Need CAPL script to find fin or RST messages over TCP connection - DOIP

Question

Can someone help me with CAPL script to find FIN /RST messages over canoe trace window? This is for DOIP module - I want it to check the RST/FIN from tester as well as ECU(as we specify)

Basically we want to identify the RST/FIN messages over canoe trace window and check from which IP or mac address its coming . This helps us to identify whether we are receiving it from ECU or tester

We implemented it is using python by taking the logs from Wireshark, this is not being useful since we are not observing this messages in Wireshark which we are seeing currently appearing over canoe trace window Unable to find any help on CAPL script to implement this,, hence need support on the same

on ethernetPacket *
 {
 if((this.dir == tx) && (this.tcp.IsAvailable()))     
   {
    int i; 
    for(i=0;i<=60;i++)
    {
     write(" %d TCP packet bytes %X",i,this.Byte(i));

    }
  } 
 }  

Answer 1

The TCP flags can be accessed using the member <packet>.tcp.Flags (or flags as CAPL is not case-sensitive).

In your case something as follows should work:

on ethernetPacket *
{
  byte RST = 0x04;

  if((this.dir == tx) && (this.tcp.IsAvailable()))     
  {
    if(this.tcp.Flags & RST == RST)
    {
      write("RST packet received");
    }
  } 
}

The order of the flag bits is the same as specified by the TCP protocol.