{"record":{"id":"a8dfe168fd5d229b","repo":"stamparm/maltrail","slug":"received-unexpected-datalink-datalink-attempting-ip-offset","errorCode":null,"errorMessage":"Received unexpected datalink ({datalink}); attempting IP-offset heuristic","messagePattern":"Received unexpected datalink \\((.+?)\\); attempting IP-offset heuristic","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"sensor/src/packet/dlt.rs","lineNumber":165,"sourceCode":"        }\n        let off = guess_ip_offset(packet, 64)?;\n        if self.provisional.get(&datalink) == Some(&off) {\n            self.locked.insert(datalink, Some(off));\n            crate::cprintln!(\n                \"[i] datalink {datalink} missing from offset table; inferred IP offset {off} by heuristic\"\n            );\n            return Some(off);\n        }\n        self.provisional.insert(datalink, off);\n        Some(off)\n    }\n\n    /// Full `packet_handler` offset resolution, including the unknown-datalink path.\n    pub fn resolve(&mut self, datalink: i32, packet: &[u8]) -> Option<usize> {\n        match settings::dlt_offset(datalink) {\n            Some(base) => ip_offset(datalink, packet, base),\n            None => {\n                crate::output::log_error(\n                    &format!(\"Received unexpected datalink ({datalink}); attempting IP-offset heuristic\"),\n                    true,\n                );\n                self.guess(datalink, packet)\n            }\n        }\n    }\n}\n\n#[cfg(test)]\npub(crate) mod tests {\n    use super::*;\n\n    fn eth(ethertype: u16) -> Vec<u8> {\n        let mut v = vec![0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66];\n        v.extend_from_slice(&ethertype.to_be_bytes());\n        v\n    }","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/packet/dlt.rs#L147-L183","documentation":"The packet capture datalink type reported by the capture device is not one of the known DLT offsets, so the sensor cannot use the standard IP offset resolution. It logs this warning and falls back to an IP-offset heuristic (guess) that inspects the packet bytes to find the IP header start.","triggerScenarios":"resolve(datalink, packet) is called with a datalink value for which settings::dlt_offset(datalink) returns None — e.g. an unusual libpcap DLT from an exotic interface, tunnel, or VM virtual NIC.","commonSituations":"Capturing on unusual interfaces (VPN tunnels, raw/unknown DLTs, unusual virtualization NICs); capture library reporting a DLT this sensor build doesn't map; cross-platform capture files with uncommon link types.","solutions":["Identify the interface's datalink type (tcpdump -i <iface> --print / -L) and confirm whether the sensor build should support it.","If safe, capture on a standard Ethernet (DLT_EN10MB) or Linux SLL interface so the known offset path is used.","Verify the heuristic is working: check packets_ignored vs parsed packet metrics; if heuristics misfire, packets may be misparsed.","Upgrade the sensor to a build that maps the DLT in settings::dlt_offset if support for the link type exists upstream."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"# identify the datalink of the capture interface beforehand\ntcpdump -L -i <iface>   # lists supported datalink types\n# prefer standard Ethernet (EN10MB) or Linux SLL interfaces","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Capture on interfaces with known DLTs (Ethernet, Linux SLL)","After seeing this warning, verify parse quality via packet metrics (ignored vs parsed)","Keep the sensor updated so new DLTs are mapped in settings::dlt_offset","If heuristics are in play, spot-check parsed output against tcpdump"],"tags":["packet-capture","datalink","fallback","pcap"],"backgroundTag":"unsupported-enum-value","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}