Snort: Cannot decode data link type 127 reading a pcapng file

Question

I've captured on my wifi some days ago and now I want snort to analyse the capture to detect any problem. However, when I run snort -l ./snort-log -b -c /etc/snort/snort.conf -r captura-analisar.pcapng it stops with

ERROR: Cannot decode data link type 127

Fatal Error, Quitting..

I guess this is happening because there is some encrypted 802.11 data in the file. Not all packets are encrypted though. If it is the case, how to set snort to ignore the encrypted data and analyse only the decrypted? Or if it isn't the case, what is the problem?

Answer 1

from what you described, I understood:

• You already have PCAP files to analyse with Snort (so you are not running in live mode but reading back previously created captures). Therefore the switch -i does not apply in this case.
• Snort aborts with the message: ERROR: Cannot decode data link type 127
• When you mention "detect any problem", I assume you are specifically looking for malware communication (and not investigation network issues, eg. layer-2 issues with your Wifi!).

First, you need to remove radiotap link encapsulation by rewriting the layer-2 link type into something Snort can easily cope with, eg. link-type ether

For that you can use editcap tool from Wireshark project.

editcap captura-analisar.pcapng -T ether captura-1.pcap, where:

• -T ether: sets the encapsulation type of the output file to ether.

By the way, if your version of Snort does not read PCAPNG files, you can also convert it with editcap adding parameter -F pcap

editcap captura-analisar.pcapng -F pcap -T ether captura-1.pcap

From now on you can run snort over your PCAPs files with a command such as:

snort -A console -k none -K none -c snort.conf -r captura-1.pcap

where:

• -A: issues alerts to the console
• -K: logging-mode, none will not create PCAPs from the alerts, while pcap will do so. Use accordingly.
• -k: checksum mode, ignore checksum validation.
• -c: your snort config file containing variables, pre-process options, rules.
• -r: read PCAP. be aware of other options to read bunch of pcap files, such as --pcap-dir=/home/foo/pcaps or --pcap-list="foo1.pcap foo2.pcap foo3.pcap"

Does it make sense?

Kind regards J.C.

• editcap is part of Wireshark, see: https://www.wireshark.org/docs/wsug_html_chunked/AppToolseditcap.html

PS: you can inspect the properties of PCAP files with capinfos -M captura.pcap. This shows information on encapsulation, amount of packets captured, start/end date of capture, duration, etc.