



Network Working Group                                     G. Harris, Ed.
Internet-Draft                                                          
Intended status: Informational                             M. Richardson
Expires: 26 May 2026                                           Sandelman
                                                        22 November 2025


         Link-Layer Types for PCAP-related Capture File Formats
                   draft-ietf-opsawg-pcaplinktype-14

Abstract

   This document describes a set of Packet CAPture (PCAP)-related
   LinkType values and creates an IANA registry for those values.  These
   values are used by the PCAP and PCAP-Now-Generic specifications.

About This Document

   This note is to be removed before publishing as an RFC.

   Status information for this document may be found at
   https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcaplinktype/.

   Discussion of this document takes place on the opsawg Working Group
   mailing list (mailto:opsawg@ietf.org), which is archived at
   https://mailarchive.ietf.org/arch/browse/opsawg/.  Subscribe at
   https://www.ietf.org/mailman/listinfo/opsawg/.

   Source for this draft and an issue tracker can be found at
   https://github.com/IETF-OPSAWG-WG/pcapng.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 26 May 2026.




Harris & Richardson        Expires 26 May 2026                  [Page 1]

Internet-Draft                pcaplinktype                 November 2025


Copyright Notice

   Copyright (c) 2025 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   3
     2.1.  PCAP Registry . . . . . . . . . . . . . . . . . . . . . .   3
     2.2.  LinkType Registry . . . . . . . . . . . . . . . . . . . .   3
       2.2.1.  Initial Values  . . . . . . . . . . . . . . . . . . .   4
       2.2.2.  Guidance for Designated Experts . . . . . . . . . . .  25
   3.  Security Considerations . . . . . . . . . . . . . . . . . . .  26
   4.  Contributors  . . . . . . . . . . . . . . . . . . . . . . . .  26
   5.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  26
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  26
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .  26
     6.2.  Informative References  . . . . . . . . . . . . . . . . .  26
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  38

1.  Introduction

   In the late 1980s, Van Jacobson, Steve McCanne, and others at the
   Network Research Group at Lawrence Berkeley National Laboratory
   developed the tcpdump program to capture and dissect network traces.
   The code to capture traffic, using low-level mechanisms in various
   operating systems, and to read and write network traces to a file was
   later put into a library named libpcap [LIBPCAP].

   Other documents describe the original (legacy) file format used by
   tcpdump (PCAP, [I-D.ietf-opsawg-pcap]), as well as a revised file
   format [I-D.ietf-opsawg-pcapng], both of which are used by tcpdump
   and Wireshark [Wireshark].

   Within those file formats each packet that is captured is indicated
   by a LinkType value.  The LinkType value selects one of many hundred
   formats for metadata and Layer 2 encapsulation of the packet.




Harris & Richardson        Expires 26 May 2026                  [Page 2]

Internet-Draft                pcaplinktype                 November 2025


   This document creates an IANA registry for LinkType values,
   establishing the IANA Considerations by which other uses of the PCAP-
   related formats may register new LinkType values.

2.  IANA Considerations

2.1.  PCAP Registry

   IANA is requested to create a new registry group entitled "The PCAP
   Registry".

2.2.  LinkType Registry

   IANA is also requested to create a registry entitled "PCAP-related
   LinkType List" under The PCAP registry group (Section 2.1).

   The registry has the following structure:

   *  LinkType Name: Indicates the symbolic name for this LinkType.  The
      name is prefixed with "LINKTYPE_" (i.e., LINKTYPE_something).

   *  LinkType Value: Indicates the 16-bit unsigned integer assigned for
      this LinkType.

   *  Description: Provides a very short description.

   *  Reference: Indicates an authoritative document reference for the
      LinkType or a requester reference.

   The policy allocation for the LinkType values is as follows:

   *  Values from 0 to 65000 are allocated following an Expert Review
      policy (Section 4.5 of [RFC8126]).  Values in the ranges 0-10,
      50-51, and 98-301 are already assigned; values in the ranges 11-49
      and 52-97 are reserved and must not be assigned.

   *  Values from 65001 to 65535 are reserved for Experimental Use
      (Section 4.2 of [RFC8126]).

   The initial version of the registry is provided in Section 2.2.1.  In
   each case here, the reference should be set to [TCPDUMP] and the RFC
   number to be assigned to this document, which is not repeated each
   time.  The change controller for all entries is the IESG, via
   appointed Designated Experts.

   The initial contents of the table are based upon the link-layer
   header type list maintained by libpcap, and published on [TCPDUMP].




Harris & Richardson        Expires 26 May 2026                  [Page 3]

Internet-Draft                pcaplinktype                 November 2025


   LinkType values 147 to 162 named LINKTYPE_RESERVED_xx were originally
   reserved for Experimental/Private Use, and that use continues to be
   supported.  However, new private use cases should use the values in
   the 65001-65535 range.

   In general, Experimental Use values should never leak out of the
   entity that uses it.  As the FCFS range is large and easily obtained,
   official values are recommended.

      There is often an associated Data Link Type (DLT) value which is
      often identical in value, but not universally so.  DLT values are
      associated with specific operating systems, and the numerical
      values for some of them are operating system specific, and are
      thus not subject to standardization.

2.2.1.  Initial Values

   This is the initial table for the registry:

   Name  LINKTYPE_NULL
   Number  0
   Description  BSD loopback encapsulation
   Reference  [LINKTYPE_NULL]

   Name  LINKTYPE_ETHERNET
   Number  1
   Description  IEEE 802.3 Ethernet
   Reference:  [LINKTYPE_ETHERNET]

   Name  LINKTYPE_EXP_ETHERNET
   Number  2
   Description  Xerox experimental 3Mb Ethernet
   Reference  [PracConsEthDesign]

   Name  LINKTYPE_AX25
   Number  3
   Description  AX.25 layer 2 packets
   Reference  [LINKTYPE_AX25]

   Name  LINKTYPE_PRONET
   Number  4
   Description  Proteon PRONet Token Ring

   Name  LINKTYPE_CHAOS
   Number  5
   Description  MIT Chaosnet
   Reference  [AIM-628]




Harris & Richardson        Expires 26 May 2026                  [Page 4]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_IEEE802_5
   Number  6
   Description  IEEE 802.5 Token Ring

   Name  LINKTYPE_ARCNET_BSD
   Number  7
   Description  ARCNET Data Packets with BSD encapsulation

   Name  LINKTYPE_SLIP
   Number  8
   Description  SLIP, with a direction header
   Reference  [LINKTYPE_SLIP]

   Name  LINKTYPE_PPP
   Number  9
   Description  PPP
   Reference  [LINKTYPE_PPP]

   Name  LINKTYPE_FDDI
   Number  10
   Description  FDDI: per ANSI INCITS 239-1994

   Name  Not available for assignment
   Number  11-49
   Description  Do not use these values

   Name  LINKTYPE_PPP_HDLC
   Number  50
   Description  PPP in HDLC-like framing
   Reference  [LINKTYPE_PPP_HDLC]

   Name  LINKTYPE_PPP_ETHER
   Number  51
   Description  PPPoE session packets
   Reference  [LINKTYPE_PPP_ETHER]

   Name  Not available for assignment
   Number  52-98
   Description  Used historically by NetBSD

   Name  LINKTYPE_SYMANTEC_FIREWALL
   Number  99
   Description  Symantec Enterprise Firewall

   Name  LINKTYPE_ATM_RFC1483
   Number  100
   Description  LLC/SNAP-encapsulated ATM
   Reference  [LINKTYPE_ATM_RFC1483]



Harris & Richardson        Expires 26 May 2026                  [Page 5]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_RAW
   Number  101
   Description  IP without link-layer headers
   Reference  [LINKTYPE_RAW] [RFC791] [RFC8200]

   Name  LINKTYPE_SLIP_BSDOS
   Number  102
   Description  BSD/OS SLIP BPF header

   Name  LINKTYPE_PPP_BSDOS
   Number  103
   Description  BSD/OS PPP BPF header

   Name  LINKTYPE_C_HDLC
   Number  104
   Description  Cisco PPP with HDLC framing
   Reference  [LINKTYPE_C_HDLC]

   Name  LINKTYPE_IEEE802_11
   Number  105
   Description  IEEE 802.11 wireless LAN

   Name  LINKTYPE_ATM_CLIP
   Number  106
   Description  ATM Classical IP, with no header preceding IP

   Name  LINKTYPE_FRELAY
   Number  107
   Description  Frame Relay LAPF
   Reference  [LINKTYPE_FRELAY]

   Name  LINKTYPE_LOOP
   Number  108
   Description  OpenBSD loopback encapsulation
   Reference  [LINKTYPE_LOOP]

   Name  LINKTYPE_ENC
   Number  109
   Description  OpenBSD IPsec encapsulation

   Name  LINKTYPE_LANE8023
   Number  110
   Description  ATM LANE + 802.3

   Name  LINKTYPE_HIPPI
   Number  111
   Description  NetBSD HIPPI




Harris & Richardson        Expires 26 May 2026                  [Page 6]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_HDLC
   Number  112
   Description  NetBSD HDLC framing

   Name  LINKTYPE_LINUX_SLL
   Number  113
   Description  Linux "cooked" capture encapsulation
   Reference  [LINKTYPE_LINUX_SLL]

   Name  LINKTYPE_LTALK
   Number  114
   Description  Apple LocalTalk
   Reference  [LINKTYPE_LTALK]

   Name  LINKTYPE_ECONET
   Number  115
   Description  Acorn Econet

   Name  LINKTYPE_IPFILTER
   Number  116
   Description  OpenBSD ipfilter

   Name  LINKTYPE_PFLOG
   Number  117
   Description  PF packet filter logging

   Name  LINKTYPE_CISCO_IOS
   Number  118
   Description  Cisco-internal use

   Name  LINKTYPE_IEEE802_11_PRISM
   Number  119
   Description  IEEE 802.11 wireless LAN, preceded by a Prism monitor
      mode header
   Reference  [LINKTYPE_IEEE802_11_PRISM]

   Name  LINKTYPE_IEEE802_11_AIRONET
   Number  120
   Description  802.11 + FreeBSD Aironet radio metadata

   Name  LINKTYPE_HHDLC
   Number  121
   Description  Siemens HiPath HDLC

   Name  LINKTYPE_IP_OVER_FC
   Number  122
   Description  IP and ATM over Fibre Channel
   Reference  [LINKTYPE_IP_OVER_FC]



Harris & Richardson        Expires 26 May 2026                  [Page 7]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_SUNATM
   Number  123
   Description  ATM traffic captured from a SunATM device
   Reference  [LINKTYPE_SUNATM]

   Name  LINKTYPE_RIO
   Number  124
   Description  RapidIO

   Name  LINKTYPE_PCI_EXP
   Number  125
   Description  PCI Express

   Name  LINKTYPE_AURORA
   Number  126
   Description  Xilinx Aurora link layer

   Name  LINKTYPE_IEEE802_11_RADIOTAP
   Number  127
   Description  IEEE 802.11 wireless LAN, preceded by a Radiotap header
   Reference  [Radiotap]

   Name  LINKTYPE_TZSP
   Number  128
   Description  Tazmen Sniffer Protocol

   Name  LINKTYPE_ARCNET_LINUX
   Number  129
   Description  ARCNET Data Packets with Linux encapsulation

   Name  LINKTYPE_JUNIPER_MLPPP
   Number  130
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_MLFR
   Number  131
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_ES
   Number  132
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_GGSN
   Number  133
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_MFR
   Number  134



Harris & Richardson        Expires 26 May 2026                  [Page 8]

Internet-Draft                pcaplinktype                 November 2025


   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_ATM2
   Number  135
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_SERVICES
   Number  136
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_ATM1
   Number  137
   Description  Juniper Networks

   Name  LINKTYPE_APPLE_IP_OVER_IEEE1394
   Number  138
   Description  Apple IP-over-IEEE 1394 cooked header
   Reference  [LINKTYPE_APPLE_IP_OVER_IEEE1394]

   Name  LINKTYPE_MTP2_WITH_PHDR
   Number  139
   Description  SS7 MTP2 frames, with a pseudo-header
   Reference  [LINKTYPE_MTP2_WITH_PHDR]

   Name  LINKTYPE_MTP2
   Number  140
   Description  SS7 MTP2 packets
   Reference  [LINKTYPE_MTP2]

   Name  LINKTYPE_MTP3
   Number  141
   Description  SS7 MTP3 packets
   Reference  [LINKTYPE_MTP3]

   Name  LINKTYPE_SCCP
   Number  142
   Description  SS7 SCCP packets
   Reference  [LINKTYPE_SCCP]

   Name  LINKTYPE_DOCSIS
   Number  143
   Description  DOCSIS MAC frames
   Reference  [DOCSIS-4.0-MULP]

   Name  LINKTYPE_LINUX_IRDA
   Number  144
   Description  Linux-IrDA packets
   Reference  [LINKTYPE_LINUX_IRDA]



Harris & Richardson        Expires 26 May 2026                  [Page 9]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_IBM_SP
   Number  145
   Description  IBM SP switch

   Name  LINKTYPE_IBM_SN
   Number  146
   Description  IBM Next Federation switch

   Name  LINKTYPE_RESERVED_01
   Number  147
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_02
   Number  148
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_03
   Number  149
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_04
   Number  150
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_05
   Number  151
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_06
   Number  152
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_07
   Number  153
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_08
   Number  154
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_09
   Number  155
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_10
   Number  156
   Description  For private use (deprecated)




Harris & Richardson        Expires 26 May 2026                 [Page 10]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_RESERVED_11
   Number  157
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_12
   Number  158
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_13
   Number  159
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_14
   Number  160
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_15
   Number  161
   Description  For private use (deprecated)

   Name  LINKTYPE_RESERVED_16
   Number  162
   Description  For private use (deprecated)

   Name  LINKTYPE_IEEE802_11_AVS
   Number  163
   Description  IEEE 802.11 wireless LAN, preceded by an AVS header
   Reference  [AVS]

   Name  LINKTYPE_JUNIPER_MONITOR
   Number  164
   Description  Juniper Networks

   Name  LINKTYPE_BACNET_MS_TP
   Number  165
   Description  BACnet MS/TP frames
   Reference  [LINKTYPE_BACNET_MS_TP]

   Name  LINKTYPE_PPP_PPPD
   Number  166
   Description  PPP preceded by a direction octet and an HDLC-like
      control field
   Reference  [LINKTYPE_PPP_PPPD]

   Name  LINKTYPE_JUNIPER_PPPOE
   Number  167
   Description  Juniper Networks




Harris & Richardson        Expires 26 May 2026                 [Page 11]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_JUNIPER_PPPOE_ATM
   Number  168
   Description  Juniper Networks

   Name  LINKTYPE_GPRS_LLC
   Number  169
   Description  General Packet Radio Service Logical Link Control, as
      per 3GPP TS 04.64
   Reference  [_3GPP-TS-04.64]

   Name  LINKTYPE_GPF_T
   Number  170
   Description  Transparent-mapped generic framing procedure
   Reference  [G.7041]

   Name  LINKTYPE_GPF_F
   Number  171
   Description  Frame-mapped generic framing procedure
   Reference  [G.7041]

   Name  LINKTYPE_GCOM_T1E1
   Number  172
   Description  Gcom T1/E1 line monitoring equipment

   Name  LINKTYPE_GCOM_SERIAL
   Number  173
   Description  Gcom T1/E1 line monitoring equipment

   Name  LINKTYPE_JUNIPER_PIC_PEER
   Number  174
   Description  Juniper Networks

   Name  LINKTYPE_ERF_ETH
   Number  175
   Description  Endace TYPE_ETH ERF records
   Reference  [LINKTYPE_ERF]

   Name  LINKTYPE_ERF_POS
   Number  176
   Description  Endace TYPE_POS_HDLC ERF records
   Reference  [LINKTYPE_ERF]

   Name  LINKTYPE_LINUX_LAPD
   Number  177
   Description  Linux vISDN LAPD frames
   Reference  [LINKTYPE_LINUX_LAPD]

   Name  LINKTYPE_JUNIPER_ETHER



Harris & Richardson        Expires 26 May 2026                 [Page 12]

Internet-Draft                pcaplinktype                 November 2025


   Number  178
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_PPP
   Number  179
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_FRELAY
   Number  180
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_CHDLC
   Number  181
   Description  Juniper Networks

   Name  LINKTYPE_MFR
   Number  182
   Description  FRF.16.1 Multi-Link Frame Relay frames
   Reference  [LINKTYPE_MFR]

   Name  LINKTYPE_JUNIPER_VP
   Number  183
   Description  Juniper Networks

   Name  LINKTYPE_A429
   Number  184
   Description  ARINC 429 frames

   Name  LINKTYPE_A653_ICM
   Number  185
   Description  Arinc 653 Interpartition Communication messages

   Name  LINKTYPE_USB_FREEBSD
   Number  186
   Description  USB traffic captured on FreeBSD

   Name  LINKTYPE_BLUETOOTH_HCI_H4
   Number  187
   Description  Bluetooth HCI UART Transport Layer packets
   Reference  [LINKTYPE_BLUETOOTH_HCI_H4]

   Name  LINKTYPE_IEEE802_16_MAC_CPS
   Number  188
   Description  IEEE 802.16 MAC Common Part Sublayer

   Name  LINKTYPE_USB_LINUX
   Number  189
   Description  USB packets, beginning with a Linux USB header



Harris & Richardson        Expires 26 May 2026                 [Page 13]

Internet-Draft                pcaplinktype                 November 2025


   Reference  [LINKTYPE_USB_LINUX]

   Name  LINKTYPE_CAN20B
   Number  190
   Description  Controller Area Network (CAN) v. 2.0B packets

   Name  LINKTYPE_IEEE802_15_4_LINUX
   Number  191
   Description  IEEE 802.15.4 with address fields padded by Linux

   Name  LINKTYPE_PPI
   Number  192
   Description  Per-Packet Information header preceding packet data
   Reference  [LINKTYPE_PPI]

   Name  LINKTYPE_IEEE802_16_MAC_CPS_RADIO
   Number  193
   Description  802.16 MAC Common Part Sublayer plus radio header

   Name  LINKTYPE_JUNIPER_ISM
   Number  194
   Description  Juniper Networks

   Name  LINKTYPE_IEEE802_15_4_WITHFCS
   Number  195
   Description  IEEE 802.15.4 with FCS
   Reference  [LINKTYPE_IEEE802_15_4_WITHFCS]

   Name  LINKTYPE_SITA
   Number  196
   Description  Various link-layer types, with a pseudo-header
   Reference  [LINKTYPE_SITA]

   Name  LINKTYPE_ERF
   Number  197
   Description  Endace ERF records
   Reference  [LINKTYPE_ERF]

   Name  LINKTYPE_RAIF1
   Number  198
   Description  Ethernet packets captured from a u10 Networks board

   Name  LINKTYPE_IPMB_KONTRON
   Number  199
   Description  IPMB packet for IPMI, with a 2-octet header

   Name  LINKTYPE_JUNIPER_ST
   Number  200



Harris & Richardson        Expires 26 May 2026                 [Page 14]

Internet-Draft                pcaplinktype                 November 2025


   Description  Juniper Networks

   Name  LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR
   Number  201
   Description  Bluetooth HCI UART Transport Layer packets with a
      direction pseudo-header
   Reference  [LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR]

   Name  LINKTYPE_AX25_KISS
   Number  202
   Description  KISS frames between a host and an AX.25 TNC
   Reference  [LINKTYPE_AX25_KISS]

   Name  LINKTYPE_LAPD
   Number  203
   Description  Q.921 LAPD frames
   Reference  [LINKTYPE_LAPD]

   Name  LINKTYPE_PPP_WITH_DIR
   Number  204
   Description  PPP, with a direction header
   Reference  [LINKTYPE_PPP_WITH_DIR]

   Name  LINKTYPE_C_HDLC_WITH_DIR
   Number  205
   Description  Cisco PPP with HDLC framing, with a direction header
   Reference  [LINKTYPE_C_HDLC_WITH_DIR]

   Name  LINKTYPE_FRELAY_WITH_DIR
   Number  206
   Description  Frame Relay LAPF, with a direction header
   Reference  [LINKTYPE_FRELAY_WITH_DIR]

   Name  LINKTYPE_LAPB_WITH_DIR
   Number  207
   Description  X.25 LAPB, with a direction header
   Reference  [LINKTYPE_LAPB_WITH_DIR]

   Name  WillBarker-Proprietary
   Number  208
   Description  Proprietary Link-Layer type

   Name  LINKTYPE_I2C_LINUX
   Number  209
   Description  Linux I2C packets
   Reference  [LINKTYPE_I2C_LINUX]

   Name  LINKTYPE_FLEXRAY



Harris & Richardson        Expires 26 May 2026                 [Page 15]

Internet-Draft                pcaplinktype                 November 2025


   Number  210
   Description  FlexRay frames or symbols, with a pseudo-header
   Reference  [LINKTYPE_FLEXRAY]

   Name  LINKTYPE_MOST
   Number  211
   Description  Media Oriented Systems Transport (MOST) bus

   Name  LINKTYPE_LIN
   Number  212
   Description  Local Interconnect Network (LIN) automotive bus, with a
      metadata header
   Reference  [LINKTYPE_LIN]

   Name  LINKTYPE_X2E_SERIAL
   Number  213
   Description  X2E serial line captures

   Name  LINKTYPE_X2E_XORAYA
   Number  214
   Description  X2E Xoraya data loggers

   Name  LINKTYPE_IEEE802_15_4_NONASK_PHY
   Number  215
   Description  IEEE 802.15.4 with PHY header
   Reference  [LINKTYPE_IEEE802_15_4_NONASK_PHY]

   Name  LINKTYPE_LINUX_EVDEV
   Number  216
   Description  Linux evdev messages

   Name  LINKTYPE_GSMTAP_UM
   Number  217
   Description  GSM Um interface, with gsmtap header

   Name  LINKTYPE_GSMTAP_ABIS
   Number  218
   Description  GSM Abis interface, with gsmtap header

   Name  LINKTYPE_MPLS
   Number  219
   Description  MPLS packets with MPLS label as the header

   Name  LINKTYPE_USB_LINUX_MMAPPED
   Number  220
   Description  USB packets, beginning with an extended Linux USB header
   Reference  [LINKTYPE_USB_LINUX_MMAPPED]




Harris & Richardson        Expires 26 May 2026                 [Page 16]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_DECT
   Number  221
   Description  DECT packets, with a pseudo-header

   Name  LINKTYPE_AOS
   Number  222
   Description  OS Space Data Link Protocol

   Name  LINKTYPE_WIHART
   Number  223
   Description  Wireless HART (Highway Addressable Remote Transducer)

   Name  LINKTYPE_FC_2
   Number  224
   Description  Fibre Channel FC-2 frames
   Reference  [LINKTYPE_FC_2]

   Name  LINKTYPE_FC_2_WITH_FRAME_DELIMS
   Number  225
   Description  Fibre Channel FC-2 frames with SOF and EOF
   Reference  [LINKTYPE_FC_2_WITH_FRAME_DELIMS]

   Name  LINKTYPE_IPNET
   Number  226
   Description  Solaris ipnet
   Reference  [LINKTYPE_IPNET]

   Name  LINKTYPE_CAN_SOCKETCAN
   Number  227
   Description  Controller Area Network (CAN) frames, with a metadata
      header
   Reference  [LINKTYPE_CAN_SOCKETCAN]

