Re: [Wireshark-dev] Input plugin for PEAK Systems CAN interfaces

[Guy Harris]

On Jan 4, 2024, at 7:53 AM, Miklós Márton  wrote:

> The PEAK-CAN to Wireshark question came up again, and I started to work on it 
> based on this wonderful piece of code:
> https://github.com/theXappy/ExtcapNet
> 
> I also reached the point to figure out how to handle over the CAN messages 
> via extcap question.
> Would it be possible to share the code with me? I would only need the extcap 
> packet format for CAN 2.0B packets.

The packet formats for extcap are pcap format:


https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcap.html

and pcapng format:


https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcapng.html

and the link-layer types in those file formats are as described in

https://www.tcpdump.org/linktypes.html

That page lists both:

LINKTYPE_CAN20B, for which the format is *not* defined (I asked the 
people who requested it, and they don't have any documentation available);

LINKTYPE_CAN_SOCKETCAN, which is described at 
https://www.tcpdump.org/linktypes/LINKTYPE_CAN_SOCKETCAN.html.

That page will soon be updated to describe how CAN XL frames are handled.
___
Sent via:Wireshark-dev mailing list 
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
 mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe

Re: [Wireshark-dev] SocketCAN Support is broken in latest Wireshark-v4.3.0rc0-1430-g600de02805d0

[Guy Harris]

So the libpcap main and 1.10 branches include changes to

not clear the CANFD_FDF flag for FD frames;

put the multi-byte fields in the CAN XL header into little-endian byte 
order;

and the Wireshark main and 4.2 branches include changes to

treat CAN frames without the CANXL_XLF flag or the CANFD_FDF flag as FD 
frames if they're exactly 72 bytes long, to work around the (fixed in the main 
and 1.10 branches) libpcap bug where CANFD_FDF is unintentionally cleared;

dissect CAN XL frames;

hand LINKTYPE_LINUX_SLL frames with a protocol type of CAN XL to the 
SocketCAN dissector;

so I think this issue will be resolved by the next Wireshark and libpcap 
releases.
___
Sent via:Wireshark-dev mailing list 
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
 mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe