All Apps and Add-ons

Splunk App for Stream: Why am I getting "stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12"

New Member

When I am trying to capture a openvpn device which name is tun0, I got some error as bellow.
Logs:
2019-01-09 21:43:03 ERROR 139638504761088 stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12
2019-01-09 21:43:03 FATAL 139638504761088 stream.CaptureServer - SnifferReactor was unable to start packet capturesniffer
2019-01-09 21:44:44 WARN 139638487975680 stream.CaptureServer - No streams are configured

local/streamfwd.conf

[streamfwd]
streamfwdcapture.0.interface = tun0
streamfwdcapture.0.offline = false

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!