All is in the topic : I'm trying to filter my CAN frames with j1939, but apparently the usage on wireshark is incorrect. I suppose the frame No.1 should be still visible if I type "j1939" (or maybe I should precise the extended ID like "j1939.can_id == 0xdeadbeef") on the textbar...
You have to know there is nothing responding on my network, I don't know if this is problematic. I just using can-utils "cansend" command and watching if it still appears below. (see screenshots at the end of this post)
Any advice? I don't know how to proceed... Thank you in advance. Cheers
asked 12 Apr '16, 00:38
j1939 is a sub-dissector of can, and as can be seen, both from the protocol column and the packet details you have a can frame, so the filter would be
The easy way to find any filter name is to select the field in question in the packet details pane and then look at the status bar at the bottom which shows the field info. You can also right click any field in the packet details pane and choose "Apply as Filter" or "Prepare a Filter" to have a filter applied or added with the contents of the field you selected.
answered 12 Apr '16, 01:36