   Name  LINKTYPE_IPV4
   Number  228
   Description  IPv4 without link-layer headers
   Reference  [LINKTYPE_IPV4] [RFC791]

   Name  LINKTYPE_IPV6
   Number  229
   Description  IPv6 without link-layer headers
   Reference  [LINKTYPE_IPV6] [RFC8200]

   Name  LINKTYPE_IEEE802_15_4_NOFCS
   Number  230
   Description  IEEE 802.15.4 without FCS
   Reference  [LINKTYPE_IEEE802_15_4_NOFCS]




Harris & Richardson        Expires 26 May 2026                 [Page 17]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_DBUS
   Number  231
   Description  D-Bus messages
   Reference  [LINKTYPE_DBUS]

   Name  LINKTYPE_JUNIPER_VS
   Number  232
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_SRX_E2E
   Number  233
   Description  Juniper Networks

   Name  LINKTYPE_JUNIPER_FIBRECHANNEL
   Number  234
   Description  Juniper Networks

   Name  LINKTYPE_DVB_CI
   Number  235
   Description  DVB-CI messages, with a pseudo-header
   Reference  [DVB-CI-PCAP]

   Name  LINKTYPE_MUX27010
   Number  236
   Description  Variant of 3GPP TS 27.010 multiplexing protocol
   Reference  [LINKTYPE_MUX27010]

   Name  LINKTYPE_STANAG_5066_D_PDU
   Number  237
   Description  STANAG 5066 D_PDUs
   Reference  [LINKTYPE_STANAG_5066_D_PDU]

   Name  LINKTYPE_JUNIPER_ATM_CEMIC
   Number  238
   Description  Juniper Networks

   Name  LINKTYPE_NFLOG
   Number  239
   Description  Linux netlink NETLINK NFLOG socket log messages
   Reference  [LINKTYPE_NFLOG]

   Name  LINKTYPE_NETANALYZER
   Number  240
   Description  Ethernet frames with netANALYZER pseudo-header
   Reference  [LINKTYPE_NETANALYZER]

   Name  LINKTYPE_NETANALYZER_TRANSPARENT
   Number  241



Harris & Richardson        Expires 26 May 2026                 [Page 18]

Internet-Draft                pcaplinktype                 November 2025


   Description  Ethernet frames with netANALYZER pseudo-header,
      preamble, and SFD
   Reference  [LINKTYPE_NETANALYZER_TRANSPARENT]

   Name  LINKTYPE_IPOIB
   Number  242
   Description  IP-over-InfiniBand
   Reference  [LINKTYPE_IPOIB]

   Name  LINKTYPE_MPEG_2_TS
   Number  243
   Description  MPEG-2 Transport Stream transport packets
   Reference  [LINKTYPE_MPEG_2_TS]

   Name  LINKTYPE_NG40
   Number  244
   Description  Frames from ng4T GmbH's ng40 protocol tester
   Reference  [LINKTYPE_NG40]

   Name  LINKTYPE_NFC_LLCP
   Number  245
   Description  NFC Logical Link Control Protocol frames, with a pseudo-
      header
   Reference  [LINKTYPE_NFC_LLCP]

   Name  LINKTYPE_PFSYNC
   Number  246
   Description  pfsync output

   Name  LINKTYPE_INFINIBAND
   Number  247
   Description  InfiniBand data packets
   Reference  [LINKTYPE_INFINIBAND]

   Name  LINKTYPE_SCTP
   Number  248
   Description  SCTP packets, with no lower-level protocols such as IPv4
      or IPv6
   Reference  [RFC9260]

   Name  LINKTYPE_USBPCAP
   Number  249
   Description  USB packets, beginning with a USBPcap header
   Reference  [USBPcap]

   Name  LINKTYPE_RTAC_SERIAL
   Number  250
   Description  Serial-line packet from the Schweitzer Engineering



Harris & Richardson        Expires 26 May 2026                 [Page 19]

Internet-Draft                pcaplinktype                 November 2025


      Laboratories RTAC product
   Reference  [LINKTYPE_RTAC_SERIAL]

   Name  LINKTYPE_BLUETOOTH_LE_LL
   Number  251
   Description  Bluetooth Low Energy link-layer packets
   Reference  [LINKTYPE_BLUETOOTH_LE_LL]

   Name  LINKTYPE_WIRESHARK_UPPER_PDU
   Number  252
   Description  Wireshark

   Name  LINKTYPE_NETLINK
   Number  253
   Description  Linux Netlink capture encapsulation
   Reference  [LINKTYPE_NETLINK]

   Name  LINKTYPE_BLUETOOTH_LINUX_MONITOR
   Number  254
   Description  Bluetooth Linux Monitor
   Reference  [LINKTYPE_BLUETOOTH_LINUX_MONITOR]

   Name  LINKTYPE_BLUETOOTH_BREDR_BB
   Number  255
   Description  Bluetooth Basic Rate and Enhanced Data Rate baseband
      packets
   Reference  [LINKTYPE_BLUETOOTH_BREDR_BB]

   Name  LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR
   Number  256
   Description  Bluetooth Low Energy link-layer packets
   Reference  [LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR]

   Name  LINKTYPE_PROFIBUS_DL
   Number  257
   Description  PROFIBUS data link layer packets
   Reference  [LINKTYPE_PROFIBUS_DL]

   Name  LINKTYPE_PKTAP
   Number  258
   Description  Apple PKTAP capture encapsulation
   Reference  [LINKTYPE_PKTAP]

   Name  LINKTYPE_EPON
   Number  259
   Description  Ethernet-over-passive-optical-network packets, including
      preamble octets
   Reference  [LINKTYPE_EPON]



Harris & Richardson        Expires 26 May 2026                 [Page 20]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_IPMI_HPM_2
   Number  260
   Description  IPMI HPM.2 trace packets
   Reference  [LINKTYPE_IPMI_HPM_2]

   Name  LINKTYPE_ZWAVE_R1_R2
   Number  261
   Description  Z-Wave RF profile R1 and R2 packets
   Reference  [LINKTYPE_ZWAVE_R1_R2]

   Name  LINKTYPE_ZWAVE_R3
   Number  262
   Description  Z-Wave RF profile R3 packets
   Reference  [LINKTYPE_ZWAVE_R3]

   Name  LINKTYPE_WATTSTOPPER_DLM
   Number  263
   Description  WattStopper Digital Lighting Management (DLM) and
      Legrand Nitoo Open protocol packets
   Reference  [LINKTYPE_WATTSTOPPER_DLM]

   Name  LINKTYPE_ISO_14443
   Number  264
   Description  ISO 14443 contactless smartcard messages
   Reference  [ISO-14443-PCAP]

   Name  LINKTYPE_RDS
   Number  265
   Description  IEC 62106 Radio data system (RDS) groups
   Reference  [LINKTYPE_RDS]

   Name  LINKTYPE_USB_DARWIN
   Number  266
   Description  USB packets captured on a Darwin-based operating system
      (macOS, etc.)
   Reference  [LINKTYPE_USB_DARWIN]

   Name  LINKTYPE_OPENFLOW
   Number  267
   Description  OpenBSD DLT_OPENFLOW

   Name  LINKTYPE_SDLC
   Number  268
   Description  SNA SDLC packets
   Reference  [LINKTYPE_SDLC]

   Name  LINKTYPE_TI_LLN_SNIFFER
   Number  269



Harris & Richardson        Expires 26 May 2026                 [Page 21]

Internet-Draft                pcaplinktype                 November 2025


   Description  Texas Instruments protocol sniffer

   Name  LINKTYPE_LORATAP
   Number  270
   Description  LoRaWan packets with a LoRaTap pseudo-header
   Reference  [LINKTYPE_LORATAP]

   Name  LINKTYPE_VSOCK
   Number  271
   Description  Protocol for communication between host and guest
      machines in VMware and KVM hypervisors
   Reference  [LINKTYPE_VSOCK]

