knxcap
Decode KNXnet/IP tunnelling captures made with tshark.
knxcap prints the KNX telegrams of a tunnelling capture, decoded. It is a development tool, used to compare what
another tool sends with what Tinkerbus would send, and to create the capture fixtures the tests use. It does not touch the
bus.
It reads the tab separated output of
tshark -r FILE.pcap -Y 'tcp.port==3671 && tcp.len>0' -T fields \
-e frame.number -e frame.time_relative -e ip.src -e tcp.payload
from standard input, or from the file named on the command line.
tshark ... | knxcap [-data] [-fixture]
knxcap [-data] [-fixture] tshark-output.txt
Flags
| Flag | Meaning |
|---|---|
-data | Only frames with application data. Hides connect, acknowledgement and confirmation noise. |
-fixture | Print only what the first host sent to change a device (load control, property and memory writes, function property commands, restart) in the format of the capture fixtures under internal/download/testdata. |
Without -fixture, each line has the frame number, the time, the direction (> sent by the first host, < by the
other), the cEMI message (req, con or ind), the source and destination, and the decoded transport and application
layer, including extended property and function property services.
The capture has to be of KNXnet/IP over TCP on port 3671, as recorded with a tunnelling TCP connection.