Network Working Group                                     G. Harris, Ed.
Internet-Draft                                                          
Intended status: Informational                             M. Richardson
Expires: 26 May 2025                                           Sandelman
                                                        22 November 2024


       Link-Layer Types for PCAP and PCAPNG Capture File Formats
                   draft-ietf-opsawg-pcaplinktype-08

Abstract

   This document creates an IANA registry for the PCAP and PCAPNG
   LINKTYPE values.  The PCAP and PCAPNG formats are used to save
   network captures from programs such as tcpdump and wireshark, when
   using libraries such as libpcap.

About This Document

   This note is to be removed before publishing as an RFC.

   Status information for this document may be found at
   https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcaplinktype/.

   Discussion of this document takes place on the opsawg Working Group
   mailing list (mailto:opsawg@ietf.org), which is archived at
   https://mailarchive.ietf.org/arch/browse/opsawg/.  Subscribe at
   https://www.ietf.org/mailman/listinfo/opsawg/.

   Source for this draft and an issue tracker can be found at
   https://github.com/IETF-OPSAWG-WG/pcapng.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 26 May 2025.



Harris & Richardson        Expires 26 May 2025                  [Page 1]

Internet-Draft                pcaplinktype                 November 2024


Copyright Notice

   Copyright (c) 2024 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   3
     3.1.  PCAP Registry . . . . . . . . . . . . . . . . . . . . . .   3
     3.2.  LinkType Registry . . . . . . . . . . . . . . . . . . . .   3
       3.2.1.  Initial Values  . . . . . . . . . . . . . . . . . . .   4
       3.2.2.  Guidance for Designated Experts . . . . . . . . . . .  27
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .  28
   5.  Contributors  . . . . . . . . . . . . . . . . . . . . . . . .  28
   6.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  28
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  28
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  28
     7.2.  Informative References  . . . . . . . . . . . . . . . . .  29
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  37

1.  Introduction

   In the late 1980's, Van Jacobson, Steve McCanne, and others at the
   Network Research Group at Lawrence Berkeley National Laboratory
   developed the tcpdump program to capture and dissect network traces.
   The code to capture traffic, using low-level mechanisms in various
   operating systems, and to read and write network traces to a file was
   later put into a library named libpcap [LIBPCAP].

   Other documents describe the original (legacy) format used by tcpdump
   (pcap), as well as the revised format (pcapng) which is used by
   tcpdump and Wireshark [Wireshark].

   Within those formats each packet that is captured is described by a
   LINKTYPE value.  The LINKTYPE value selects one of many hundred
   formats for metadata and Layer 2 encapsulation of the packet.




Harris & Richardson        Expires 26 May 2025                  [Page 2]

Internet-Draft                pcaplinktype                 November 2024


   This document creates an IANA registry for the LINKTYPE format,
   establishing the IANA Considerations by which other uses of the pcap
   and pcapng formats may register new LINKTYPE values.

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

3.  IANA Considerations

3.1.  PCAP Registry

   IANA is requested to create a new registry group entitled "The PCAP
   Registry".

3.2.  LinkType Registry

   IANA is also requested to create a registry entitled "PCAP LinkType
   List" under The PCAP registry group (Section 3.1).

   The registry has the following structure:

   *  LINKTYPE Name: Indicates the symbolic name for this LinkType.  The
      name is prefixed with "LINKTYPE_" (i.e., LINKTYPE_something).

   *  LINKTYPE Value: Indicates the integer value assigned for this
      LinkType.

   *  Description: Provides a very short description.

   *  Reference: Indicates an authoritative the document reference for
      the LinkType or a requester reference.

   The LinkType value is a 16-bit number.  The policy allocation for the
   LinkType values is as follows:

   *  Values from 32768 to 65000 must be allocated via Specification
      Required (Section 4.6 of [RFC8126]).  Guidance for Designated
      Experts is provided in Section 3.2.2.

   *  Values from 0 to 32767 are allocated following a First-Come First-
      Served policy (Section 4.4 of [RFC8126]).  Note that this category
      includes the historical allocations which have an uneven level of
      definition.



Harris & Richardson        Expires 26 May 2025                  [Page 3]

Internet-Draft                pcaplinktype                 November 2024


   *  Values from 65001 to 65535 are reserved for Private Use
      (Section 4.1 of [RFC8126]).

   The initial version of the registry is provided in Section 3.2.1.  In
   each case here, the reference should be to [TCPDUMP] and the RFC
   number to be assigned to this document, which is not repeated each
   time.

   The initial values table is based upon the Link type list maintained
   by libpcap, and published on [TCPDUMP].

   Note that historically, values were assigned incrementally following
   First Come First Served policy, with a preference for a public
   specification, but with no mandate.  Some historical values may have
   less specification than desired.

   LinkType values 147 to 162 named LINKTYPE_RESERVED_xx were originally
   reserved for Private Use. Their use is Deprecated in favour of the
   values in the 65001-65535 range.

   In general, Private Use values should never leak out of the entity
   that uses it.  As the First Come First Served range is large and
   easily obtained, official values are recommended.

      There is often an associated DLT value which is often identical in
      value, but not universally so.  DLT values are associated with
      specific operation system captures, and are operating system
      specific, and are thus not subject to standardization.

3.2.1.  Initial Values

   This is the initial table for the registry:

   Name  LINKTYPE_NULL
   Number  0
   Description  BSD loopback encapsulation
   Reference  [LINKTYPE_NULL]

   Name  LINKTYPE_ETHERNET
   Number  1
   Description  IEEE 802.3 Ethernet

   Name  LINKTYPE_EXP_ETHERNET
   Number  2
   Description  Xerox experimental 3Mb Ethernet

   Name  LINKTYPE_AX25
   Number  3



Harris & Richardson        Expires 26 May 2025                  [Page 4]

Internet-Draft                pcaplinktype                 November 2024


   Description  AX.25 packet
   Reference  [AX.25]

   Name  LINKTYPE_PRONET
   Number  4
   Description  Reserved for PRONET

   Name  LINKTYPE_CHAOS
   Number  5
   Description  Reserved for MIT CHAOSNET

   Name  LINKTYPE_IEEE802_5
   Number  6
   Description  IEEE 802.5 Token Ring

   Name  LINKTYPE_ARCNET_BSD
   Number  7
   Description  ARCNET Data Packets with BSD encapsulation

   Name  LINKTYPE_SLIP
   Number  8
   Description  SLIP
   Reference  [LINKTYPE_SLIP]

   Name  LINKTYPE_PPP
   Number  9
   Description  PPP
   Reference  [RFC1661]/[RFC1662]

   Name  LINKTYPE_FDDI
   Number  10
   Description  FDDI: per ANSI INCITS 239-1994

   Name  not to be used
   Number  11-49
   Description  Do not use these values

   Name  LINKTYPE_PPP_HDLC
   Number  50
   Description  PPP in HDLC-like framing
   Reference  [RFC1662]

   Name  LINKTYPE_PPP_ETHER
   Number  51
   Description  PPPoE
   Reference  Section 4 of [RFC2516]

   Name  Reserved



Harris & Richardson        Expires 26 May 2025                  [Page 5]

Internet-Draft                pcaplinktype                 November 2024


   Number  52-98
   Description  Do not use these values

   Name  LINKTYPE_SYMANTEC_FIREWALL
   Number  99
   Description  Reserved for Symantec Enterprise Firewall

   Name  LINKTYPE_ATM_RFC1483
   Number  100
   Description  LLC/SNAP-encapsulated ATM
   Reference  [RFC1483]

   Name  LINKTYPE_RAW
   Number  101
   Description  Raw IP; begins with an IPv4 or IPv6 header

   Name  LINKTYPE_SLIP_BSDOS
   Number  102
   Description  Reserved for BSD/OS SLIP BPF header

   Name  LINKTYPE_PPP_BSDOS
   Number  103
   Description  Reserved for BSD/OS PPP BPF header