   Name  LINKTYPE_NORDIC_BLE
   Number  272
   Description  Messages to and from a Nordic Semiconductor nRF Sniffer
      for Bluetooth LE packets
   Reference  [LINKTYPE_NORDIC_BLE]

   Name  LINKTYPE_DOCSIS31_XRA31
   Number  273
   Description  DOCSIS packets and bursts, preceded by a pseudo-header
   Reference  [DOCSIS-XRA] [DOCSIS-4.0-MULP]

   Name  LINKTYPE_ETHERNET_MPACKET
   Number  274
   Description  IEEE 802.3 mPackets
   Reference  [LINKTYPE_ETHERNET_MPACKET]

   Name  LINKTYPE_DISPLAYPORT_AUX
   Number  275
   Description  DisplayPort AUX channel monitoring messages
   Reference  [LINKTYPE_DISPLAYPORT_AUX]

   Name  LINKTYPE_LINUX_SLL2
   Number  276
   Description  Linux cooked capture encapsulation v2
   Reference  [LINKTYPE_LINUX_SLL2]

   Name  LINKTYPE_SERCOS_MONITOR
   Number  277
   Description  Sercos Monitor

   Name  LINKTYPE_OPENVIZSLA
   Number  278
   Description  OpenVizsla FPGA-based USB sniffer
   Reference  [OpenVizsla]




Harris & Richardson        Expires 26 May 2026                 [Page 22]

Internet-Draft                pcaplinktype                 November 2025


   Name  LINKTYPE_EBHSCR
   Number  279
   Description  Elektrobit High Speed Capture and Replay (EBHSCR) format
   Reference  [EBHSCR]

   Name  LINKTYPE_VPP_DISPATCH
   Number  280
   Description  fd.io VPP graph dispatcher trace records
   Reference  [FD.io-VPP]

   Name  LINKTYPE_DSA_TAG_BRCM
   Number  281
   Description  Ethernet frames, with a Broadcom switch tag inserted
   Reference  [LINKTYPE_DSA_TAG_BRCM]

   Name  LINKTYPE_DSA_TAG_BRCM_PREPEND
   Number  282
   Description  Ethernet frames, with a Broadcom switch tag prepended
   Reference  [LINKTYPE_DSA_TAG_BRCM_PREPEND]

   Name  LINKTYPE_IEEE802_15_4_TAP
   Number  283
   Description  IEEE 802.15.4 with a tap header preceding it
   Reference  [Exegin-802.15.4-TAP]

   Name  LINKTYPE_DSA_TAG_DSA
   Number  284
   Description  Ethernet frames, with a Marvell DSA switch tag inserted
   Reference  [LINKTYPE_DSA_TAG_DSA]

   Name  LINKTYPE_DSA_TAG_EDSA
   Number  285
   Description  Ethernet frames, with a Marvell EDSA switch tag inserted
   Reference  [LINKTYPE_DSA_TAG_EDSA]

   Name  LINKTYPE_ELEE
   Number  286
   Description  ELEE lawful intercept protocol

   Name  LINKTYPE_Z_WAVE_SERIAL
   Number  287
   Description  Serial frames transmitted between a host and a Z-Wave
      chip over an RS-232 or USB serial connection
   Reference  [Z_WAVE_SERIAL] section 5

   Name  LINKTYPE_USB_2_0
   Number  288
   Description  USB 2.0, 1.1, or 1.0 packets



Harris & Richardson        Expires 26 May 2026                 [Page 23]

Internet-Draft                pcaplinktype                 November 2025


   Reference  [LINKTYPE_USB_2_0]

   Name  LINKTYPE_ATSC_ALP
   Number  289
   Description  ATSC Link-Layer Protocol frames
   Reference  [LINKTYPE_ATSC_ALP]

   Name  LINKTYPE_ETW
   Number  290
   Description  Event Tracing for Windows messages
   Reference  [LINKTYPE_ETW]

   Name  LINKTYPE_NETANALYZER_NG
   Number  291
   Description  Hilscher Gesellschaft fuer Systemautomation mbH
      netANALYZER NG hardware and software

   Name  LINKTYPE_ZBOSS_NCP
   Number  292
   Description  ZBOSS NCP Serial Protocol, with a pseudo-header
   Reference  [LINKTYPE_ZBOSS_NCP]

   Name  LINKTYPE_USB_2_0_LOW_SPEED
   Number  293
   Description  Low-Speed USB 2.0, 1.1, or 1.0 packets
   Reference  [LINKTYPE_USB_2_0_LOW_SPEED]

   Name  LINKTYPE_USB_2_0_FULL_SPEED
   Number  294
   Description  Full-Speed USB 2.0, 1.1, or 1.0 packets
   Reference  [LINKTYPE_USB_2_0_FULL_SPEED]

   Name  LINKTYPE_USB_2_0_HIGH_SPEED
   Number  295
   Description  High-Speed USB 2.0 packets
   Reference  [LINKTYPE_USB_2_0_HIGH_SPEED]

   Name  LINKTYPE_AUERSWALD_LOG
   Number  296
   Description  Auerswald Logger Protocol
   Reference  [Auerswald-Logger]

   Name  LINKTYPE_ZWAVE_TAP
   Number  297
   Description  Z-Wave packets, with a metadata header
   Reference  [LINKTYPE_ZWAVE_TAP]

   Name  LINKTYPE_SILABS_DEBUG_CHANNEL



Harris & Richardson        Expires 26 May 2026                 [Page 24]

Internet-Draft                pcaplinktype                 November 2025


   Number  298
   Description  Silicon Labs debug channel protocol
   Reference  [Silabs-Debug-Channel]

   Name  LINKTYPE_FIRA_UCI
   Number  299
   Description  Ultra-wideband (UWB) controller interface protocol (UCI)
   Reference  [LINKTYPE_FIRA_UCI]

   Name  LINKTYPE_MDB
   Number  300
   Description  MDB (Multi-Drop Bus) protocol
   Reference  [MDB-PCAP]

   Name  LINKTYPE_DECT_NR
   Number  301
   Description  DECT-2020 New Radio (NR) MAC layer
   Reference  [LINKTYPE_DECT_NR]

2.2.2.  Guidance for Designated Experts

   When processing a request for an allocation, the Designated Experts
   will encourage the requester to provide a specification at a stable
   URL.

   There is no requirement for a specification, but often review of the
   specification allows the Designated Expert to determine if the
   allocation actually is a duplicate of another specification.

   When the contents of the link type can contain an IPv4 or IPv6
   header, then the octets between the beginning of the link type and
   the IP header needs to be clearly specified.

   Specifications that are not publicly available, but which may be
   obtained via liaison agreements (such as to ITU-T, drafts, IEEE,
   etc.) are acceptable particularly if the specification document will
   be public eventually.  This includes specifications that might be
   subject to a security classification for which no public document
   will ever be made.  The minimal requirement is to provide a contact
   person for that link type.

   For other documents, the Designated Expert will need use their
   judgement, or consult the OPSAWG or an Area Director.








Harris & Richardson        Expires 26 May 2026                 [Page 25]

Internet-Draft                pcaplinktype                 November 2025


3.  Security Considerations

   This document describes the IANA registration rules for the LinkType
   encapsulations.  PCAP-related packet file formats use this value to
   determine what kind of headers precede network packet captures.  Many
   of these formats can contain IPv4 and IPv6 packets.  A system reading
   PCAP-related format captures can be subject to arbitrary inputs that
   may be controlled by malicious entities, so utmost caution is
   required.

   Many LinkType formats include a "snapshot" length, which may be
   smaller than the actual packet.  It is therefore very likely that
   trailing parts of a packet capture may be omitted, yet internal
   length fields in the packets will claim the packet is bigger than the
   capture.  This leads to trivial buffer overreads, and systems
   interpreting the packets need to carefully scrutinize all attempts to
   read data from a capture.

