# Does Bro support pcap file with id 9?

**URL:** <https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152>\
**Category:** Zeek\
**Created:** [December 11, 2011, 9:27am UTC](https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152 "2011-12-11T09:27:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Readon\_Shaw](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Readon\_Shaw](https://community.zeek.org/u/Readon_Shaw)\
**Post date:** [December 11, 2011, 9:27am UTC](https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152/1 "2011-12-11T09:27:28Z")

</div>

When i was processing traces downloaded from WAND, it was reported that “Unknown data link type 0x9”.  
I am using Bro 2.0 Beta.  
If not, is there any solution?

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 12, 2011, 12:59am UTC](https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152/2 "2011-12-12T00:59:46Z")

</div>

Unfortunately we don't support PPP packets (link type 9) yet. If you point us to the traces you're are using though, we can make sure that we support PPP when we get around to reworking our packet input process.

.Seth

---

<div class="post-metadata">

**Author:** ![Readon\_Shaw](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Readon\_Shaw](https://community.zeek.org/u/Readon_Shaw)\
**Post date:** [December 12, 2011, 2:07am UTC](https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152/3 "2011-12-12T02:07:16Z")

</div>

I have attached a pcap file in previous mail.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/does-bro-support-pcap-file-with-id-9/2152/4 "2022-05-06T15:40:03Z")

</div>

Closed on May 6, 2022, 3:40pm UTC


