Re: CAN libpcap capture endianess

[Marc Kleine-Budde <mkl@pengutronix.de>]

[-- Attachment #1: Type: text/plain, Size: 1815 bytes --]

Hello,

On 09/11/2013 07:42 PM, Ico wrote:
> Recently I tried the CANopen module in wireshark to sniff on my slcan
> interface, but the dissector seemed to mix up the endianess of the

When opening your attached files I don't see any CANopen related
dissecting happening in my wireshark (Version 1.10.1 (SVN Rev 50926 from
/trunk-1.10), from current Debian testing/jessie). Just normal raw CAN
frames are displayed.

> capture. The source of the dissector seems to assume the CANopen data is
> encoded in big endian, altough afaik CANopen uses little endian for its
> data.

Maybe you are mixing CANopen and plain raw CAN frames.

> I contacted Yegor Yefremov, the contributor of the CANopen dissector,
> who is now just confused as I am: he made some captures on his own
> setup, on which the endianess is indeed different then from mine.
> 
> We both run on x86, so host endianess does not seem to be part of the
> problem.

But you're using a 64 bit system while Yegor uses a 32 bit one
(according to your notes below).

> Hereby I attach two capture files, one made on my setup, and one made by
> Yegor. Can oneone check which one has the proper endianess, and maybe
> take a look at the current CANopen dissector in wireshark to see if the
> implementation is ok?

Your dump doesn't look correct in my wireshark, it has alternating
extended and standard frames and the standard frames have identifiers of
0x060000 which is not valid.

Does the command line tool candump show proper frames?

Marc
-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]