4.  Contributors

   PCAP has been developed over three and half decades by a variety of
   developers, including: Bill Fenner, Denis Ovsienko, Francois-Xavier
   Le Bail, Fulvio Risso, Gerald Combs, Gianluca Varenni, Gisle Vanem,
   Hannes Gredler, Joerg Mayer, Michal Sekletar, Stephen Donnelly,
   Torsten Landschoff, and Jun-ichiro itojun Hagino.

   PCAP was originally created at LBL by Steve McCanne, Craig Leres, and
   Van Jacobson.

5.  Acknowledgments

   The authors wish to thank: Michael Tuexen, Mohamed Boucadair, Carsten
   Bormann, Henk Birkholtz, and Robert Wilton their invaluable comments
   and encouragement.

6.  References

6.1.  Normative References

   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
              Writing an IANA Considerations Section in RFCs", BCP 26,
              RFC 8126, DOI 10.17487/RFC8126, June 2017,
              <https://www.rfc-editor.org/rfc/rfc8126>.

6.2.  Informative References

   [TCPDUMP]  "LINK-LAYER HEADER TYPES",
              <https://www.tcpdump.org/linktypes.html>.



Harris & Richardson        Expires 26 May 2026                 [Page 26]

Internet-Draft                pcaplinktype                 November 2025


   [LIBPCAP]  "libpcap", <https://github.com/the-tcpdump-group/libpcap>.

   [Wireshark]
              "Homepage of Wireshark", <https://www.wireshark.org>.

   [_3GPP-TS-04.64]
              "Digital cellular telecommunications system (Phase 2+);
              General Packet Radio Service (GPRS); Mobile Station -
              Serving GPRS Support Node (MS-SGSN) Logical Link Control
              (LLC) layer specification", 3GPP TS 04.64.

   [AIM-628]  Moon, D. A., "Chaosnet", MIT A.I. Memo No. 628, June 1981,
              <http://www.bitsavers.org/pdf/mit/ai/AIM-
              628_chaosnet.pdf>.

   [Auerswald-Logger]
              "Packet structure", n.d., <https://github.com/Auerswald-
              GmbH/auerlog/blob/master/auerlog.txt>.

   [AVS]      Peachy, S., "AVS Capture Frame Format Version 2",
              <http://web.archive.org/web/20040803232023/
              http://www.shaftnet.org/~pizza/software/capturefrm.txt>.

   [DOCSIS-4.0-MULP]
              "DOCSIS 4.0 MAC and Upper Layer Protocols Interface
              Specification", <https://www.cablelabs.com/specifications/
              CM-SP-MULPIv4.0>.

   [DOCSIS-XRA]
              "Excentis XRA Header Definition",
              <https://support.excentis.com/knowledge/article/45>.

   [DVB-CI-PCAP]
              Kaiser, M., "PCAP format for DVB-CI", January 2021,
              <https://www.kaiser.cx/posts/pcap-dvbci/>.

   [EBHSCR]   "Documentation EBHSCR",
              <http://www.elektrobit.com/ebhscr>.

   [Exegin-802.15.4-TAP]
              "IEEE 802.15.4 TAP Link Type Specification",
              <https://gitlab.com/exegin/ieee802-15-4-tap>.

   [FD.io-VPP]
              "VNET (VPP Network Stack)", <https://fdio-
              vpp.readthedocs.io/en/latest/gettingstarted/developers/
              vnet.html>.




Harris & Richardson        Expires 26 May 2026                 [Page 27]

Internet-Draft                pcaplinktype                 November 2025


   [G.7041]   "Generic Framing Procedure", ITU-T Recommendation G.7041/
              Y.1303, <https://www.itu.int/rec/T-REC-G.7041/en>.

   [ISO-14443-PCAP]
              Kaiser, M., "PCAP format for ISO14443", January 2021,
              <https://www.kaiser.cx/posts/pcap-iso14443/>.

   [LINKTYPE_APPLE_IP_OVER_IEEE1394]
              "LINKTYPE_APPLE_IP_OVER_IEEE1394",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_APPLE_IP_OVER_IEEE1394.html>.

   [LINKTYPE_ATM_RFC1483]
              "LINKTYPE_ATM_RFC1483",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ATM_RFC1483.html>.

   [LINKTYPE_ATSC_ALP]
              "LINKTYPE_ATSC_ALP", <https://www.tcpdump.org/linktypes/
              LINKTYPE_ATSC_ALP.html>.

   [LINKTYPE_AX25]
              "LINKTYPE_AX25",
              <https://www.tcpdump.org/linktypes/LINKTYPE_AX25.html>.

   [LINKTYPE_AX25_KISS]
              "LINKTYPE_AX25_KISS", <https://www.tcpdump.org/linktypes/
              LINKTYPE_AX25_KISS.html>.

   [LINKTYPE_BACNET_MS_TP]
              "LINKTYPE_BACNET_MS_TP",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BACNET_MS_TP.html>.

   [LINKTYPE_BLUETOOTH_BREDR_BB]
              "LINKTYPE_BLUETOOTH_BREDR_BB",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_BREDR_BB.html>.

   [LINKTYPE_BLUETOOTH_HCI_H4]
              "LINKTYPE_BLUETOOTH_HCI_H4",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_HCI_H4.html>.

   [LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR]
              "LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR.html>.



Harris & Richardson        Expires 26 May 2026                 [Page 28]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_BLUETOOTH_LE_LL]
              "LINKTYPE_BLUETOOTH_LE_LL",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_LE_LL.html>.

   [LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR]
              "LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR.html>.

   [LINKTYPE_BLUETOOTH_LINUX_MONITOR]
              "LINKTYPE_BLUETOOTH_LINUX_MONITOR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_BLUETOOTH_LINUX_MONITOR.html>.

   [LINKTYPE_C_HDLC]
              "LINKTYPE_C_HDLC",
              <https://www.tcpdump.org/linktypes/LINKTYPE_C_HDLC.html>.

   [LINKTYPE_C_HDLC_WITH_DIR]
              "LINKTYPE_C_HDLC_WITH_DIR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_C_HDLC_WITH_DIR.html>.

   [LINKTYPE_CAN_SOCKETCAN]
              "LINKTYPE_CAN_SOCKETCAN",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_CAN_SOCKETCAN.html>.

   [LINKTYPE_DBUS]
              "LINKTYPE_DBUS",
              <https://www.tcpdump.org/linktypes/LINKTYPE_DBUS.html>.

   [LINKTYPE_DECT_NR]
              "LINKTYPE_DECT_NR",
              <https://www.tcpdump.org/linktypes/LINKTYPE_DECT_NR.html>.

   [LINKTYPE_DISPLAYPORT_AUX]
              "LINKTYPE_DISPLAYPORT_AUX",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DISPLAYPORT_AUX.html>.

   [LINKTYPE_DSA_TAG_BRCM]
              "LINKTYPE_DSA_TAG_BRCM",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_BRCM.html>.





Harris & Richardson        Expires 26 May 2026                 [Page 29]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_DSA_TAG_BRCM_PREPEND]
              "LINKTYPE_DSA_TAG_BRCM_PREPEND",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_BRCM_PREPEND.html>.

   [LINKTYPE_DSA_TAG_DSA]
              "LINKTYPE_DSA_TAG_DSA",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_DSA.html>.

   [LINKTYPE_DSA_TAG_EDSA]
              "LINKTYPE_DSA_TAG_EDSA",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_DSA_TAG_EDSA.html>.

   [LINKTYPE_ETHERNET]
              "IEEE 802.3 Ethernet",
              <https://ieeexplore.ieee.org/document/9844436>.

   [LINKTYPE_EPON]
              "LINKTYPE_EPON",
              <https://www.tcpdump.org/linktypes/LINKTYPE_EPON.html>.

   [LINKTYPE_ERF]
              "LINKTYPE_ERF",
              <https://www.tcpdump.org/linktypes/LINKTYPE_ERF.html>.

