I haven't had any luck finding a capture where a BRD
datagram also has data.
EtherCAT datagram: Cmd: 'BRD' (7), Len: 2, Adp 0x0, Ado 0x130, Cnt 0
MATE extract the cmd
fields as hex so the display filter search would be for "0x07".
MATE code to allow search for a specific cmd/data pair:
Pdu sub1_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub1.cmd;
Extract data From ecat.sub1.data;
};
Gop sub1_gop On sub1_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub2_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub2.cmd;
Extract data From ecat.sub2.data;
};
Gop sub2_gop On sub2_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub3_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub3.cmd;
Extract data From ecat.sub3.data;
};
Gop sub3_gop On sub3_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub4_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub4.cmd;
Extract data From ecat.sub4.data;
};
Gop sub4_gop On sub4_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub5_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub5.cmd;
Extract data From ecat.sub5.data;
};
Gop sub5_gop On sub5_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub6_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub6.cmd;
Extract data From ecat.sub6.data;
};
Gop sub6_gop On sub6_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub7_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub7.cmd;
Extract data From ecat.sub7.data;
};
Gop sub7_gop On sub7_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub8_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub8.cmd;
Extract data From ecat.sub8.data;
};
Gop sub8_gop On sub8_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub9_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub9.cmd;
Extract data From ecat.sub9.data;
};
Gop sub9_gop On sub9_pdu Match (cmd, data) {
Start (cmd, data);
};
Pdu sub10_pdu Proto ecat Transport mate {
Extract cmd From ecat.sub10.cmd;
Extract data From ecat.sub10.data;
};
Gop sub10_gop On sub10_pdu Match (cmd, data) {
Start (cmd, data);
};
Gog ecat_gog {
Member sub1_gop (cmd, data);
Member sub2_gop (cmd, data);
Member sub3_gop (cmd, data);
Member sub4_gop (cmd, data);
Member sub5_gop (cmd, data);
Member sub6_gop (cmd, data);
Member sub7_gop (cmd, data);
Member sub8_gop (cmd, data);
Member sub9_gop (cmd, data);
Member sub10_gop (cmd, data);
};
Done;
Display filter example: (mate.ecat_gog.cmd == "0x04") && (mate.ecat_gog.data == "06:00")
EtherCAT can have multiple datagrams per frame.
You would like the filter to match frames only where the two conditions are in the same datagram.
If Wireshark display filters supported field occurrence then this might be possible.
An upvote for the bugs in this Ask question might help to get it added.
18827: Ability to filter on occurrences of a field
If the
(more)ecat
dissector were updated to add them as true PDUs, this could be solved with MATE.Currently it is
[Protocols in frame: eth:ethertype:ecatf:ecat]
- a single PDU.