Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 12687] SocketCAN dissector does not support CAN FD

Date: Mon, 01 Aug 2016 16:32:30 +0000

Comment # 10 on bug 12687 from
(In reply to Michael Mann from comment #9)
> (In reply to Oliver Hartkopp from comment #8)

> > When
> > your registered for ETH_P_CAN and ETH_P_CANFD with the LINUX_SSL_P_CAN[FD]
> > you will get both type of CAN frames.
> 
> > And now comes the big trick (tada!):
> > When you get a socketbuffer with skb->len == sizeof(struct can_frame) you
> > have a 'classic' CAN frame, when skb->len == sizeof(struct canfd_frame) you
> > have a CAN FD frame,
> 
> We are still talking two entirely different languages. 

I see. But it helps me to get into your world :-)

> The layers you speak
> of are not passed to any information Wireshark has (Wireshark does not have
> socket information).  Wireshark is not passed the struct canfd_frame (or
> technically the can_frame).  The "file format" more closely resembles the
> can_frame, but the "data" field is not guaranteed to be 8.
> 
> Do you have any capture files where data length > 8?  I didn't see any
> frames like that in the capture provided.

I tried.

But either with Wireshark 2.0.4 (Debian) or with the latest Wireshark git
master v2.3.0rc0-136-g765f3b5 with your patch I can't create a pcap file that
contains CAN FD frames.

E.g. with tshark -r <mycapture>.pcap I can only see the fames that are CAN -
even when I can see a mix of CAN and CAN FD traffic with the tool 'candump'.

> > IMO you can just assume to have
> > a CAN FD interface and work with struct canfd_frame (see PDF slides).
> 
> I think this can "work", but there still isn't a way to distinguish CAN and
> CANFD frames if both are part of the same capture file (again, because there
> isn't anything in the "file format" that differiates them).  So you can
> either have one or the other from Wireshark's perspective.

As the 'length' is a weak difference (CAN and CAN FD can both have 8 data
bytes) - what about setting a bit into one of the reserved bytes when a CAN FD
frame was received (somewhere in wiresharks lower layers)??


You are receiving this mail because:
  • You are watching all bug changes.