   [LINKTYPE_ETW]
              "LINKTYPE_ETW",
              <https://www.tcpdump.org/linktypes/LINKTYPE_ETW.html>.

   [LINKTYPE_ETHERNET_MPACKET]
              "LINKTYPE_ETHERNET_MPACKET",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ETHERNET_MPACKET.html>.

   [LINKTYPE_FC_2]
              "LINKTYPE_FC_2",
              <https://www.tcpdump.org/linktypes/LINKTYPE_FC_2.html>.

   [LINKTYPE_FC_2_WITH_FRAME_DELIMS]
              "LINKTYPE_FC_2_WITH_FRAME_DELIMS",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_FC_2_WITH_FRAME_DELIMSa.html>.

   [LINKTYPE_FIRA_UCI]
              "LINKTYPE_FIRA_UCI", <https://www.tcpdump.org/linktypes/
              LINKTYPE_FIRA_UCI.html>.



Harris & Richardson        Expires 26 May 2026                 [Page 30]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_FLEXRAY]
              "LINKTYPE_FLEXRAY",
              <https://www.tcpdump.org/linktypes/LINKTYPE_FLEXRAY.html>.

   [LINKTYPE_FRELAY]
              "LINKTYPE_FRELAY",
              <https://www.tcpdump.org/linktypes/LINKTYPE_FRELAY.html>.

   [LINKTYPE_FRELAY_WITH_DIR]
              "LINKTYPE_FRELAY_WITH_DIR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_FRELAY_WITH_DIR.html>.

   [LINKTYPE_I2C_LINUX]
              "LINKTYPE_I2C_LINUX", <https://www.tcpdump.org/linktypes/
              LINKTYPE_I2C_LINUX.html>.

   [LINKTYPE_IEEE802_11_PRISM]
              "LINKTYPE_IEEE802_11_PRISM",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_IEEE802_11_PRISM.html>.

   [LINKTYPE_IEEE802_15_4_NOFCS]
              "LINKTYPE_IEEE802_15_4_NOFCS",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_IEEE802_15_4_NOFCS.html>.

   [LINKTYPE_IEEE802_15_4_NONASK_PHY]
              "LINKTYPE_IEEE802_15_4_NONASK_PHY",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_IEEE802_15_4_NONASK_PHY.html>.

   [LINKTYPE_IEEE802_15_4_WITHFCS]
              "LINKTYPE_IEEE802_15_4_WITHFCS",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_IEEE802_15_4_WITHFCS.html>.

   [LINKTYPE_IPV4]
              "LINKTYPE_IPV4",
              <https://www.tcpdump.org/linktypes/LINKTYPE_IPV4.html>.

   [LINKTYPE_IPV6]
              "LINKTYPE_IPV6",
              <https://www.tcpdump.org/linktypes/LINKTYPE_IPV6.html>.

   [LINKTYPE_IPOIB]
              "LINKTYPE_IPOIB",
              <https://www.tcpdump.org/linktypes/LINKTYPE_IPOIB.html>.



Harris & Richardson        Expires 26 May 2026                 [Page 31]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_IP_OVER_FC]
              "LINKTYPE_IP_OVER_FC", <https://www.tcpdump.org/linktypes/
              LINKTYPE_IP_OVER_FC.html>.

   [LINKTYPE_INFINIBAND]
              "LINKTYPE_INFINIBAND", <https://www.tcpdump.org/linktypes/
              LINKTYPE_INFINIBAND.html>.

   [LINKTYPE_IPMI_HPM_2]
              "LINKTYPE_IPMI_HPM_2", <https://www.tcpdump.org/linktypes/
              LINKTYPE_IPMI_HPM_2.html>.

   [LINKTYPE_IPNET]
              "LINKTYPE_IPNET",
              <https://www.tcpdump.org/linktypes/LINKTYPE_IPNET.html>.

   [LINKTYPE_LAPB_WITH_DIR]
              "LINKTYPE_LAPB_WITH_DIR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_LAPB_WITH_DIR.html>.

   [LINKTYPE_LAPD]
              "LINKTYPE_LAPD",
              <https://www.tcpdump.org/linktypes/LINKTYPE_LAPD.html>.

   [LINKTYPE_LIN]
              "LINKTYPE_LIN",
              <https://www.tcpdump.org/linktypes/LINKTYPE_LIN.html>.

   [LINKTYPE_LINUX_IRDA]
              "LINKTYPE_LINUX_IRDA", <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_IRDA.html>.

   [LINKTYPE_LINUX_LAPD]
              "LINKTYPE_LINUX_LAPD", <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_LAPD.html>.

   [LINKTYPE_LINUX_SLL]
              "LINKTYPE_LINUX_SLL", <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_SLL.html>.

   [LINKTYPE_LINUX_SLL2]
              "LINKTYPE_LINUX_SLL2", <https://www.tcpdump.org/linktypes/
              LINKTYPE_LINUX_SLL2.html>.

   [LINKTYPE_LOOP]
              "LINKTYPE_LOOP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_LOOP.html>.



Harris & Richardson        Expires 26 May 2026                 [Page 32]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_LORATAP]
              "LINKTYPE_LORATAP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_LORATAP.html>.

   [LINKTYPE_LTALK]
              "LINKTYPE_LTALK",
              <https://www.tcpdump.org/linktypes/LINKTYPE_LTALK.html>.

   [LINKTYPE_MFR]
              "LINKTYPE_MFR",
              <https://www.tcpdump.org/linktypes/LINKTYPE_MFR.html>.

   [LINKTYPE_MPEG_2_TS]
              "LINKTYPE_MPEG_2_TS", <https://www.tcpdump.org/linktypes/
              LINKTYPE_MPEG_2_TS.html>.

   [LINKTYPE_MTP2]
              "LINKTYPE_MTP2",
              <https://www.tcpdump.org/linktypes/LINKTYPE_MTP2.html>.

   [LINKTYPE_MTP2_WITH_PHDR]
              "LINKTYPE_MTP2_WITH_PHDR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_MTP2_WITH_PHDR.html>.

   [LINKTYPE_MTP3]
              "LINKTYPE_MTP3",
              <https://www.tcpdump.org/linktypes/LINKTYPE_MTP3.html>.

   [LINKTYPE_SCCP]
              "LINKTYPE_SCCP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_SCCP.html>.

   [LINKTYPE_MUX27010]
              "LINKTYPE_MUX27010", <https://www.tcpdump.org/linktypes/
              LINKTYPE_MUX27010.html>.

   [LINKTYPE_NETANALYZER]
              "LINKTYPE_NETANALYZER",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NETANALYZER.html>.

   [LINKTYPE_NETANALYZER_TRANSPARENT]
              "LINKTYPE_NETANALYZER_TRANSPARENT",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_NETANALYZER_TRANSPARENT.html>.





Harris & Richardson        Expires 26 May 2026                 [Page 33]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_NETLINK]
              "LINKTYPE_NETLINK",
              <https://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html>.

   [LINKTYPE_NFC_LLCP]
              "LINKTYPE_NFC_LLCP", <https://www.tcpdump.org/linktypes/
              LINKTYPE_NFC_LLCP.html>.

   [LINKTYPE_NFLOG]
              "LINKTYPE_NFLOG",
              <https://www.tcpdump.org/linktypes/LINKTYPE_NFLOG.html>.

   [LINKTYPE_NG40]
              "LINKTYPE_NG40",
              <https://www.tcpdump.org/linktypes/LINKTYPE_NG40.html>.

   [LINKTYPE_NORDIC_BLE]
              "LINKTYPE_NORDIC_BLE", <https://www.tcpdump.org/linktypes/
              LINKTYPE_NORDIC_BLE.html>.

   [LINKTYPE_NULL]
              "LINKTYPE_NULL",
              <https://www.tcpdump.org/linktypes/LINKTYPE_NULL.html>.

   [LINKTYPE_PKTAP]
              "LINKTYPE_PKTAP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_PKTAP.html>.