   Name  LINKTYPE_C_HDLC
   Number  104
   Description  Cisco PPP with HDLC framing
   Reference  Section 4.3.1 of [RFC1547]

   Name  LINKTYPE_IEEE802_11
   Number  105
   Description  IEEE 802.11 wireless LAN

   Name  LINKTYPE_ATM_CLIP
   Number  106
   Description  ATM Classical IP, with no header preceding IP

   Name  LINKTYPE_FRELAY
   Number  107
   Description  Frame Relay LAPF frames

   Name  LINKTYPE_LOOP
   Number  108
   Description  OpenBSD loopback encapsulation
   Reference  [LINKTYPE_LOOP]

   Name  LINKTYPE_ENC
   Number  109



Harris & Richardson        Expires 26 May 2025                  [Page 6]

Internet-Draft                pcaplinktype                 November 2024


   Description  Reserved for OpenBSD IPSEC encapsulation

   Name  LINKTYPE_LANE8023
   Number  110
   Description  Reserved for ATM LANE + 802.3

   Name  LINKTYPE_HIPPI
   Number  111
   Description  Reserved for NetBSD HIPPI

   Name  LINKTYPE_HDLC
   Number  112
   Description  Reserved for NetBSD HDLC framing

   Name  LINKTYPE_LINUX_SLL
   Number  113
   Description  Linux "cooked" capture encapsulation
   Reference  [LINKTYPE_LINUX_SLL]

   Name  LINKTYPE_LTALK
   Number  114
   Description  Apple LocalTalk

   Name  LINKTYPE_ECONET
   Number  115
   Description  Reserved for Acorn Econet

   Name  LINKTYPE_IPFILTER
   Number  116
   Description  Reserved for OpenBSD ipfilter

   Name  LINKTYPE_PFLOG
   Number  117
   Description  OpenBSD pflog; "struct pfloghdr" structure

   Name  LINKTYPE_CISCO_IOS
   Number  118
   Description  Reserved for Cisco-internal use

   Name  LINKTYPE_IEEE802_11_PRISM
   Number  119
   Description  Prism monitor mode
   Reference  [LINKTYPE_IEEE802_11_PRISM]

   Name  LINKTYPE_IEEE802_11_AIRONET
   Number  120
   Description  Reserved for 802.11 + FreeFreeBSD Aironet radio metadata




Harris & Richardson        Expires 26 May 2025                  [Page 7]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_HHDLC
   Number  121
   Description  Reserved for Siemens HiPath HDLC

   Name  LINKTYPE_IP_OVER_FC
   Number  122
   Description  IP-over-Fibre Channel, starting with the Network_Header
   Reference  [RFC2625]

   Name  LINKTYPE_SUNATM
   Number  123
   Description  ATM traffic captured from a SunATM device
   Reference  [LINKTYPE_SUNATM]

   Name  LINKTYPE_RIO
   Number  124
   Description  Reserved for RapidIO

   Name  LINKTYPE_PCI_EXP
   Number  125
   Description  Reserved for PCI Express

   Name  LINKTYPE_AURORA
   Number  126
   Description  Reserved for Xilinx Aurora link layer

   Name  LINKTYPE_IEEE802_11_RADIOTAP
   Number  127
   Description  Radiotap header, followed by an 802.11 header
   Reference  [Radiotap]

   Name  LINKTYPE_TZSP
   Number  128
   Description  Reserved for Tazmen Sniffer Protocol

   Name  LINKTYPE_ARCNET_LINUX
   Number  129
   Description  ARCNET Data Packets, per RFC 1051 frames w/variations

   Name  LINKTYPE_JUNIPER_MLPPP
   Number  130
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_MLFR
   Number  131
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_ES



Harris & Richardson        Expires 26 May 2025                  [Page 8]

Internet-Draft                pcaplinktype                 November 2024


   Number  132
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_GGSN
   Number  133
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_MFR
   Number  134
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_ATM2
   Number  135
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_SERVICES
   Number  136
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_ATM1
   Number  137
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_APPLE_IP_OVER_IEEE1394
   Number  138
   Description  Apple IP-over-IEEE 1394 cooked header
   Reference  [LINKTYPE_APPLE_IP_OVER_IEEE1394]

   Name  LINKTYPE_MTP2_WITH_PHDR
   Number  139
   Description  Signaling System 7 (SS7) Message Transfer Part Level
   Reference  [Q.703]

   Name  LINKTYPE_MTP2
   Number  140
   Description  SS7 Level 2
   Reference  [Q.703]

   Name  LINKTYPE_MTP3
   Number  141
   Description  SS7 Level 3, with no MTP2 header
   Reference  [Q.704]

   Name  LINKTYPE_SCCP
   Number  142
   Description  SS7 Control Part, with no MTP3 or MTP2 header
   Reference  [Q.711] [Q.712] [Q.713] [Q.714]




Harris & Richardson        Expires 26 May 2025                  [Page 9]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_DOCSIS
   Number  143
   Description  DOCSIS MAC frames
   Reference  [DOCSIS-4.0-MULP]

   Name  LINKTYPE_LINUX_IRDA
   Number  144
   Description  Linux-IrDA packets
   Reference  [LINKTYPE_LINUX_IRDA]

   Name  LINKTYPE_IBM_SP
   Number  145
   Description  Reserved for IBM SP switch

   Name  LINKTYPE_IBM_SN
   Number  146
   Description  Reserved for IBM Next Federation switch

   Name  LINKTYPE_RESERVED_01
   Number  147
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_02
   Number  148
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_03
   Number  149
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_04
   Number  150
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_05
   Number  151
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_06
   Number  152
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_07
   Number  153
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_08
   Number  154



Harris & Richardson        Expires 26 May 2025                 [Page 10]

Internet-Draft                pcaplinktype                 November 2024


   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_09
   Number  155
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_10
   Number  156
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_11
   Number  157
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_12
   Number  158
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_13
   Number  159
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_14
   Number  160
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_15
   Number  161
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_16
   Number  162
   Description  For private use (deprecated)

   Name  LINKTYPE_IEEE802_11_AVS
   Number  163
   Description  AVS header, followed by an 802.11 header
   Reference  [AVS]

   Name  LINKTYPE_JUNIPER_MONITOR
   Number  164
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_BACNET_MS_TP
   Number  165
   Description  BACnet MS/TP frames
   Reference  Section 9.3 MS/TP Frame Format of [ASHRAE-135]




Harris & Richardson        Expires 26 May 2025                 [Page 11]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_PPP_PPPD
   Number  166
   Description  PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC,
      different stuffing

   Name  LINKTYPE_JUNIPER_PPPOE
   Number  167
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_PPPOE_ATM
   Number  168
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_GPRS_LLC
   Number  169
   Description  General Packet Radio Service Logical Link Control, as
      per 3GPP TS 04.64
   Reference  [_3GPP-TS-04.64]

   Name  LINKTYPE_GPF_T
   Number  170
   Description  Transparent-mapped generic framing procedure
   Reference  [G.7041]

   Name  LINKTYPE_GPF_F
   Number  171
   Description  Frame-mapped generic framing procedure
   Reference  [G.7041]

   Name  LINKTYPE_GCOM_T1E1
   Number  172
   Description  Reserved for Gcom T1/E1 line monitoring equipment

   Name  LINKTYPE_GCOM_SERIAL
   Number  173
   Description  Reserved for Gcom T1/E1 line monitoring equipment

   Name  LINKTYPE_JUNIPER_PIC_PEER
   Number  174
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_ERF_ETH
   Number  175
   Description  Endace ERF header followed by 802.3 Ethernet

   Name  LINKTYPE_ERF_POS
   Number  176
   Description  Endace ERF header followed by Packet-over-SONET



Harris & Richardson        Expires 26 May 2025                 [Page 12]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_LINUX_LAPD
   Number  177
   Description  Linux vISDN LAPD frames
   Reference  [LINKTYPE_LINUX_LAPD]

