THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 1
Guy Harris's avatar
19.9k
Guy Harris
answered 2020-02-04 17:27:07 +0000

To see how a pcapng file is structured, see the pcapng specification. Packets in a pcapng file are probably stored in Enhanced Protocol Blocks.

The link-layer type in the Interface Description Block in pcapng files for interfaces carrying CAN packets will probably be LINKTYPE_LINUX_SLL or LINKTYPE_LINUX_SLL2. The "ARPHRD_ type" field would, as per those pages, have the value 0x000C for CAN frames and 0x000D for CAN FD frames.