276 Unknown Or Unsupported-: -pcap Network Type

from scapy.all import rdpcap, wrpcap, Raw
pkts = rdpcap("in.pcap")
out = []
for p in pkts:
    b = bytes(p)[4:]
    out.append(Raw(b))
wrpcap("out.pcap", out)

You used a nRF52 DK or nRF Sniffer to capture BLE packets. The output file is a .pcap with DLT 276. You try opening it in:

If you encounter DLT 276 during an investigation: -pcap network type 276 unknown or unsupported-

Here is how to solve the problem, from simplest to most advanced.

Some proprietary analysis tools (e.g., from Cisco, Arista, or certain SD-WAN probes) assign custom DLT values (often in the range 200–300) for internal telemetry. DLT 276 might be repurposed in your specific environment—though officially it's Nordic BLE, not all vendors follow the registry.

For Wireshark:
Install Wireshark 3.4+ or 4.0+ (supports DLT 276 out of the box). Using Scapy to rewrite (example, assumes 4-byte vendor

For Scapy (Python):
Update Scapy and ensure it links to a modern libpcap:

pip install --upgrade scapy
# If that doesn't work, reinstall libpcap:
sudo apt install libpcap-dev  # then reinstall scapy

Then, in Scapy, force the DLT:

from scapy.all import *
pkts = rdpcap("capture.pcap", linktype=276)  # Scapy 2.5+

A security team was auditing a fleet of medical IoT devices (insulin pumps) that communicated via 802.15.4 (ZigBee). They captured traffic using a dedicated USB dongle which wrote pcap files with DLT 276 (mapped to DLT_IEEE802_15_4_TAP). When they transferred the file to their central Linux analysis server (running RHEL 7 with an older libpcap), they received the error: Then open out

-pcap network type 276 unknown or unsupported-

Resolution: They did not need to change the file. Instead, they installed a custom Wireshark build with ZigBee plugins and used tshark on a Windows workstation running Npcap (which supports DLT 276 out-of-the-box). They also back-converted a subset of the capture using editcap -T 195 (since 195 is the official DLT for raw ZigBee without tap headers).

The number 276 is not a random error code; it is a DLT value assigned by libpcap . According to the official libpcap DLT registry (maintained by the Tcpdump Group):

This DLT is used for captures coming from Nordic Semiconductor's BLE sniffer hardware or firmware (e.g., the nRF Sniffer for 802.15.4 or BLE). It is a vendor-specific link-layer header type that describes BLE advertisements, connections, and raw radio information.

However, the error appears when you try to read such a file with a tool that has not been compiled with support for DLT 276. Wireshark versions before 3.x or older builds of Scapy, TShark, or libpcap may lack the dissector or the DLT mapping.