   Name  LINKTYPE_JUNIPER_ETHER
   Number  178
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_PPP
   Number  179
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_FRELAY
   Number  180
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_CHDLC
   Number  181
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_MFR
   Number  182
   Description  FRF.16.1 Multi-Link Frame Relay frames, beginning with
      an FRF.12 Interface fragmentation format fragmentation header
   Reference  [FRF.16.1]

   Name  LINKTYPE_JUNIPER_VP
   Number  183
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_A429
   Number  184
   Description  Reserved for ARINC 429 frames

   Name  LINKTYPE_A653_ICM
   Number  185
   Description  Reserved for Arinc 653 Interpartition Communication
      messages

   Name  LINKTYPE_USB_FREEBSD
   Number  186
   Description  USB packets, beginning with a FreeBSD USB header

   Name  LINKTYPE_BLUETOOTH_HCI_H4
   Number  187
   Description  Bluetooth HCI UART transport layer; the frame contains




Harris & Richardson        Expires 26 May 2025                 [Page 13]

Internet-Draft                pcaplinktype                 November 2024


      an HCI packet indicator octet, as specified by the UART Transport
      Layer portion of the most recent Bluetooth Core specification,
      followed by an HCI packet of the specified packet type, as
      specified by the Host Controller Interface Functional
      Specification portion of the most recent Bluetooth Core
      Specification

   Name  LINKTYPE_IEEE802_16_MAC_CPS
   Number  188
   Description  Reserved for IEEE 802.16 MAC Common Part Sublayer

   Name  LINKTYPE_USB_LINUX
   Number  189
   Description  USB packets, beginning with a Linux USB header, as
      specified by the struct usbmon_packet in the Documentation/usb/
      usbmon.txt file in the Linux source tree.  Only the first 48
      octets of that header are present.  All fields in the header are
      in host byte order.  When performing a live capture, the host byte
      order is the byte order of the machine on which the packets are
      captured.  When reading a pcap file, the byte order is the byte
      order for the file, as specified by the file's magic number; when
      reading a pcapng file, the byte order is the byte order for the
      section of the pcapng file, as specified by the Section Header
      Block

   Name  LINKTYPE_CAN20B
   Number  190
   Description  Reserved for Controller Area Network (CAN) v. 2.0B
      packets

   Name  LINKTYPE_IEEE802_15_4_LINUX
   Number  191
   Description  IEEE 802.15.4, with address fields padded, as is done by
      Linux drivers

   Name  LINKTYPE_PPI
   Number  192
   Description  Per-Packet Information information, as specified by the
      Per-Packet Information Header Specification , followed by a packet
      with the LINKTYPE_ value specified by the pph_dlt field of that
      header
   Reference  [PPI]

   Name  LINKTYPE_IEEE802_16_MAC_CPS_RADIO
   Number  193
   Description  Reserved for 802.16 MAC Common Part Sublayer plus radio
      header




Harris & Richardson        Expires 26 May 2025                 [Page 14]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_JUNIPER_ISM
   Number  194
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_IEEE802_15_4_WITHFCS
   Number  195
   Description  IEEE 802.15.4 Low-Rate Wireless Networks, with each
      packet having the FCS at the end of the frame

   Name  LINKTYPE_SITA
   Number  196
   Description  Various link-layer types, with a pseudo-header
   Reference  [LINKTYPE_SITA]

   Name  LINKTYPE_ERF
   Number  197
   Description  Endace ERF records
   Reference  [ERF]

   Name  LINKTYPE_RAIF1
   Number  198
   Description  Reserved for Ethernet packets captured from a u10
      Networks board

   Name  LINKTYPE_IPMB_KONTRON
   Number  199
   Description  Reserved for IPMB packet for IPMI, with a 2-octet header

   Name  LINKTYPE_JUNIPER_ST
   Number  200
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
   Number  201
   Description  Bluetooth HCI UART transport layer; the frame contains a
      4-octet direction field, in network byte order (big-endian), the
      low-order bit of which is set if the frame was sent from the host
      to the controller and clear if the frame was received by the host
      from the controller, followed by an HCI packet indicator octet, as
      specified by the UART Transport Layer portion of the most recent
      Bluetooth Core specification, followed by an HCI packet of the
      specified packet type, as specified by the Host Controller
      Interface Functional Specification portion of the most recent
      Bluetooth Core Specification

   Name  LINKTYPE_AX25_KISS
   Number  202
   Description  AX.25 packet, with a KISS header



Harris & Richardson        Expires 26 May 2025                 [Page 15]

Internet-Draft                pcaplinktype                 November 2024


   Reference  [KISS] [AX.25]

   Name  LINKTYPE_LAPD
   Number  203
   Description  Link Access Procedures on the D Channel (LAPD) frames,
      starting with the address field, with no pseudo-header
   Reference  [Q.920] [Q.921]

   Name  LINKTYPE_PPP_WITH_DIR
   Number  204
   Description  PPP, as per RFC 1661 and RFC 1662 , preceded with a one-
      octet pseudo-header with a zero value meaning received by this
      host and a non-zero value meaning sent by this host; if the first
      2 octets are 0xff and 0x03, it's PPP in HDLC-like framing, with
      the PPP header following those two octets, otherwise it's PPP
      without framing, and the packet begins with the PPP header.  The
      data in the frame is not octet-stuffed or bit-stuffed

   Name  LINKTYPE_C_HDLC_WITH_DIR
   Number  205
   Description  Cisco PPP with HDLC framing, preceded with a one-octet
      pseudo-header with a zero value meaning received by this host and
      a non-zero value meaning sent by this host
   Reference  Section 4.3.1 of [RFC1547]

   Name  LINKTYPE_FRELAY_WITH_DIR
   Number  206
   Description  Frame Relay LAPF frames, beginning with a one-octet
      pseudo-header with a zero value meaning received by this host
      (DCE->DTE) and a non-zero value meaning sent by this host
      (DTE->DCE), followed by an ITU-T Recommendation Q.922 LAPF header
      starting with the address field, and without an FCS at the end of
      the frame

   Name  LINKTYPE_LAPB_WITH_DIR
   Number  207
   Description  Link Access Procedure, Balanced (LAPB), as specified by
      ITU-T Recommendation X.25 , preceded with a one-octet pseudo-
      header with a zero value meaning received by this host (DCE->DTE)
      and a non-zero value meaning sent by this host (DTE->DCE)

   Name  Reserved
   Number  208
   Description  Reserved for an unspecified link-layer type

   Name  LINKTYPE_I2C_LINUX
   Number  209
   Description  Linux I2C packets



Harris & Richardson        Expires 26 May 2025                 [Page 16]

Internet-Draft                pcaplinktype                 November 2024


   Reference  [LINKTYPE_I2C_LINUX]

   Name  LINKTYPE_FLEXRAY
   Number  210
   Description  FlexRay frames or symbols, with a pseudo-header
   Reference  [LINKTYPE_FLEXRAY]

   Name  LINKTYPE_MOST
   Number  211
   Description  Reserved for Media Oriented Systems Transport (MOST) bus

   Name  LINKTYPE_LIN
   Number  212
   Description  Local Interconnect Network (LIN) automotive bus
   Reference  [LINKTYPE_LIN]

   Name  LINKTYPE_X2E_SERIAL
   Number  213
   Description  Reserved for X2E serial line captures

   Name  LINKTYPE_X2E_XORAYA
   Number  214
   Description  Reserved for X2E Xoraya data loggers

   Name  LINKTYPE_IEEE802_15_4_NONASK_PHY
   Number  215
   Description  IEEE 802.15.4 Low-Rate Wireless Networks, with each
      packet having the FCS at the end of the frame, and with the PHY-
      level data for the O-QPSK, BPSK, GFSK, MSK, and RCC DSS BPSK PHYs
      (4 octets of 0 as preamble, one octet of SFD, one octet of frame
      length + reserved bit) preceding the MAC-layer data (starting with
      the frame control field)

