Wireshark-bugs: [Wireshark-bugs] [Bug 12687] SocketCAN dissector does not support CAN FD

Date: Sun, 31 Jul 2016 17:09:06 +0000

Comment # 8 on bug 12687 from
(In reply to Michael Mann from comment #7)

> You're mixing two completely different pieces of functionality.  Wireshark
> is a network analysis tool that happens to have hooks for doing capturing as
> well.  Wireshark can only analyze what's been captured for it. After
> capturing, it then gets passed to the analysis/dissector portion.

ok.

> 
> vcan0 is the "capture driver"

Just to make it clear: vcan0 is a "network device" with dev->type = ARPHRD_CAN
inside Linux.

A CAN netdevice (either 'real' CAN or 'virtual' CAN) can have a maximum
transfer unit (MTU) of 16 or 72 which reflects the sizeof(struct can_frame) or
the sizeof(struct canfd_frame).

When having a CAN FD capable interface (dev->mtu == 72) you might receive
either CAN or CAN FD frames on this interface. 

> and it's providing the capture data in the
> socketCAN format as specified by LINKTYPE_ definition of:
> u32 CAN_ID
> u8 length
> u8 pad1
> u8 pad2
> u8 pad3
> u8 data[8];
> 
> If vcan0 writes a "CANFD" frame, I think it looks like this:
> u32 CAN_ID
> u8 length
> u8 fd_flags
> u8 pad2
> u8 pad3
> u8 data[64];

IMO you can just assume to have a CAN FD interface and work with struct
canfd_frame (see PDF slides).

When your registered for ETH_P_CAN and ETH_P_CANFD with the LINUX_SSL_P_CAN[FD]
you will get both type of CAN frames.

And now comes the big trick (tada!):

When you get a socketbuffer with skb->len == sizeof(struct can_frame) you have
a 'classic' CAN frame, when skb->len == sizeof(struct canfd_frame) you have a
CAN FD frame,

As the length information is at the same position the only big difference in
the case of CAN FD is to display a 'CAN FD' info and the two bits 'BRS' and
'ESI' when set in the flags field.

> What I was hoping to get out of the capture file was a deterministic way to
> tell if CANFD was present.  In the capture file you did provide, CANFD is
> piggybacking on the CAN format, so how is one supposed to know if its CAN or
> CANFD?  Can we assume the fd_flags field will be non-zero?  (It appears to
> be in all but the first packet of your capture).  Are we to assume pad1
> should always be 0 with "regular" CAN?

I hope my description finally answered your questions.

> The capture file format is why I also mentioned the SLL types.  vcan0
> doesn't appear to write capture files in that format (and there isn't a
> magic button to change it), so does that not need to be supported?

Just an additional hint. I compiled the tool tst-packet.c
(https://github.com/linux-can/can-tests/blob/master/tst-packet.c) from the CAN
tests repo at https://github.com/linux-can/can-tests .

Instead of setting

        sll.sll_family   = AF_PACKET;
        sll.sll_ifindex  = ifindex;
        sll.sll_protocol = htons(ETH_P_CAN);

I changed the code to

        sll.sll_family   = AF_PACKET;
        sll.sll_ifindex  = ifindex;
        sll.sll_protocol = htons(ETH_P_CANFD);

to receive CAN FD frames. But this had the problem that you get CAN frames OR
CAN FD frames - and not both of them at the same time (which is usual for CAN
FD capable network interfaces).


You are receiving this mail because:
  • You are watching all bug changes.