Wireshark-bugs: [Wireshark-bugs] [Bug 12687] SocketCAN dissector does not support CAN FD
Comment # 10
on bug 12687
from Oliver Hartkopp
(In reply to Michael Mann from comment #9)
> (In reply to Oliver Hartkopp from comment #8)
> > When
> > your registered for ETH_P_CAN and ETH_P_CANFD with the LINUX_SSL_P_CAN[FD]
> > you will get both type of CAN frames.
>
> > And now comes the big trick (tada!):
> > When you get a socketbuffer with skb->len == sizeof(struct can_frame) you
> > have a 'classic' CAN frame, when skb->len == sizeof(struct canfd_frame) you
> > have a CAN FD frame,
>
> We are still talking two entirely different languages.
I see. But it helps me to get into your world :-)
> The layers you speak
> of are not passed to any information Wireshark has (Wireshark does not have
> socket information). Wireshark is not passed the struct canfd_frame (or
> technically the can_frame). The "file format" more closely resembles the
> can_frame, but the "data" field is not guaranteed to be 8.
>
> Do you have any capture files where data length > 8? I didn't see any
> frames like that in the capture provided.
I tried.
But either with Wireshark 2.0.4 (Debian) or with the latest Wireshark git
master v2.3.0rc0-136-g765f3b5 with your patch I can't create a pcap file that
contains CAN FD frames.
E.g. with tshark -r <mycapture>.pcap I can only see the fames that are CAN -
even when I can see a mix of CAN and CAN FD traffic with the tool 'candump'.
> > IMO you can just assume to have
> > a CAN FD interface and work with struct canfd_frame (see PDF slides).
>
> I think this can "work", but there still isn't a way to distinguish CAN and
> CANFD frames if both are part of the same capture file (again, because there
> isn't anything in the "file format" that differiates them). So you can
> either have one or the other from Wireshark's perspective.
As the 'length' is a weak difference (CAN and CAN FD can both have 8 data
bytes) - what about setting a bit into one of the reserved bytes when a CAN FD
frame was received (somewhere in wiresharks lower layers)??
You are receiving this mail because:
- You are watching all bug changes.