   Name  LINKTYPE_LINUX_EVDEV
   Number  216
   Description  Reserved for Linux evdev messages

   Name  LINKTYPE_GSMTAP_UM
   Number  217
   Description  Reserved for GSM Um interface, with gsmtap header

   Name  LINKTYPE_GSMTAP_ABIS
   Number  218
   Description  Reserved for GSM Abis interface, with gsmtap header

   Name  LINKTYPE_MPLS
   Number  219
   Description  MPLS packets with MPLS label as the header



Harris & Richardson        Expires 26 May 2025                 [Page 17]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_USB_LINUX_MMAPPED
   Number  220
   Description  USB packets, beginning with a Linux USB header, as
      specified by the struct usbmon_packet in the Documentation/usb/
      usbmon.txt file in the Linux source tree.  All 64 octets of the
      header are present.  All fields in the header are in host byte
      order.  When performing a live capture, the host byte order is the
      byte order of the machine on which the packets are captured.  When
      reading a pcap file, the byte order is the byte order for the
      file, as specified by the file's magic number; when reading a
      pcapng file, the byte order is the byte order for the section of
      the pcapng file, as specified by the Section Header Block.  For
      isochronous transfers, the ndesc field specifies the number of
      isochronous descriptors that follow

   Name  LINKTYPE_DECT
   Number  221
   Description  Reserved for DECT packets, with a pseudo-header

   Name  LINKTYPE_AOS
   Number  222
   Description  Reserved for OS Space Data Link Protocol

   Name  LINKTYPE_WIHART
   Number  223
   Description  Reserved for Wireless HART (Highway Addressable Remote
      Transducer)

   Name  LINKTYPE_FC_2
   Number  224
   Description  Fibre Channel FC-2 frames, beginning with a Frame_Header

   Name  LINKTYPE_FC_2_WITH_FRAME_DELIMS
   Number  225
   Description  Fibre Channel FC-2 frames, beginning an encoding of the
      SOF, followed by a Frame_Header, and ending with an encoding of
      the SOF.  The encodings represent the frame delimiters as 4-octet
      sequences representing the corresponding ordered sets, with K28.5
      represented as 0xBC, and the D symbols as the corresponding octet
      values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
      is represented as 0xBC 0xB5 0x55 0x55

   Name  LINKTYPE_IPNET
   Number  226
   Description  Solaris ipnet
   Reference  [LINKTYPE_IPNET]

   Name  LINKTYPE_CAN_SOCKETCAN



Harris & Richardson        Expires 26 May 2025                 [Page 18]

Internet-Draft                pcaplinktype                 November 2024


   Number  227
   Description  Controller Area Network frames
   Reference  [LINKTYPE_CAN_SOCKETCAN]

   Name  LINKTYPE_IPV4
   Number  228
   Description  Raw IPv4; the packet begins with an IPv4 header

   Name  LINKTYPE_IPV6
   Number  229
   Description  Raw IPv6; the packet begins with an IPv6 header

   Name  LINKTYPE_IEEE802_15_4_NOFCS
   Number  230
   Description  IEEE 802.15.4 Low-Rate Wireless Network, without the FCS
      at the end of the frame

   Name  LINKTYPE_DBUS
   Number  231
   Description  Raw D-Bus messages , starting with the endianness flag,
      followed by the message type, etc., but without the authentication
      handshake before the message sequence
   Reference  [D-Bus]

   Name  LINKTYPE_JUNIPER_VS
   Number  232
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_SRX_E2E
   Number  233
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_JUNIPER_FIBRECHANNEL
   Number  234
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_DVB_CI
   Number  235
   Description  DVB-CI messages
   Reference  [DVB-CI-PCAP][DVB-CI]

   Name  LINKTYPE_MUX27010
   Number  236
   Description  Variant of 3GPP TS 27.010 multiplexing protocol
   Reference  [LINKTYPE_MUX27010]

   Name  LINKTYPE_STANAG_5066_D_PDU
   Number  237



Harris & Richardson        Expires 26 May 2025                 [Page 19]

Internet-Draft                pcaplinktype                 November 2024


   Description  D_PDUs as described by NATO standard STANAG 5066,
      starting with the synchronization sequence, and including both
      header and data CRCs.  The current version of STANAG 5066 is
      backwards-compatible with the 1.0.2 version , although newer
      versions are classified
   Reference  [STANAG-5066]

   Name  LINKTYPE_JUNIPER_ATM_CEMIC
   Number  238
   Description  Reserved for Juniper Networks

   Name  LINKTYPE_NFLOG
   Number  239
   Description  Linux netlink NETLINK NFLOG socket log messages
   Reference  [LINKTYPE_NFLOG]

   Name  LINKTYPE_NETANALYZER
   Number  240
   Description  Ethernet frames with netANALYZER pseudo-header
   Reference  [LINKTYPE_NETANALYZER]

   Name  LINKTYPE_NETANALYZER_TRANSPARENT
   Number  241
   Description  Ethernet frames with netANALYZER pseudo-header,
      preamble, and SFD
   Reference  [LINKTYPE_NETANALYZER_TRANSPARENT]

   Name  LINKTYPE_IPOIB
   Number  242
   Description  IP-over-InfiniBand
   Reference  Section 6 of [RFC4391]

   Name  LINKTYPE_MPEG_2_TS
   Number  243
   Description  MPEG-2 Transport Stream transport packets
   Reference  Table 2-2 of section 2.4.3.2 Transport Stream packet layer
      of [H.222.0]

   Name  LINKTYPE_NG40
   Number  244
   Description  Frames from ng4T GmbH's ng40 protocol tester
   Reference  [LINKTYPE_NG40]

   Name  LINKTYPE_NFC_LLCP
   Number  245
   Description  NFC Logical Link Control Protocol frames, with a pseudo-
      header
   Reference  [LINKTYPE_NFC_LLCP]



Harris & Richardson        Expires 26 May 2025                 [Page 20]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_PFSYNC
   Number  246
   Description  Reserved for pfsync output

   Name  LINKTYPE_INFINIBAND
   Number  247
   Description  Raw InfiniBand frames, starting with the Local Routing
      Header, as specified in Chapter 5 Data packet format of
      InfiniBand™ Architectural Specification Release 1.2.1 Volume 1 -
      General Specifications

   Name  LINKTYPE_SCTP
   Number  248
   Description  SCTP packets, as defined by RFC 4960 , with no lower-
      level protocols such as IPv4 or IPv6

   Name  LINKTYPE_USBPCAP
   Number  249
   Description  USB packets, beginning with a USBPcap header
   Reference  [USBPcap]

   Name  LINKTYPE_RTAC_SERIAL
   Number  250
   Description  Serial-line packet from the Schweitzer Engineering
      Laboratories RTAC product
   Reference  [LINKTYPE_RTAC_SERIAL]

   Name  LINKTYPE_BLUETOOTH_LE_LL
   Number  251
   Description  Bluetooth Low Energy air interface Link Layer packets,
      in the format described in Section 2.1 (PACKET FORMAT) of volume 6
      of the Bluetooth Specification Version 4.0 (see PDF page 2200),
      but without the Preamble

   Name  LINKTYPE_WIRESHARK_UPPER_PDU
   Number  252
   Description  Reserved for Wireshark

   Name  LINKTYPE_NETLINK
   Number  253
   Description  Linux Netlink capture encapsulation
   Reference  [LINKTYPE_NETLINK] [RFC3549]

   Name  LINKTYPE_BLUETOOTH_LINUX_MONITOR
   Number  254
   Description  Bluetooth Linux Monitor
   Reference  [LINKTYPE_BLUETOOTH_LINUX_MONITOR]




