All Apps and Add-ons

Splunk App for Stream: Why am I getting "stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12"

New Member

When I am trying to capture a openvpn device which name is tun0, I got some error as bellow.
Logs:
2019-01-09 21:43:03 ERROR 139638504761088 stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12
2019-01-09 21:43:03 FATAL 139638504761088 stream.CaptureServer - SnifferReactor was unable to start packet capturesniffer
2019-01-09 21:44:44 WARN 139638487975680 stream.CaptureServer - No streams are configured

local/streamfwd.conf

[streamfwd]
streamfwdcapture.0.interface = tun0
streamfwdcapture.0.offline = false

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

View solution in original post

0 Karma