   [LINKTYPE_PPI]
              "LINKTYPE_PPI",
              <https://www.tcpdump.org/linktypes/LINKTYPE_PPI.html>.

   [LINKTYPE_PPP]
              "LINKTYPE_PPP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_PPP.html>.

   [LINKTYPE_PPP_ETHER]
              "LINKTYPE_PPP_ETHER", <https://www.tcpdump.org/linktypes/
              LINKTYPE_PPP_ETHER.html>.

   [LINKTYPE_PPP_HDLC]
              "LINKTYPE_PPP_HDLC", <https://www.tcpdump.org/linktypes/
              LINKTYPE_PPP_HDLC.html>.

   [LINKTYPE_PPP_PPPD]
              "LINKTYPE_PPP_PPPD", <https://www.tcpdump.org/linktypes/
              LINKTYPE_PPP_PPPD.html>.




Harris & Richardson        Expires 26 May 2026                 [Page 34]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_PPP_WITH_DIR]
              "LINKTYPE_PPP_WITH_DIR",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_PPP_WITH_DIR.html>.

   [LINKTYPE_PROFIBUS_DL]
              "LINKTYPE_PROFIBUS_DL",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_PROFIBUS_DL.html>.

   [LINKTYPE_RAW]
              "LINKTYPE_RAW",
              <https://www.tcpdump.org/linktypes/LINKTYPE_RAW.html>.

   [LINKTYPE_RDS]
              "LINKTYPE_RDS",
              <https://www.tcpdump.org/linktypes/LINKTYPE_RDS.html>.

   [LINKTYPE_RTAC_SERIAL]
              "LINKTYPE_RTAC_SERIAL",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_RTAC_SERIAL.html>.

   [LINKTYPE_SDLC]
              "LINKTYPE_SDLC",
              <https://www.tcpdump.org/linktypes/LINKTYPE_SDLC.html>.

   [LINKTYPE_SITA]
              "LINKTYPE_SITA",
              <https://www.tcpdump.org/linktypes/LINKTYPE_SITA.html>.

   [LINKTYPE_SLIP]
              "LINKTYPE_SLIP",
              <https://www.tcpdump.org/linktypes/LINKTYPE_SLIP.html>.

   [LINKTYPE_STANAG_5066_D_PDU]
              "LINKTYPE_STANAG_5066_D_PDU",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_STANAG_5066_D_PDU.html>.

   [LINKTYPE_SUNATM]
              "LINKTYPE_SUNATM",
              <https://www.tcpdump.org/linktypes/LINKTYPE_SUNATM.html>.

   [LINKTYPE_USB_2_0]
              "LINKTYPE_USB_2_0",
              <https://www.tcpdump.org/linktypes/LINKTYPE_USB_2_0.html>.




Harris & Richardson        Expires 26 May 2026                 [Page 35]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_USB_2_0_FULL_SPEED]
              "LINKTYPE_USB_2_0_FULL_SPEED",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_2_0_FULL_SPEED.html>.

   [LINKTYPE_USB_2_0_HIGH_SPEED]
              "LINKTYPE_USB_2_0_HIGH_SPEED",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_2_0_HIGH_SPEED.html>.

   [LINKTYPE_USB_2_0_LOW_SPEED]
              "LINKTYPE_USB_2_0_LOW_SPEED",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_2_0_LOW_SPEED.html>.

   [LINKTYPE_USB_DARWIN]
              "LINKTYPE_USB_DARWIN", <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_DARWIN.html>.

   [LINKTYPE_USB_LINUX]
              "LINKTYPE_USB_LINUX", <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_LINUX.html>.

   [LINKTYPE_USB_LINUX_MMAPPED]
              "LINKTYPE_USB_LINUX_MMAPPED",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_USB_LINUX_MMAPPED.html>.

   [LINKTYPE_VSOCK]
              "LINKTYPE_VSOCK",
              <https://www.tcpdump.org/linktypes/LINKTYPE_VSOCK.html>.

   [LINKTYPE_WATTSTOPPER_DLM]
              "LINKTYPE_WATTSTOPPER_DLM",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_WATTSTOPPER_DLM.html>.

   [LINKTYPE_ZBOSS_NCP]
              "LINKTYPE_ZBOSS_NCP", <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZBOSS_NCP.html>.

   [LINKTYPE_ZWAVE_R1_R2]
              "LINKTYPE_ZWAVE_R1_R2",
              <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZWAVE_R1_R2.html>.






Harris & Richardson        Expires 26 May 2026                 [Page 36]

Internet-Draft                pcaplinktype                 November 2025


   [LINKTYPE_ZWAVE_R3]
              "LINKTYPE_ZWAVE_R3", <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZWAVE_R3.html>.

   [LINKTYPE_ZWAVE_TAP]
              "LINKTYPE_ZWAVE_TAP", <https://www.tcpdump.org/linktypes/
              LINKTYPE_ZWAVE_TAP.html>.

   [MDB-PCAP] Kaiser, M., "PCAP format for MDB", August 2023,
              <https://www.kaiser.cx/posts/pcap-mdb/>.

   [OpenVizsla]
              "OpenVizsla protocol description", August 2018,
              <https://github.com/matwey/libopenvizsla/wiki/OpenVizsla-
              protocol-description>.

   [PracConsEthDesign]
              Crane, R. C. and E. A. Taft, "Practical Considerations in
              Ethernet Local Network Design", February 1980,
              <http://bitsavers.org/pdf/xerox/ethernet_3mb/Practical_Con
              siderations_in_Ethernet_Local_Network_Design_Feb1980.pdf>.

   [Radiotap] radiotap.org, "Radiotap Web site",
              <https://www.radiotap.org>.

   [Silabs-Debug-Channel]
              "Silabs Debug Channel Format", n.d., <https://github.com/S
              iliconLabs/java_packet_trace_library/blob/master/doc/
              debug-channel.md>.

   [USBPcap]  "USBPcap Capture format specification",
              <https://desowin.org/usbpcap/captureformat.html>.

   [Z_WAVE_SERIAL]
              "Z-Wave Serial API Host Application Programming Guide",
              <https://www.silabs.com/documents/public/user-guides/
              INS12350-Serial-API-Host-Appl.-Prg.-Guide.pdf>.

   [I-D.ietf-opsawg-pcap]
              Harris, G. and M. Richardson, "PCAP Capture File Format",
              Work in Progress, Internet-Draft, draft-ietf-opsawg-pcap-
              06, 3 September 2025,
              <https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-
              pcap-06>.

   [I-D.ietf-opsawg-pcapng]
              Tüxen, M., Risso, F., Bongertz, J., Combs, G., Harris, G.,
              Chaudron, E., and M. Richardson, "PCAP Now Generic



Harris & Richardson        Expires 26 May 2026                 [Page 37]

Internet-Draft                pcaplinktype                 November 2025


              (pcapng) Capture File Format", Work in Progress, Internet-
              Draft, draft-ietf-opsawg-pcapng-04, 30 August 2025,
              <https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-
              pcapng-04>.

   [RFC791]   Postel, J., "Internet Protocol", STD 5, RFC 791,
              DOI 10.17487/RFC0791, September 1981,
              <https://www.rfc-editor.org/rfc/rfc791>.

   [RFC8200]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", STD 86, RFC 8200,
              DOI 10.17487/RFC8200, July 2017,
              <https://www.rfc-editor.org/rfc/rfc8200>.

   [RFC9260]  Stewart, R., Tüxen, M., and K. Nielsen, "Stream Control
              Transmission Protocol", RFC 9260, DOI 10.17487/RFC9260,
              June 2022, <https://www.rfc-editor.org/rfc/rfc9260>.

Authors' Addresses

   Guy Harris (editor)
   Email: gharris@sonic.net


   Michael C. Richardson
   Sandelman Software Works Inc
   Email: mcr+ietf@sandelman.ca
   URI:   http://www.sandelman.ca/























Harris & Richardson        Expires 26 May 2026                 [Page 38]
