CAN libpcap capture endianess

[Ico <can@zevv.nl>]

[-- Attachment #1: Type: text/plain, Size: 987 bytes --]

Hello,

Recently I tried the CANopen module in wireshark to sniff on my slcan
interface, but the dissector seemed to mix up the endianess of the
capture. The source of the dissector seems to assume the CANopen data is
encoded in big endian, altough afaik CANopen uses little endian for its
data.

I contacted Yegor Yefremov, the contributor of the CANopen dissector,
who is now just confused as I am: he made some captures on his own
setup, on which the endianess is indeed different then from mine.

We both run on x86, so host endianess does not seem to be part of the
problem.

Hereby I attach two capture files, one made on my setup, and one made by
Yegor. Can oneone check which one has the proper endianess, and maybe
take a look at the current CANopen dissector in wireshark to see if the
implementation is ok?

Thank you,

Ico

attached:

1. capture-ico.pcap: CAN-232 interface, slcan, x86_64
2. capture-yegor.pcap: VScom USB-CAN interface, slcal, x86

-- 
:wq
^X^Cy^K^X^C^C^C^C

[-- Attachment #2: capture-ico.pcap --]
[-- Type: application/octet-stream, Size: 12940 bytes --]

[-- Attachment #3: capture-yegor.pcap --]
[-- Type: application/octet-stream, Size: 22128 bytes --]