 | 1 | initial version |
To see how a pcapng file is structured, see the pcapng specification. Packets in a pcapng file are probably stored in Enhanced Protocol Blocks.
The link-layer type in the Interface Description Block in pcapng files for interfaces carrying CAN packets will probably be LINKTYPE_LINUX_SLL or LINKTYPE_LINUX_SLL2. The "ARPHRD_ type" field would, as per those pages, have the value 0x000C for CAN frames and 0x000D for CAN FD frames.
