From: Marc Kleine-Budde <mkl@pengutronix.de>
To: Ico Doornekamp <can@zevv.nl>
Cc: linux-can <linux-can@vger.kernel.org>
Subject: Re: CAN libpcap capture endianess
Date: Wed, 11 Sep 2013 22:11:04 +0200 [thread overview]
Message-ID: <5230CE58.3020604@pengutronix.de> (raw)
In-Reply-To: <1378929884-sup-7223@pruts.nl>
[-- Attachment #1: Type: text/plain, Size: 1427 bytes --]
On 09/11/2013 10:05 PM, Ico Doornekamp wrote:
> * On 2013-09-11 21:37:06 +0200, Marc Kleine-Budde wrote:
>
>> On 09/11/2013 07:42 PM, Ico wrote:
>>> 1. capture-ico.pcap: CAN-232 interface, slcan, x86_64
>>> 2. capture-yegor.pcap: VScom USB-CAN interface, slcal, x86
>>
>> BTW:
>>
>>> file *.pcap
>>> capture-ico.pcap: pcap-ng capture file - version 1.0
>>> capture-yegor.pcap: tcpdump capture file (little-endian) - version 2.4 (SocketCAN, capture length 65535)
>>
>> You are using different tools.
>
> That's fine for all I know, since a sniff is a sniff. The original
> question - which endianess is the right one (and what causes the wrong
> endian sniff) - still stands.
I don't think so, there seems to be two different capture formats, the
tcpdump's and the wireshark's one.
I'm not familiar with the tcpdump capture format, but the
"(little-endian)" above suggests that the format supports both little
and big endianes.
And I'm neither familiar with wireshark. Is there an abstraction for the
different capture formats? Who handles the different endianesses? Maybe
it's a bug in the CAN dissector.
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 259 bytes --]
next prev parent reply other threads:[~2013-09-11 20:11 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-11 17:42 CAN libpcap capture endianess Ico
2013-09-11 18:22 ` Marc Kleine-Budde
2013-09-11 18:30 ` Ico Doornekamp
2013-09-11 18:38 ` Marc Kleine-Budde
2013-09-11 18:53 ` Ico Doornekamp
2013-09-11 19:22 ` Oliver Hartkopp
2013-09-11 19:17 ` Oliver Hartkopp
2013-09-11 19:34 ` Marc Kleine-Budde
2013-09-11 19:37 ` Marc Kleine-Budde
2013-09-11 20:05 ` Ico Doornekamp
2013-09-11 20:11 ` Marc Kleine-Budde [this message]
2013-09-12 6:52 ` Ico Doornekamp
2013-09-12 8:00 ` Marc Kleine-Budde
2013-09-12 8:47 ` Ico Doornekamp
2013-09-12 8:52 ` Marc Kleine-Budde
2013-09-12 9:09 ` Ico Doornekamp
2013-09-12 9:13 ` Marc Kleine-Budde
2013-09-12 9:31 ` Ico Doornekamp
2016-05-10 19:25 ` Ico Doornekamp
2016-05-11 7:40 ` Oliver Hartkopp
[not found] ` <1462952665-sup-1016@pruts.nl>
2016-05-11 8:17 ` Oliver Hartkopp
2016-05-11 12:28 ` Ico Doornekamp
2016-05-11 13:25 ` Oliver Hartkopp
2016-05-11 17:01 ` Ico Doornekamp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5230CE58.3020604@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=can@zevv.nl \
--cc=linux-can@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).