diff --git a/src/decode.h b/src/decode.h index ca44cacbf7..0a4e5cb7ca 100644 --- a/src/decode.h +++ b/src/decode.h @@ -1069,6 +1069,9 @@ int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder); #define LINKTYPE_LINUX_SLL 113 #define LINKTYPE_PPP 9 #define LINKTYPE_RAW DLT_RAW +/* http://www.tcpdump.org/linktypes.html defines DLT_RAW as 101, yet others don't. + * Libpcap on at least OpenBSD returns 101 as datalink type for RAW pcaps though. */ +#define LINKTYPE_RAW2 101 #define PPP_OVER_GRE 11 #define VLAN_OVER_GRE 13 diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c index db1ec63fec..fb29773d1e 100644 --- a/src/source-pcap-file.c +++ b/src/source-pcap-file.c @@ -327,6 +327,7 @@ TmEcode ReceivePcapFileThreadInit(ThreadVars *tv, const void *initdata, void **d pcap_g.Decoder = DecodePPP; break; case LINKTYPE_RAW: + case LINKTYPE_RAW2: pcap_g.Decoder = DecodeRaw; break; case LINKTYPE_NULL: