Snort mailing list archives

Snort 2.9.7.2 throws ERROR: Cannot decode data link type 113 while reading pcaps


From: Pratik Narang <pratik.cse.bits () gmail com>
Date: Wed, 20 May 2015 17:10:39 +0530

Dear Snort users,

It is good to be back on this list after a long, long time :D
I haven't used Snort since 2 years, so my skills have got rusted.
Pardon the naivety of my questions, since I am essentially a noob
again :)

I am running Snort 2.9.7.2 on Ubuntu 12.04. It was running fine while
listening to eth0 interface.
Now, I tried to run it against .pcap files in a directory using the
option --pcap-dir="/path/to/dumpfiles". Snort throws up an error:
ERROR: Cannot decode data link type 113
I read somewhere that "--enable-non-ether-decoders" can be used to
resolve this. But I guess this option is not available for the present
version of Snort.

Any guesses where I am wrong and how to resolve this?

Thanks!

------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud 
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Current thread: