✅ Use editcap -T <new_dlt> to force a different DLT (only if you’re sure the raw data matches a standard one, e.g., Ethernet). Example:
The error refers to a mismatch between a network capture file and the software used to read it. The value 276 corresponds to the LINKTYPE_LINUX_SLL2 link-layer header. Technical Summary -pcap network type 276 unknown or unsupported-
Wireshark/Tshark isn't reading output correctly #100 - GitHub ✅ Use editcap -T <new_dlt> to force a
| Symptom | Likely Cause | Best Fix | |---------|--------------|-----------| | -pcap network type 276 unknown on move to older system | Libpcap version mismatch | editcap -T 1 | | Capture from nflog interface | NFLOG metadata | editcap -T 239 or -T 113 | | Capture from proprietary Zigbee sniffer | Custom 802.15.4 | Do NOT convert; install vendor dissector | | Unknown origin, file was edited manually | Corrupted global header | Use hexedit to restore original DLT | | Occurs only in Wireshark, not tcpdump | Wireshark dissector missing | Assign DLT_USER in Wireshark | ✅ Use editcap -T <
Common Network Type values include:
Standard versions of Wireshark (especially older builds) might not immediately support dissecting NFLOG frames because they contain a proprietary header that includes the packet data plus metadata added by the kernel (like the hook number, ingress device, and UID). If your Wireshark lacks the NFLOG dissector, it throws the error.
Open the PCAP file with xxd or hexdump :