ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] arptype 65534 not supported by libpcap - falling back to c

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 23 Jun 2008 23:48:46 -0700
Toralf F�rster wrote:
I'm wondering what I can do to avoid that message which appears if I try to sniff

a VPN connection established at home via DSL using AT & T Global Network Client.

Either compile the current top-of-CVS tree version of libpcap, or apply the attached patch to whatever version of libpcap you have, build it, and install it.

The alternative is to ignore the message (dismiss the dialog box) - the capture should happen, and no data should be lost. If the capture *doesn't* happen, file a bug.
Index: pcap-linux.c
===================================================================
RCS file: /tcpdump/master/libpcap/pcap-linux.c,v
retrieving revision 1.148
diff -c -r1.148 pcap-linux.c
*** pcap-linux.c	14 Apr 2008 21:04:51 -0000	1.148
--- pcap-linux.c	24 Jun 2008 06:43:49 -0000
***************
*** 1539,1544 ****
--- 1539,1555 ----
  		handle->linktype = DLT_LINUX_LAPD;
  		break;
  
+ #ifndef ARPHRD_NONE
+ #define ARPHRD_NONE	0xFFFE
+ #endif
+ 	case ARPHRD_NONE:
+ 		/*
+ 		 * No link-layer header; packets are just IP
+ 		 * packets, so use DLT_RAW.
+ 		 */
+ 		handle->linktype = DLT_RAW;
+ 		break;
+ 
  	default:
  		handle->linktype = -1;
  		break;