFER | Texas Instruments low-power network sniffer frames |
| 270 | LINKTYPE_LORATAP | LoRaWAN packets with a LoRaTap pseudo-header |
| 271 | LINKTYPE_VSOCK | Host–guest socket traffic in VMware and KVM |
| 272 | LINKTYPE_NORDIC_BLE | Messages from the Nordic nRF Sniffer for Bluetooth LE |
| 273 | LINKTYPE_DOCSIS31_XRA31 | DOCSIS packets and bursts with a metadata pseudo-header (Excentis XRA-31) |
| 274 | LINKTYPE_ETHERNET_MPACKET | IEEE 802.3 mPackets |
| 275 | LINKTYPE_DISPLAYPORT_AUX | DisplayPort AUX channel monitoring messages |
| 276 | LINKTYPE_LINUX_SLL2 | Linux “cooked” capture header, version 2 |
| 277 | LINKTYPE_SERCOS_MONITOR | Sercos Monitor |
| 278 | LINKTYPE_OPENVIZSLA | Frames from the OpenVizsla FPGA-based USB sniffer |
| 279 | LINKTYPE_EBHSCR | Elektrobit High Speed Capture and Replay format |
| 280 | LINKTYPE_VPP_DISPATCH | FD.io VPP graph dispatch tracer records |
| 281 | LINKTYPE_DSA_TAG_BRCM | Ethernet with a Broadcom switch tag inserted |
| 282 | LINKTYPE_DSA_TAG_BRCM_PREPEND | Ethernet with a Broadcom switch tag in front |
| 283 | LINKTYPE_IEEE802_15_4_TAP | IEEE 802.15.4 with a TLV metadata pseudo-header |
| 284 | LINKTYPE_DSA_TAG_DSA | Ethernet with a Marvell DSA switch tag inserted |
| 285 | LINKTYPE_DSA_TAG_EDSA | Ethernet with a Marvell EDSA switch tag inserted |
| 286 | LINKTYPE_ELEE | Reserved for the ELEE lawful intercept protocol |
| 287 | LINKTYPE_Z_WAVE_SERIAL | Z-Wave serial frames between a host and its chip |
| 288 | LINKTYPE_USB_2_0 | USB 2.0, 1.1 or 1.0 packets |
| 289 | LINKTYPE_ATSC_ALP | ATSC Link-Layer Protocol frames |
| 290 | LINKTYPE_ETW | Event Tracing for Windows messages, version 1 |
| 291 | LINKTYPE_NETANALYZER_NG | Reserved for Hilscher netANALYZER NG |
| 292 | LINKTYPE_ZBOSS_NCP | ZBOSS NCP serial protocol with a pseudo-header |
| 293 | LINKTYPE_USB_2_0_LOW_SPEED | Low-speed USB 2.0, 1.1 or 1.0 packets |
| 294 | LINKTYPE_USB_2_0_FULL_SPEED | Full-speed USB 2.0, 1.1 or 1.0 packets |
| 295 | LINKTYPE_USB_2_0_HIGH_SPEED | High-speed USB 2.0 packets |
| 296 | LINKTYPE_AUERSWALD_LOG | Auerswald Logger Protocol packets |
| 297 | LINKTYPE_ZWAVE_TAP | Z-Wave packets with a metadata header |
| 298 | LINKTYPE_SILABS_DEBUG_CHANNEL | Silicon Labs debug channel protocol |
| 299 | LINKTYPE_FIRA_UCI | Ultra-wideband controller interface (FiRa UCI) |
| 300 | LINKTYPE_MDB | MDB (Multi-Drop Bus) messages with a pseudo-header |
| 301 | LINKTYPE_DECT_NR | DECT-2020 New Radio MAC layer |
| 302 | LINKTYPE_EDK2_MM | edk2 Management Mode request serialisation protocol |
| 303 | LINKTYPE_DEBUG_ONLY | Unstructured data for manual debugging only |
| 304 | LINKTYPE_DECT_NR_TAP | DECT-2020 New Radio frames with a metadata header |
| 305 | LINKTYPE_ETW2 | Event Tracing for Windows messages, version 2 |
The layout of each link-layer header is given on the tcpdump project’s page for that link type, linked from its register. The Juniper, X2E and other private types are not publicly documented.