Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

To see how a pcapng file is structured, see the pcapng specification. Packets in a pcapng file are probably stored in Enhanced Protocol Blocks.

The link-layer type in the Interface Description Block in pcapng files for interfaces carrying CAN packets will probably be LINKTYPE_LINUX_SLL or LINKTYPE_LINUX_SLL2. The "ARPHRD_ type" field would, as per those pages, have the value 0x000C for CAN frames and 0x000D for CAN FD frames.