Harris & Richardson        Expires 26 May 2025                 [Page 21]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_BLUETOOTH_BREDR_BB
   Number  255
   Description  Bluetooth Basic Rate and Enhanced Data Rate baseband
      packets
   Reference  [LINKTYPE_BLUETOOTH_BREDR_BB]

   Name  LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR
   Number  256
   Description  Bluetooth Low Energy link-layer packets
   Reference  [LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR]

   Name  LINKTYPE_PROFIBUS_DL
   Number  257
   Description  PROFIBUS data link layer packets, as specified by IEC
      standard 61158-4-3, beginning with the start delimiter, ending
      with the end delimiter, and including all octets between them

   Name  LINKTYPE_PKTAP
   Number  258
   Description  Apple PKTAP capture encapsulation
   Reference  [LINKTYPE_PKTAP]

   Name  LINKTYPE_EPON
   Number  259
   Description  Ethernet-over-passive-optical-network packets, starting
      with the last 6 octets of the modified preamble as specified by
      65.1.3.2 Transmit in Clause 65 of Section 5 of IEEE 802.3,
      followed immediately by an Ethernet frame

   Name  LINKTYPE_IPMI_HPM_2
   Number  260
   Description  IPMI trace packets, as specified by Table 3-20 Trace
      Data Block Format in the PICMG HPM.2 specification The timestamps
      for packets in this format must match the timestamps in the Trace
      Data Blocks

   Name  LINKTYPE_ZWAVE_R1_R2
   Number  261
   Description  Z-Wave RF profile R1 and R2 packets
   Reference  [LINKTYPE_ZWAVE_R1_R2]

   Name  LINKTYPE_ZWAVE_R3
   Number  262
   Description  Z-Wave RF profile R3 packets
   Reference  [LINKTYPE_ZWAVE_R3]

   Name  LINKTYPE_WATTSTOPPER_DLM
   Number  263



Harris & Richardson        Expires 26 May 2025                 [Page 22]

Internet-Draft                pcaplinktype                 November 2024


   Description  WattStopper Digital Lighting Management (DLM) and
      Legrand Nitoo Open protocol packets
   Reference  [LINKTYPE_WATTSTOPPER_DLM]

   Name  LINKTYPE_ISO_14443
   Number  264
   Description  ISO 14443 contactless smartcard messages
   Reference  [ISO-14443-PCAP]

   Name  LINKTYPE_RDS
   Number  265
   Description  IEC 62106 Radio data system (RDS) groups
   Reference  [LINKTYPE_RDS]

   Name  LINKTYPE_USB_DARWIN
   Number  266
   Description  USB packets captured on a Darwin-based operating system
      (macOS, etc.)
   Reference  [LINKTYPE_USB_DARWIN]

   Name  LINKTYPE_OPENFLOW
   Number  267
   Description  Reserved for OpenBSD DLT_OPENFLOW

   Name  LINKTYPE_SDLC
   Number  268
   Description  SDLC packets, as specified by Chapter 1, DLC Links,
      section Synchronous Data Link Control (SDLC) of Systems Network
      Architecture Formats, GA27-3136-20 , without the flag fields,
      zero-bit insertion, or Frame Check Sequence field, containing SNA
      path information units (PIUs) as the payload

   Name  LINKTYPE_TI_LLN_SNIFFER
   Number  269
   Description  Reserved for Texas Instruments protocol sniffer

   Name  LINKTYPE_LORATAP
   Number  270
   Description  LoRaTap pseudo-header , followed by the payload, which
      is typically the PHYPayload from the LoRaWan specification
   Reference  [LoRaTap][LoRaWAN]

   Name  LINKTYPE_VSOCK
   Number  271
   Description  Protocol for communication between host and guest
      machines in VMware and KVM hypervisors
   Reference  [LINKTYPE_VSOCK]




Harris & Richardson        Expires 26 May 2025                 [Page 23]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_NORDIC_BLE
   Number  272
   Description  Messages to and from a Nordic Semiconductor nRF Sniffer
      for Bluetooth LE packets
   Reference  [LINKTYPE_NORDIC_BLE]

   Name  LINKTYPE_DOCSIS31_XRA31
   Number  273
   Description  DOCSIS packets and bursts, preceded by a pseudo-header
   Reference  [DOCSIS-XRA] [DOCSIS-4.0-MULP]

   Name  LINKTYPE_ETHERNET_MPACKET
   Number  274
   Description  mPackets, as specified by IEEE 802.3br Figure 99-4,
      starting with the preamble and always ending with a CRC field

   Name  LINKTYPE_DISPLAYPORT_AUX
   Number  275
   Description  DisplayPort AUX channel monitoring messages
   Reference  [LINKTYPE_DISPLAYPORT_AUX]

   Name  LINKTYPE_LINUX_SLL2
   Number  276
   Description  Linux cooked capture encapsulation v2
   Reference  [LINKTYPE_LINUX_SLL2]

   Name  LINKTYPE_SERCOS_MONITOR
   Number  277
   Description  Reserved for Sercos Monitor

   Name  LINKTYPE_OPENVIZSLA
   Number  278
   Description  OpenVizsla FPGA-based USB sniffer
   Reference  [OpenVizsla]

   Name  LINKTYPE_EBHSCR
   Number  279
   Description  Elektrobit High Speed Capture and Replay (EBHSCR) format
   Reference  [EBHSCR]

   Name  LINKTYPE_VPP_DISPATCH
   Number  280
   Description  fd.io VPP graph dispatcher trace records
   Reference  [FD.io-VPP]

   Name  LINKTYPE_DSA_TAG_BRCM
   Number  281
   Description  Ethernet frames, with a Broadcom switch tag inserted



Harris & Richardson        Expires 26 May 2025                 [Page 24]

Internet-Draft                pcaplinktype                 November 2024


   Reference  [LINKTYPE_DSA_TAG_BRCM]

   Name  LINKTYPE_DSA_TAG_BRCM_PREPEND
   Number  282
   Description  Ethernet frames, with a Broadcom switch tag prepended
   Reference  [LINKTYPE_DSA_TAG_BRCM_PREPEND]

   Name  LINKTYPE_IEEE802_15_4_TAP
   Number  283
   Description  IEEE 802.15.4 Low-Rate Wireless Networks, with a pseudo-
      header containing TLVs with metadata preceding the 802.15.4 header

   Name  LINKTYPE_DSA_TAG_DSA
   Number  284
   Description  Ethernet frames, with a Marvell DSA switch tag inserted
   Reference  [LINKTYPE_DSA_TAG_DSA]

   Name  LINKTYPE_DSA_TAG_EDSA
   Number  285
   Description  Ethernet frames, with a Marvell EDSA switch tag inserted
   Reference  [LINKTYPE_DSA_TAG_EDSA]

   Name  LINKTYPE_ELEE
   Number  286
   Description  Payload of lawful intercept packets using the ELEE
      protocol The packet begins with the ELEE header; it does not
      include any transport-layer or lower-layer headers for protocols
      used to transport ELEE packets

   Name  LINKTYPE_Z_WAVE_SERIAL
   Number  287
   Description  Serial frames transmitted between a host and a Z-Wave
      chip over an RS-232 or USB serial connection
   Reference  [Z_WAVE_SERIAL] section 5

   Name  LINKTYPE_USB_2_0
   Number  288
   Description  USB 2.0, 1.1, or 1.0 packet, beginning with a PID, as
      described by Chapter 8 Protocol Layer of the the Universal Serial
      Bus Specification Revision 2.0

   Name  LINKTYPE_ATSC_ALP
   Number  289
   Description  ATSC Link-Layer Protocol frames, as described in section
      5 of the A/330 Link-Layer Protocol specification, found at
      https://www.atsc.org/atsc-documents/type/3-0-standards/, beginning
      with a Base Header




Harris & Richardson        Expires 26 May 2025                 [Page 25]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_ETW
   Number  290
   Description  Event Tracing for Windows messages
   Reference  [LINKTYPE_ETW]

