Wireshark-bugs: [Wireshark-bugs] [Bug 12687] SocketCAN dissector does not support CAN FD

Date: Sat, 30 Jul 2016 19:27:38 +0000

Comment # 6 on bug 12687 from
(In reply to Michael Mann from comment #5)
> (In reply to Oliver Hartkopp from comment #3)
> > I'm not really sure if it helps
> > as I only can see ETH_P_CAN frames in Wireshark. I've seen the CAN FD frames
> > with 'candump vcan0' from can-utils on a separate console though.
> 
> I think you have some "file formatting" issues.
> 
> SocketCAN has a reserved link type value (227) in the pcap format.  That
> link type is what ends up calling the socketcan dissector.
> 
> The socketcan dissector can also be called through the Linux cooked-mode
> capture which also has a reserved link type value (113) in pcap format. 
> It's in the Linux cooked-mode capture (dissector) that the SLL value of 0xC
> is used to call the SocketCAN dissector.
> 
> The patches you reference add a SLL value of 0xD for CANFD, but the capture
> you provided is in the format of socketCAN, not Linux cooked-mode.

The capture was generated with Wireshark after selecting vcan0.

How can I provide a capture file that fits your needs?
Is there some magic config button I would have to press?

> The patch I created (https://code.wireshark.org/review/16787) is just a
> quick hack adding 0xD for CANFD.  Right now the canfd dissection is exactly
> the same as CAN.

I cloned the current wireshark git tree and applied your patch to it.
But I still don't see any CAN FD traffic when generating that type of traffic
on vcan0.

> If you want to add a reserved link type value for CANFD, you can send an
> email to [email protected] asking for a new LINKTYPE_/DLT_
> value, and specifying the purpose of the new value.  And if you're
> successful, we can add one line in socketcan.c to call the CANFD dissector
> directly.

Don't know whether a new type value for CANFD is needed inside Wirehark.
But when capturing traffic with Wireshark CAN and CAN FD frames have to be
distinguished.

Can you provide a patch here for testing that would make it work for CAN FD
completely?


You are receiving this mail because:
  • You are watching all bug changes.