All Apps and Add-ons

Splunk App for Stream: Why am I getting "stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12"

splunkuser20190
New Member

When I am trying to capture a openvpn device which name is tun0, I got some error as bellow.
Logs:
2019-01-09 21:43:03 ERROR 139638504761088 stream.NetworkCapture - SnifferReactor unrecognized link layer for device : 12
2019-01-09 21:43:03 FATAL 139638504761088 stream.CaptureServer - SnifferReactor was unable to start packet capturesniffer
2019-01-09 21:44:44 WARN 139638487975680 stream.CaptureServer - No streams are configured

local/streamfwd.conf

[streamfwd]
streamfwdcapture.0.interface = tun0
streamfwdcapture.0.offline = false

Tags (1)
0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

View solution in original post

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

Stream doesn't support openvpn's link layer type, so it'd be an enhancement request.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...