On Thu, Apr 18, 2002 at 10:25:44AM -0400, MICHAEL M DELANEY wrote:
> What format does etheral expect a caputre file to be in?
Its standard format is libpcap format, that being the format I mentioned
the last time you asked about CANbus support.
If, howeve, you're going to write small packets out - an Internet draft
for IP over CANbus:
http://www.rfc-editor.org/internet-drafts/draft-cafi-can-ip-00.txt
says only 8 bytes of data can fit into a CANbus frame - you may be
better off inventing your own file format. libpcap format is generally
used for network traffic captures of the sort where a single IP datagram
that's not fragmented at the IP layer is a *single* packet; for example,
ATM captures typically have a single AAL5 frame as a packet, not a
single ATM cell. If an OS were to support IP over CANbus, the packet
capture mechanism in that OS would *probably* supply reassembled
IP-over-CANbus packets, not individual CANbus packets. (It'd probably
supply them with solely an IP header, i.e. DLT_RAW format.)
So if you're thinking of *raw* CANbus, you might want to go for your own
format, much as the CoralReef people devised their own format for
captures showing raw ATM cells.
> We're thinking
> about using etheral for CAN (its a char device, its kinda like multicast
> serial), but when I tried to load a caputre file we made, the data parser
> didn't seem to be able to read most of the file.
In what format did you write that capture file? If you tried to load it
in Ethereal, the only capture file formats it can handle are the ones it
already supports - if you devised a new capture file format, it wouldn't
be able to read it.
> The program we're using
> to dump the bus to a file makes 26 byte "packets". Is it possible to get
> etheral to understand this,
It could, although in order to handle, say, IP over CANbus, as per the
draft, in that format, you'd have to add fragment reassembly support.