# Wireless LAN: Unsupported link type

**URL:** <https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [June 7, 2017, 11:55am UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571 "2017-06-07T11:55:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 7, 2017, 11:55am UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571/1 "2017-06-07T11:55:57Z")

</div>

Hi!  
I'm trying to index a pcap-file with wireless traffic using Packetbeat 5.4.1:

```
packetbeat -e -v -waitstop 10 -t -d publish -I c:\temp\wlan-132_07.06.17_1232.eth

```

but getting the following error:

```
2017/06/07 11:52:00.957186 beat.go:339: CRIT Exiting: Initializing sniffer failed: Error creating decoder: Unsupported link type: UnknownLinkType(105)
Exiting: Initializing sniffer failed: Error creating decoder: Unsupported link type: UnknownLinkType(105)

```

Does the program support wireless data?  
Thank you!

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 8, 2017, 10:26am UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571/2 "2017-06-08T10:26:21Z")

</div>

> Please post all questions and issues on [Beats - Discuss the Elastic Stack](https://discuss.elastic.co/c/beats)  
> before opening a Github Issue. Your questions will reach a wider audience there,  
> and if we confirm that there is a bug, then you can open a new issue.

Could you guys please confirm, that this is a bug? I'm going to open a github issue then.  
Thanks!

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [June 8, 2017, 10:45am UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571/3 "2017-06-08T10:45:22Z")

</div>

Hm... UnknownLinkType kind of indicates the network type is not even known to the sniffer libs used by packetbeat. But 105 clearly stands for LINKTYPE\_IEEE802\_11...

Packetbeat needs to be able to decode the different network layers. Does the pcap contain actual unencrypted traffic from your wireless, or is it just WiFi management message? Have you tried to open the PCAP in wireshark and check wireshark can analyze the application payload like HTTP and such?

In general, packetbeat does not support wireless lan, as this will require some more advanced parsing/handling of the packets.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 8, 2017, 12:54pm UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571/4 "2017-06-08T12:54:05Z")

</div>

the file can be opened with Wireshark just fine. It's unencrypted traffic captured on the access point.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:54pm UTC](https://discuss.elastic.co/t/wireless-lan-unsupported-link-type/88571/5 "2017-07-06T12:54:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.