The global header is 24 bytes. Bytes 20–21 (0x14–0x15) store the network type in little-endian. For network type 276:
Every .pcap or .pcapng file contains a global header defining its link-layer encapsulation type. Traditional Ethernet uses LINKTYPE_ETHERNET (Value 1).
An updated "cooked" capture format that includes the interface name within the packet header, which the original SLL (Type 113) format did not support.
Example Python snippet (using scapy ):
Network type corresponds to LINKTYPE_LINUX_SLL2 , the updated Linux "cooked" capture encapsulation (v2).
hexdump -C suspicious.pcap | head -50
Unlike the older LINKTYPE_LINUX_SLL (Type 113), the format includes additional metadata that helps in multi-interface captures: -pcap network type 276 unknown or unsupported-
-pcap network type 276 unknown or unsupported-
Link-Type 276 was assigned and integrated into packet capture standards relatively recently compared to legacy types like Ethernet ( LINKTYPE_ETHERNET / 1). If you are running an older, legacy version of Wireshark, an outdated Linux distribution with an old version of tcpdump , or a proprietary security appliance with frozen dependencies, the system will look at the value 276 and fail because it is missing from its hardcoded lookup tables. 2. Lack of Dissector/Parser Support
This DLT is used for captures coming from Nordic Semiconductor's BLE sniffer hardware or firmware (e.g., the nRF Sniffer for 802.15.4 or BLE). It is a vendor-specific link-layer header type that describes BLE advertisements, connections, and raw radio information. The global header is 24 bytes
You are likely seeing this error for one of three reasons:
Every PCAP and PCAPNG file contains a global header that specifies the Link-Layer Header Type (also known as linktype or network ). This value tells the packet analyzer how to interpret the very first bytes of each captured packet—whether it is standard Ethernet, Wi-Fi, Loopback, or something more specialized. According to the official registry: Link-Type Value: 276 Corresponding Name: LINKTYPE_NFC_LLCP
This specific numeric code corresponds to , which is the modernized Linux cooked-mode capture format used by tools like tcpdump and ksniff when intercepting multi-interface or containerized traffic. When older analysis engines encounter this ID, parsing fails immediately. Understanding the Core Concepts What is LinkType 276? Traditional Ethernet uses LINKTYPE_ETHERNET (Value 1)
If you’ve spent any time wrangling packet captures on the command line—using tools like tcpdump , tshark , or editcap —you may have been stopped cold by a cryptic error message:
Wireshark's editcap tool can change the DLT of a pcap file without altering the packet data. Only do this if you are certain of the true link-layer type.