   Name  LINKTYPE_NETANALYZER_NG
   Number  291
   Description  Reserved for Hilscher Gesellschaft fuer Systemautomation
      mbH netANALYZER NG hardware and software

   Name  LINKTYPE_ZBOSS_NCP
   Number  292
   Description  ZBOSS NCP Serial Protocol, with a pseudo-header
   Reference  [LINKTYPE_ZBOSS_NCP]

   Name  LINKTYPE_USB_2_0_LOW_SPEED
   Number  293
   Description  Low-Speed USB 2.0, 1.1, or 1.0 packet, beginning with a
      PID, as described by Chapter 8 "Protocol Layer" of the
      https://www.usb.org/document-library/usb-20-specification the
      Universal Serial Bus Specification Revision 2.0

   Name  LINKTYPE_USB_2_0_FULL_SPEED
   Number  294
   Description  Full-Speed USB 2.0, 1.1, or 1.0 packet, beginning with a
      PID, as described by Chapter 8 "Protocol Layer" of the
      https://www.usb.org/document-library/usb-20-specification the
      Universal Serial Bus Specification Revision 2.0

   Name  LINKTYPE_USB_2_0_HIGH_SPEED
   Number  295
   Description  High-Speed USB 2.0 packet, beginning with a PID, as
      described by Chapter 8 "Protocol Layer" of the
      https://www.usb.org/document-library/usb-20-specification the
      Universal Serial Bus Specification Revision 2.0

   Name  LINKTYPE_AUERSWALD_LOG
   Number  296
   Description  Auerswald Logger Protocol, as described in
      https://github.com/Auerswald-GmbH/auerlog/blob/master/auerlog.txt

   Name  LINKTYPE_ZWAVE_TAP
   Number  297
   Description  Z-Wave packets, as specified by ITU-T Recommendation
      G.9959, with a https://gitlab.com/exegin/zwave-g9959-tap TAP meta-
      data header
   Reference  [Exegin-TAP-Link][G.9959]




Harris & Richardson        Expires 26 May 2025                 [Page 26]

Internet-Draft                pcaplinktype                 November 2024


   Name  LINKTYPE_SILABS_DEBUG_CHANNEL
   Number  298
   Description  Silicon Labs debug channel protocol, as described in htt
      ps://github.com/SiliconLabs/java_packet_trace_library/blob/master/
      doc/debug-channel.md

   Name  LINKTYPE_FIRA_UCI
   Number  299
   Description  Ultra-wideband (UWB) controller interface protocol (UCI)
   Reference  [LINKTYPE_FIRA_UCI]

   Name  LINKTYPE_MDB
   Number  300
   Description  MDB (Multi-Drop Bus) protocol between a vending machine
      controller and peripherals inside the vending machine, with the
      message format specified by https://www.kaiser.cx/pcap-mdb.html
      the PCAP format for MDB specification

   Name  LINKTYPE_DECT_NR
   Number  301
   Description  DECT-2020 New Radio (NR) MAC layer specified in
      https://www.etsi.org/committee/1394-dect ETSI TS 103 636-4.  The
      Physical Header Field is always encoded using 80 bits (10 bytes).
      Broadcast transmissions using 40 bits (5 bytes) is padded with 40
      zero bits (5 bytes).  When padding is used the Receiver Identity
      value 0x0000 (reserved address) is used to detect broadcast
      transmissions

3.2.2.  Guidance for Designated Experts

   When processing a request for a Specification Required allocation the
   Designated Experts are expected to be able to find the relevant
   specification at a clearly stable URL.  It is noted that many
   enterprise web sites do not maintain URLs over a long period of time,
   and a documented in a "wp-uploaded" section is highly likely to
   disappear.  In addition Specifications that require a reader to click
   through any kind of marketing or legal agreement are not considered
   public.  (This is the opinion of other corporate lawyers, who worry
   about what their employees might have agreed to)

   The specification needs to be clearly written, and when the contents
   of the link type can contain an IPv4 or IPv6 header, then the octets
   between the beginning of the link type and the IP header needs to be
   very clearly specified in that document.

   Specifications that are not publicly available, but which may be
   obtained via liaison agreements (such as to ITU-T, 3GPP, IEEE, etc.)
   are acceptable particularly if the document will be public



Harris & Richardson        Expires 26 May 2025                 [Page 27]

Internet-Draft                pcaplinktype                 November 2024


   eventually, but are discouraged.  For other documents, the Designated
   Expert will need use their judgement, or consult the WG or an Area
   Director.

   Linktypes may be allocated for specifications not publicly available
   may be made within the First-Come/First-Served area.  This includes
   specifications that might be classified.  The minimal requirement is
   for a contact person for that link type.

4.  Security Considerations

   This document describes the IANA registration rules for the LINKTYPE
   encapsulations.  PCAP, and PCAPNG packet file formats use this value
   to determine what kind of headers precede network packet captures.
   Many of these formats can contain IPv4 and IPv6 packets.  A system
   reading PCAP or PCAPNG format captures can be subject to arbitrary
   inputs that may be controlled by malicious entities, so utmost
   caution is required.

   Many LINKTYPE formats include a "snapshot" length, which may be
   smaller than the actual packet.  It is therefore very likely that
   trailing parts of a packet capture may be omitted, yet internal
   length fields in the packets will claim the packet is bigger than the
   capture.  This leads to trivial buffer overreads, and systems
   interpreting the packets need to carefully scrutinize all attempts to
   read data from a capture.

5.  Contributors

   PCAP has been developed over three and half decades by a variety of
   developers, including: Bill Fenner, Denis Ovsienko, Francois-Xavier
   Le Bail, Fulvio Risso, Gerald Combs, Gianluca Varenni, Gisle Vanem,
   Hannes Gredler, Joerg Mayer, Michal Sekletar, Stephen Donnelly,
   Torsten Landschoff, and Jun-ichiro itojun Hagino

   PCAP was originally created at LBL by Steve McCanne, Craig Leres, and
   Van Jacobson.

6.  Acknowledgments

   The authors wish to thank: Michael Tuexen, Mohamed Boucadair, Carsten
   Bormann, Henk Birkholtz, and Robert Wilton their invaluable comments
   and encouragement.

7.  References

7.1.  Normative References




Harris & Richardson        Expires 26 May 2025                 [Page 28]

Internet-Draft                pcaplinktype                 November 2024


   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/rfc/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
              Writing an IANA Considerations Section in RFCs", BCP 26,
              RFC 8126, DOI 10.17487/RFC8126, June 2017,
              <https://www.rfc-editor.org/rfc/rfc8126>.

7.2.  Informative References

   [TCPDUMP]  "LINK-LAYER HEADER TYPES", n.d.,
              <https://www.tcpdump.org/linktypes.html>.

   [LIBPCAP]  "libpcap", n.d.,
              <https://github.com/the-tcpdump-group/libpcap>.

   [Wireshark]
              "Homepage of Wireshark", n.d.,
              <https://www.wireshark.org>.

   [_3GPP-TS-04.64]
              "Digital cellular telecommunications system (Phase 2+);
              General Packet Radio Service (GPRS); Mobile Station -
              Serving GPRS Support Node (MS-SGSN) Logical Link Control
              (LLC) layer specification", 3GPP TS 04.64, n.d..

   [ASHRAE-135]
              "BACnet(TM): A Data Communication Protocol for Building
              Automation and Control Networks", ANSI/ASHRAE Standard
              135, n.d..

   [AVS]      Peachy, S., "Archived AVS specification", n.d.,
              <http://web.archive.org/web/20040803232023/
              http://www.shaftnet.org/~pizza/software/capturefrm.txt>.

   [AX.25]    Beech, W. A., Nielsen, D. E., and J. Taylor, "AX.25 Link
              Access Protocol for Amateur Packet Radio Version 2.2",
              July 1998, <https://www.ax25.net/AX25.2.2-Jul%2098-2.pdf>.







Harris & Richardson        Expires 26 May 2025                 [Page 29]

Internet-Draft                pcaplinktype                 November 2024


   [D-Bus]    Pennington, H., Carlsson, A., Larsson, A., Herzberg, S.,
              McVittie, S., and D. Zeuthen, "D-Bus Specification", n.d.,
              <https://dbus.freedesktop.org/doc/dbus-
              specification.html>.

   [DOCSIS-4.0-MULP]
              "DOCSIS 4.0 MAC and Upper Layer Protocols Interface
              Specification", n.d.,
              <https://www.cablelabs.com/specifications/CM-SP-
              MULPIv4.0>.

   [DOCSIS-XRA]
              "Excentis XRA Header", n.d.,
              <https://support.excentis.com/index.php?/Knowledgebase/
              Article/View/159>.

   [DVB-CI]   "Common Interface Specification for Conditional Access and
              other Digital Video Broadcasting Decoder Applications",
              n.d., <https://dvb.org/?standard=common-interface-
              specification-for-conditional-access-and-other-digital-
              video-broadcasting-decoder-applications>.

   [DVB-CI-PCAP]
              Kaiser, M., "PCAP format for DVB-CI", January 2021,
              <https://www.kaiser.cx/pcap-dvbci.html>.

   [EBHSCR]   "Documentation EBHSCR", n.d.,
              <http://www.elektrobit.com/ebhscr>.

   [ERF]      "ERF Types Reference Guide", n.d.,
              <https://www.endace.com/erf-extensible-record-format-
              types.pdf>.

   [Exegin-TAP-Link]
              "IEEE 802.15.4 TAP Link Type Specification", n.d.,
              <https://github.com/jkcko/ieee802.15.4-tap/blob/master/
              IEEE%20802.15.4%20TAP%20Link%20Type%20Specification.pdf>.

   [FD.io-VPP]
              "VNET (VPP Network Stack)", n.d., <https://fdio-
              vpp.readthedocs.io/en/latest/gettingstarted/developers/
              vnet.html>.

   [FRF.16.1] "Multilink Frame Relay UNI/NNI Implementation Agreement
              FRF.16.1", May 2002,
              <https://web.archive.org/web/20160427004354/
              https://www.broadband-forum.org/technical/download/FRF.16/
              frf16.1.pdf>.



Harris & Richardson        Expires 26 May 2025                 [Page 30]

Internet-Draft                pcaplinktype                 November 2024


   [G.7041]   "Generic Framing Procedure", ITU-T Recommendation G.7041/
              Y.1303, n.d., <https://www.itu.int/rec/T-REC-G.7041/en>.

   [G.9959]   "Short range narrow-band digital radiocommunication
              transceivers - PHY, MAC, SAR and LLC layer
              specifications", ITU-T Recommendation G.9959, n.d.,
              <https://www.itu.int/rec/T-REC-G.9959/en>.

   [H.222.0]  "Information technology - Generic coding of moving
              pictures and associated audio information: Systems", ITU-T
              Recommendation H.222.0, n.d.,
              <https://www.itu.int/rec/T-REC-H.222.0>.

   [ISO-14443-PCAP]
              Kaiser, M., "PCAP format for ISO14443", January 2021,
              <https://www.kaiser.cx/posts/pcap-iso14443/>.

   [KISS]     "The KISS TNC - A simple Host-to-TNC communications
              protocol", n.d., <https://www.ax25.net/kiss.aspx>.

   [LINKTYPE_APPLE_IP_OVER_IEEE1394]
              "LINKTYPE_APPLE_IP_OVER_IEEE1394", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_APPLE_IP_OVER_IEEE1394.html>.

   [LINKTYPE_BLUETOOTH_BREDR_BB]
              "LINKTYPE_BLUETOOTH_BREDR_BB", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_BREDR_BB.html>.

   [LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR]
              "LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR.html>.

   [LINKTYPE_BLUETOOTH_LINUX_MONITOR]
              "LINKTYPE_BLUETOOTH_LINUX_MONITOR", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_LINUX_MONITOR.html>.

   [LINKTYPE_CAN_SOCKETCAN]
              "LINKTYPE_CAN_SOCKETCAN", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_CAN_SOCKETCAN.html>.







Harris & Richardson        Expires 26 May 2025                 [Page 31]

Internet-Draft                pcaplinktype                 November 2024


   [LINKTYPE_DISPLAYPORT_AUX]
              "LINKTYPE_DISPLAYPORT_AUX", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DISPLAYPORT_AUX.html>.

   [LINKTYPE_DSA_TAG_BRCM]
              "LINKTYPE_DSA_TAG_BRCM", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_BRCM.html>.

   [LINKTYPE_DSA_TAG_BRCM_PREPEND]
              "LINKTYPE_DSA_TAG_BRCM_PREPEND", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_BRCM_PREPEND.html>.

   [LINKTYPE_DSA_TAG_DSA]
              "LINKTYPE_DSA_TAG_DSA", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_DSA.html>.

   [LINKTYPE_DSA_TAG_EDSA]
              "LINKTYPE_DSA_TAG_EDSA", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_EDSA.html>.

   [LINKTYPE_ETW]
              "LINKTYPE_ETW", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_ETW.html>.

   [LINKTYPE_FIRA_UCI]
              "LINKTYPE_FIRA_UCI", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_FIRA_UCI.html>.

   [LINKTYPE_FLEXRAY]
              "LINKTYPE_FLEXRAY", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_FLEXRAY.html>.

   [LINKTYPE_I2C_LINUX]
              "LINKTYPE_I2C_LINUX", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_I2C_LINUX.html>.

   [LINKTYPE_IEEE802_11_PRISM]
              "LINKTYPE_IEEE802_11_PRISM", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_IEEE802_11_PRISM.html>.




Harris & Richardson        Expires 26 May 2025                 [Page 32]

Internet-Draft                pcaplinktype                 November 2024


   [LINKTYPE_IPNET]
              "LINKTYPE_IPNET", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_IPNET.html>.

   [LINKTYPE_LIN]
              "LINKTYPE_LIN", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_LIN.html>.

   [LINKTYPE_LINUX_IRDA]
              "LINKTYPE_LINUX_IRDA", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_IRDA.html>.

   [LINKTYPE_LINUX_LAPD]
              "LINKTYPE_LINUX_LAPD", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_LAPD.html>.

   [LINKTYPE_LINUX_SLL]
              "LINKTYPE_LINUX_SLL", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_SLL.html>.

   [LINKTYPE_LINUX_SLL2]
              "LINKTYPE_LINUX_SLL2", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_SLL2.html>.

   [LINKTYPE_LOOP]
              "LINKTYPE_LOOP", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_LOOP.html>.

   [LINKTYPE_MUX27010]
              "LINKTYPE_MUX27010", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_MUX27010.html>.

   [LINKTYPE_NETANALYZER]
              "LINKTYPE_NETANALYZER", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NETANALYZER.html>.

   [LINKTYPE_NETANALYZER_TRANSPARENT]
              "LINKTYPE_NETANALYZER_TRANSPARENT", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NETANALYZER_TRANSPARENT.html>.





Harris & Richardson        Expires 26 May 2025                 [Page 33]

Internet-Draft                pcaplinktype                 November 2024


   [LINKTYPE_NETLINK]
              "LINKTYPE_NETLINK", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html>.

   [LINKTYPE_NFC_LLCP]
              "LINKTYPE_NFC_LLCP", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NFC_LLCP.html>.

   [LINKTYPE_NFLOG]
              "LINKTYPE_NFLOG", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html>.

   [LINKTYPE_NG40]
              "LINKTYPE_NG40", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_NG40.html>.

   [LINKTYPE_NORDIC_BLE]
              "LINKTYPE_NORDIC_BLE", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NORDIC_BLE.html>.

   [LINKTYPE_NULL]
              "LINKTYPE_NULL", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_NULL.html>.

