When capturing on a WWAN link there is no Ethernet header and Wireshark cannot decode the saved pcap correctly. The reason is that in the capture file LinkType is ETHERNET (or DLT_EN10MB) but the packets don't have ethernet headers, they are starting from the IP header. From the saved file it cannot be determied subsequently how to interpret the packets if the LinkType is wrong. I need to analyze pcap files programatically that's why the correct LinkType is essential.

I cannot override the LinkType by calling pcap_set_datalink (to DLT_RAW), it returns an error since pcap_list_datalinks returns only ETHERNET (1). This is a Sierra modem where the PDN is activated by an AT command (SCACT=1) then the device driver associates an IP address to the network interface. The Interface Type is 243 (IF_TYPE_WWANPP).

Why other link types don't supported/listed only the ETHERNET even though it's not even an Ethernet interface?

Alternatively, is there a way to override the LinkType in the pcap_file_header programmatically before saving the file or I have to write a custom save function and manually generate a pcap header? I don't like to postprocess files with editcap.

Another weird phenomena that pcap_datalink_val_to_name or pcap_datalink_val_to_desc cannot translate DLT_RAW but return nil.

Thanks!