# New Repo! Wireshark\_plugins now available for Cyphal

**URL:** <https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943>\
**Category:** Applications & Usage\
**Created:** [July 21, 2023, 6:19pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943 "2023-07-21T18:19:50Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![scottdixon](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/scottdixon/32/39_2.png) [@scottdixon](https://forum.opencyphal.org/u/scottdixon)\
**Post date:** [July 21, 2023, 6:19pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/1 "2023-07-21T18:19:50Z")

</div>

Thanks to @erik.rainey, we are happy to announce a set of [WireShark Plugins](https://github.com/OpenCyphal/wireshark_plugins) are now available for Cyphal/UDP and Cyphal/CAN. These allow you to debug and decode network-layer Cyphal communications using the popular, cross-platform [WireShark](https://www.wireshark.org/) protocol analyzer.

> **[GitHub - OpenCyphal/wireshark\_plugins: A place to hold WireShark Filters for...](https://github.com/OpenCyphal/wireshark_plugins)**
>
> A place to hold WireShark Filters for Cyphal. Contribute to OpenCyphal/wireshark\_plugins development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![PetervdPerk](https://forum.opencyphal.org/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@PetervdPerk](https://forum.opencyphal.org/u/PetervdPerk)\
**Post date:** [July 26, 2023, 6:17pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/2 "2023-07-26T18:17:38Z")

</div>

Is the Wireshark UAVCAN/CAN build-in dissector broken (good reminder is should rename it as well)?

> **[Wireshark · Display Filter Reference: UAVCAN/CAN](https://www.wireshark.org/docs/dfref/u/uavcan_can.html)**
>
> Wireshark: The world's most popular network protocol analyzer

Haven’t use it in while, are there known bugs for it?

---

<div class="post-metadata">

**Author:** ![scottdixon](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/scottdixon/32/39_2.png) [@scottdixon](https://forum.opencyphal.org/u/scottdixon)\
**Post date:** [July 27, 2023, 5:05pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/3 "2023-07-27T17:05:14Z")

</div>

This seems like something that belongs to DroneCAN now. I doubt it’d work with Cyphal but I have no idea. Cyphal is multi-transport so the new repo supports Cyphal/UDP as well as CAN.

---

<div class="post-metadata">

**Author:** ![pavel.kirienko](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/pavel.kirienko/32/9_2.png) [@pavel.kirienko](https://forum.opencyphal.org/u/pavel.kirienko)\
**Post date:** [July 27, 2023, 5:53pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/4 "2023-07-27T17:53:11Z")

</div>

The dissector Peter mentioned was created specifically for Cyphal/CAN (UAVCAN v1), by Peter himself. I brought this up with @erik.rainey when he started working on the Lua plugin for CAN and IIRC his rationale was that it is desirable to keep all plugins in one place.

---

<div class="post-metadata">

**Author:** ![scottdixon](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/scottdixon/32/39_2.png) [@scottdixon](https://forum.opencyphal.org/u/scottdixon)\
**Post date:** [July 27, 2023, 8:58pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/5 "2023-07-27T20:58:56Z")

</div>

whoops! Sorry @PetervdPerk . Is this purely duplicated work or can we pull your work into this repository? Also, it does need to be renamed 😉

---

<div class="post-metadata">

**Author:** ![PetervdPerk](https://forum.opencyphal.org/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@PetervdPerk](https://forum.opencyphal.org/u/PetervdPerk)\
**Post date:** [July 27, 2023, 9:31pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/6 "2023-07-27T21:31:38Z")

</div>

So my dissector was written in C and is included in upstream Wireshark.

My approach is also a bit different, uavcan\_can implements only the Cyphal/CAN spec and reassembles all incoming frames and verifies toggle and crc.

When reassembled it passes the payload to uavcan\_dsdl ([Wireshark · Display Filter Reference: UAVCAN DSDL](https://www.wireshark.org/docs/dfref/u/uavcan_dsdl.html)) which implements a subset of the public\_regulated\_data\_types i.e. Get Register, NodeIdAllocation, Heartbeat, File and more.

Technically the Lua cyphal\_udp can also pass a reassembled frame to uavcan\_dsdl to have it decoded if the port id matches.

The Lua approach would still be interesting generate a decoder for the full dsdl spec combined with Nunavut.

---

<div class="post-metadata">

**Author:** ![erik.rainey](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/erik.rainey/32/20_2.png) [@erik.rainey](https://forum.opencyphal.org/u/erik.rainey)\
**Post date:** [August 7, 2023, 11:32pm UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/7 "2023-08-07T23:32:57Z")

</div>

Cyphal/CAN works as a CAN-FD post-dissector, just like UAVCAN/CAN does. However, a bit less well as I haven’t figured out how to make the table above reflect the dissection in Lua.

@PetervdPerk is correct about the long term roadmap. I’d like to parse the DSDL in Lua and allow arbitrary .dsdl decode in the Lua code. There’s some promising ENBF parsers in Lua, so we may be able to do it somewhat easily or with some minor code generation (due to Lua being interpreted).

Since the Lua execution model I think is per-message, I think it can’t parse the whole DSDL tree of all types, it will need a table corelating a Port ID to .dsdl file or some preprocessing from nunavut.

---

<div class="post-metadata">

**Author:** ![pavel.kirienko](https://forum.opencyphal.org/user_avatar/forum.opencyphal.org/pavel.kirienko/32/9_2.png) [@pavel.kirienko](https://forum.opencyphal.org/u/pavel.kirienko)\
**Post date:** [July 16, 2026, 11:41am UTC](https://forum.opencyphal.org/t/new-repo-wireshark-plugins-now-available-for-cyphal/1943/8 "2026-07-16T11:41:02Z")

</div>

Necroposting to mention that we now have a new Lua dissector for Cyphal v1.1 in this (draft) PR here, supporting both CAN (v1.0 and v1.1) and UDP:

> <https://github.com/OpenCyphal/wireshark_plugins/pull/20>
>
> This is 100% vibecode but it appears to function adequately so far.

It is 100% vibecoded by Sol and I am pleasantly surprised by its quality.