   [LINKTYPE_PKTAP]
              "LINKTYPE_PKTAP", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_PKTAP.html>.

   [LINKTYPE_RDS]
              "LINKTYPE_RDS", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_RDS.html>.

   [LINKTYPE_RTAC_SERIAL]
              "LINKTYPE_RTAC_SERIAL", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_RTAC_SERIAL.html>.

   [LINKTYPE_SITA]
              "LINKTYPE_SITA", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_SITA.html>.

   [LINKTYPE_SLIP]
              "LINKTYPE_SLIP", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_SLIP.html>.





Harris & Richardson        Expires 26 May 2025                 [Page 34]

Internet-Draft                pcaplinktype                 November 2024


   [LINKTYPE_SUNATM]
              "LINKTYPE_SUNATM", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_SUNATM.html>.

   [LINKTYPE_USB_DARWIN]
              "LINKTYPE_USB_DARWIN", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_DARWIN.html>.

   [LINKTYPE_VSOCK]
              "LINKTYPE_VSOCK", n.d.,
              <https://www.tcpdump.org/linktypes/LINKTYPE_VSOCK.html>.

   [LINKTYPE_WATTSTOPPER_DLM]
              "LINKTYPE_WATTSTOPPER_DLM", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_WATTSTOPPER_DLM.html>.

   [LINKTYPE_ZBOSS_NCP]
              "LINKTYPE_ZBOSS_NCP", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZBOSS_NCP.html>.

   [LINKTYPE_ZWAVE_R1_R2]
              "LINKTYPE_ZWAVE_R1_R2", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZWAVE_R1_R2.html>.

   [LINKTYPE_ZWAVE_R3]
              "LINKTYPE_ZWAVE_R3", n.d.,
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZWAVE_R3.html>.

   [LoRaTap]  "LoRaTap", n.d.,
              <https://github.com/eriknl/LoRaTap/blob/master/README.md>.

   [LoRaWAN]  "About the LoRaWAN Standards", n.d.,
              <https://lora-alliance.org/lorawan-for-developers/>.

   [OpenVizsla]
              "OpenVizsla protocol description", August 2018,
              <https://github.com/matwey/libopenvizsla/wiki/OpenVizsla-
              protocol-description>.

   [PPI]      "Per-Packet Information Header Specification", May 2007,
              <https://web.archive.org/web/20160328114748/
              http://www.cacetech.com/documents/
              PPI%20Header%20format%201.0.7.pdf>.



Harris & Richardson        Expires 26 May 2025                 [Page 35]

Internet-Draft                pcaplinktype                 November 2024


   [Q.703]    "Specifications of Signalling System No. 7 Signalling
              Link", ITU-T Recommendation Q.703, n.d.,
              <https://www.itu.int/rec/T-REC-Q.703/en/>.

   [Q.704]    "Specifications of Signalling System No. 7 Signalling
              Network Functions And Messages", ITU-T Recommendation
              Q.704, n.d., <https://www.itu.int/rec/T-REC-Q.704/en/>.

   [Q.711]    "Specifications of Signalling System No. 7 Functional
              description of the signalling connection control part",
              ITU-T Recommendation Q.711, n.d.,
              <https://www.itu.int/rec/T-REC-Q.711/en/>.

   [Q.712]    "Specifications of Signalling System No. 7 Definition and
              function of signalling connection control part messages",
              ITU-T Recommendation Q.712, n.d.,
              <https://www.itu.int/rec/T-REC-Q.712/en/>.

   [Q.713]    "Specifications of Signalling System No. 7 Signalling
              connection control part functions and codes", ITU-T
              Recommendation Q.713, n.d.,
              <https://www.itu.int/rec/T-REC-Q.713/en/>.

   [Q.714]    "Specifications of Signalling System No. 7 Signalling
              connection control part procedures", ITU-T Recommendation
              Q.714, n.d., <https://www.itu.int/rec/T-REC-Q.714/en/>.

   [Radiotap] radiotap.org, "Radiotap Web site", n.d.,
              <http://www.radiotap.org/>.

   [Q.920]    "Digital Subscriber Signalling System No. 1 (DSS1) - ISDN
              User-Network Interface Data Link Layer - General aspects",
              ITU-T Recommendation Q.920, n.d.,
              <https://www.itu.int/rec/T-REC-Q.920/en/>.

   [Q.921]    "ISDN user-network interface - Data Link Layer
              specification", ITU-T Recommendation Q.921, n.d.,
              <https://www.itu.int/rec/T-REC-Q.921/en/>.

   [STANAG-5066]
              "Profile for Maritime High Frequency (HF) Radio Data
              Communications", STANAG 5066, n.d.,
              <https://web.archive.org/web/20051004082010/
              http://www.armymars.net/ArmyMARS/HF-Email/resources/
              stanag5066.pdf>.

   [USBPcap]  "USBPcap Capture format specification", n.d.,
              <https://desowin.org/usbpcap/captureformat.html>.



Harris & Richardson        Expires 26 May 2025                 [Page 36]

Internet-Draft                pcaplinktype                 November 2024


   [Z_WAVE_SERIAL]
              "Z-Wave Serial API Host Application Programming Guide",
              n.d., <https://www.silabs.com/documents/public/user-
              guides/INS12350-Serial-API-Host-Appl.-Prg.-Guide.pdf>.

   [RFC1661]  Simpson, W., Ed., "The Point-to-Point Protocol (PPP)",
              STD 51, RFC 1661, DOI 10.17487/RFC1661, July 1994,
              <https://www.rfc-editor.org/rfc/rfc1661>.

   [RFC1662]  Simpson, W., Ed., "PPP in HDLC-like Framing", STD 51,
              RFC 1662, DOI 10.17487/RFC1662, July 1994,
              <https://www.rfc-editor.org/rfc/rfc1662>.

   [RFC2516]  Mamakos, L., Lidl, K., Evarts, J., Carrel, D., Simone, D.,
              and R. Wheeler, "A Method for Transmitting PPP Over
              Ethernet (PPPoE)", RFC 2516, DOI 10.17487/RFC2516,
              February 1999, <https://www.rfc-editor.org/rfc/rfc2516>.

   [RFC1483]  Heinanen, J., "Multiprotocol Encapsulation over ATM
              Adaptation Layer 5", RFC 1483, DOI 10.17487/RFC1483, July
              1993, <https://www.rfc-editor.org/rfc/rfc1483>.

   [RFC1547]  Perkins, D., "Requirements for an Internet Standard Point-
              to-Point Protocol", RFC 1547, DOI 10.17487/RFC1547,
              December 1993, <https://www.rfc-editor.org/rfc/rfc1547>.

   [RFC2625]  Rajagopal, M., Bhagwat, R., and W. Rickard, "IP and ARP
              over Fibre Channel", RFC 2625, DOI 10.17487/RFC2625, June
              1999, <https://www.rfc-editor.org/rfc/rfc2625>.

   [RFC4391]  Chu, J. and V. Kashyap, "Transmission of IP over
              InfiniBand (IPoIB)", RFC 4391, DOI 10.17487/RFC4391, April
              2006, <https://www.rfc-editor.org/rfc/rfc4391>.

   [RFC3549]  Salim, J., Khosravi, H., Kleen, A., and A. Kuznetsov,
              "Linux Netlink as an IP Services Protocol", RFC 3549,
              DOI 10.17487/RFC3549, July 2003,
              <https://www.rfc-editor.org/rfc/rfc3549>.

Authors' Addresses

   Guy Harris (editor)
   Email: gharris@sonic.net


   Michael C. Richardson
   Sandelman Software Works Inc
   Email: mcr+ietf@sandelman.ca



Harris & Richardson        Expires 26 May 2025                 [Page 37]

Internet-Draft                pcaplinktype                 November 2024


   URI:   http://www.sandelman.ca/


















































Harris & Richardson        Expires 26 May 2025                 [Page 38]