This is our old Q&A Site. Please post any new questions and answers at


I've just upgraded to wireshark 2.2.3 from 1.6.5 (I think it was).

I use the following command to extract information from EtherCAT frames:

"C:\Program Files\Wireshark\tshark" -r "myfile" -T fields -e -e esl.port -e esl.crcerror -e esl.alignerror -e esl.timestamp

In the previous version the field would output data from all datagrams but in the latest version it is only outputting data from the first three datagrams.

My EtherCAT frames generally have either 4 for 5 datagrams.

If I use -e, no data is output (blank lines). If I use -e then if there is a fifth datagram it is output.

Here is a summary of a frame with 4 datagrams:

Frame 41720: 191 bytes on wire (1528 bits), 191 bytes captured (1528 bits)
Ethernet II, Src: MS-NLB-PhysServer-01_05:13:7e:d0 (02:01:05:13:7e:d0), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
EtherCAT frame header
EtherCAT datagram(s): 4 Cmds, 'LRD': len 1, 'LRD': len 68, 'LWR': len 38, 'FRMW': len 4
    EtherCAT datagram: Cmd: 'LRD' (10), Len: 1, Addr 0x0, Cnt 1
    EtherCAT datagram: Cmd: 'LRD' (10), Len: 68, Addr 0x1, Cnt 2
    EtherCAT datagram: Cmd: 'LWR' (11), Len: 38, Addr 0x45, Cnt 2
    EtherCAT datagram: Cmd: 'FRMW' (14), Len: 4, Adp 0x3, Ado 0x910, Cnt 6
EtherCAT Switch Link

Is there any other information I need to supply to help figure out why datagram 4 is not outputting its data?

Thanks, G.

A capture file can be found here:!AoLeUQXl-H0MgQmMddI1ja_Yob95

Note: the frames with 4 or more datagrams are further down the capture.

asked 09 Jan '17, 20:56

grf's gravatar image

accept rate: 0%

edited 10 Jan '17, 00:48

A sample capture file would be nice.

(09 Jan '17, 23:35) Jaap ♦

Sorry, couldn't find how to attach a file, can you let me know how? In the meantime I've added a link for one. Thanks, G.

(10 Jan '17, 00:52) grf

A link to the file is fine (and the only way, there's no attachment option here).

(10 Jan '17, 01:39) Jaap ♦

When I look at the details of the frames in Wireshark (2.2.2), in this case the first one with 4 datagrams, frame 815, I see that there is no field in the last datagram, only interpreted timestamps. What data were you expecting?

(10 Jan '17, 01:44) Jaap ♦

The ones I'm interested are mostly from around frame 2719, before that there's also a whole lot of configuration frames with other datagrams.

It's the "EtherCAT datagram: Cmd: 'FRMW' (14), Len: 4, Adp 0x3, Ado 0x910, Cnt 4" datagram that I want. This datagram should have 4 bytes of data, which is a 32bit timestamp from an EtherCAT slave.

Note: I've got "enable disector" checked under the ESL protocol to show the extended EtherCAT Switch Link data at the end of the frame. Otherwise it shows this data as Pad bytes.

(10 Jan '17, 02:05) grf

Also, looking at frame 815, although its not the one I'm interested in it should still have 24 bytes of data. It is also timestamp related information.

(EtherCAT datagram: Cmd: 'FPRD' (4), Len: 24, Adp 0x1, Ado 0x910, Cnt 1)

(10 Jan '17, 02:11) grf
showing 5 of 6 show 1 more comments is a placeholder for data the dissector doesn't understand. With this change the interpretation of EtherCAT slave controller registers was added to the dissector, replacing the placeholders. Adding those field names to the command line should present you with the interpretation of the data you seek.

permanent link

answered 10 Jan '17, 02:30

Jaap's gravatar image

Jaap ♦
accept rate: 14%

I'm away from the computer till tomorrow so will check it out then. Thanks

(10 Jan '17, 02:37) grf

Thanks. The field I needed to use is ecat.reg.dc.systimeL

(10 Jan '17, 13:58) grf
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 09 Jan '17, 20:56

question was seen: 923 times

last updated: 10 Jan '17, 13:58

p​o​w​e​r​e​d by O​S​Q​A