{"id":11194,"date":"2026-02-16T00:27:32","date_gmt":"2026-02-16T00:27:32","guid":{"rendered":"https:\/\/purplemeanie.co.uk\/?p=11194"},"modified":"2026-03-02T20:32:31","modified_gmt":"2026-03-02T20:32:31","slug":"gvret-and-bdc668-disectors-for-wireshark","status":"publish","type":"post","link":"https:\/\/purplemeanie.co.uk\/index.php\/2026\/02\/16\/gvret-and-bdc668-disectors-for-wireshark\/","title":{"rendered":"GVRET and BDC668 Dissectors for Wireshark"},"content":{"rendered":"\n

This is a quick post about another non-quick rabbit hole.<\/p>\n\n\n\n

This Wireshark plugin sits on the same PC as SavvyCan and sniffs the interaction between SavvyCan and an ESP32RET CANbus sniffer. It uses the Wireshark SocketCAN format to expose the GVRET can packets to further Wireshark dissectors such as ISO-TP etc.<\/p>\n\n\n\n

If you\u2019re just after the code, then its here:<\/p>\n\n\n\n

https:\/\/github.com\/Purplemeanie\/wireshark_packet_gvret.git<\/a><\/p>\n\n\n\n

The README.md file on GitHub give more technical detail and some help with building and installing the plugin – at least on a Mac \u00af\\_(\u30c4)_\/\u00af <\/p>\n\n\n\n

TLDR;<\/h2>\n\n\n\n

As part of my Project sEVen EV conversion, I’ve been playing about with CANBuses a lot. And in the previous post I talked about getting a CANBus sniffer working on an Adafruit ESP32-S3 TFT board, with some graphics. <\/p>\n\n\n\n

Well towards then end of that ESP32 project I decided to get into a long-wished-for-but-too-lazy-to-go-at project of getting a CANbus dissector working on Wireshark.<\/p>\n\n\n\n

I’ve done some CANBus stuff in Wireshark before and in 2019 (I think) even got a patch accepted into the core Wireshark CANBus dissector – it wasn’t handling extended CAN ID’s properly at the time.<\/p>\n\n\n\n

So, I’ve got a bit of a track record with CANBus and Wireshark. <\/p>\n\n\n\n

But, unless you want to fork out some money for a dedicated CANbus sniffer, there’s not really a way of getting CANBus data sniffed into a Mac. There are SocketCAN interfaces on Linux, but I tend to work mainly on Mac’s these days so wanted a way of getting CAN frames into Wireshark so I could watch live traffic with all the fancy filtering and plotting that Wireshark can do.<\/p>\n\n\n\n

Side note: it’s a sorry day when Ethereal turned into Wireshark and they stopped selling their T-shirts. I had, and loved, their “Ethereal – Sniffing the glue that holds the internet together”! \ud83e\udd23 <\/p>\n\n\n\n

Back to the topic of this post though. I had a few home grown and open source packet sniffers lying around. And they connected to the SavvyCan.com packet analyser, so I could poke around at what was going on on the bus. <\/p>\n\n\n\n

But I find SavvyCan a bit limiting. Don\u2019t get me wrong, SavvyCan is awesome (thanks Colin). It’s great for reverse engineering stuff you don’t have the documentation for, but I wasn’t finding it useful for working out sequences of events. My EV project has lots of devices sat on a CANbus, many of which require complex configuration sequences with many many CANbus messages and fields within the messages. So I just wasn\u2019t \u201cgetting\u201d SavvyCan for that sort of workflow.<\/p>\n\n\n\n

(BTW… I’m probably going to interchange CANBus frames, packets and message with gay abandon. Don’t shoot me!).<\/p>\n\n\n\n

So a packet reverse engineering tool, like SavvyCan, is great, but not totally what I need.<\/p>\n\n\n\n

Wireshark<\/h2>\n\n\n\n

And so to Wireshark<\/a>. <\/p>\n\n\n\n

Wireshark does understand CAN. But it does so in a rather unhelpful set of dissectors when working on a Mac. (I really should go and checkout the SocketCAN support on a Mac again \ud83e\udd14)<\/p>\n\n\n\n

Therefore, my plan was to have my ESP32RET<\/a> packet sniffer, sending GVRET packets over TCP to SavvyCan, and for Wireshark to sniff the packets as they are sent to SavvyCan.<\/p>\n\n\n\n

One of the advantages of that approach is that SavvyCan can do all the configuration of the ESP32RET Sniffer and Wireshark can just watch, and sniff… Wireshark is good at sniffing packets, but it’s not very good at controlling other devices.. I.e. generating rather than sniffing. So it worked well to leave that to SavvyCan.<\/p>\n\n\n\n

So\u2026 my Wireshark sniffing will only work if it’s sat on the same computer as SavvyCan is running on… for the moment!<\/p>\n\n\n\n

But Wireshark doesn’t know any of the protocols that SavvyCan talks. Especially not the GVRET protocol that ESP32RET uses.<\/p>\n\n\n\n

And so the first part of my project is to get Wireshark to decode GVRET packets sent over TCP.<\/p>\n\n\n\n

The next part of the project would be to then get Wireshark to further decode those GVRET packets and disect them into Brusa BDC668 CANBus messaging – breaking out all the voltages, currents, error flags, statuses and modes… etc. See later in this post.<\/p>\n\n\n\n

GVRET Wireshark Dissector<\/h3>\n\n\n\n

And so to ChatGPT again. As I’ve said above, I’ve worked with Wireshark code in the past. I know how to compile it, debug it and make changes. But that took weeks of learning, though those weeks were spread out over the past 20 years of using Ethereal and now Wireshark. And I didn’t want to spend weeks on this project. So… I use ChatGPT to speed the process up. It doesn’t get everything right, and there are endless iterations as you get it to home in a solution, but for the complexity of this project it was a massive speed boost. There I said it! I use AI to write code!<\/p>\n\n\n\n

Back to the point. Between ChatGPT and myself we got a GVRET dissector plugin created. At the moment the plugin has to be built “in tree” meaning you have to build it inside the Wireshark directory structure. I did try “out of tree” building, but “we” failed. I may come back to that at some point but for the moment that’s a problem for future John and what I have is definitely “Good enough TM”.<\/p>\n\n\n\n

You can find the basic files here: https:\/\/github.com\/Purplemeanie\/wireshark_packet_gvret.git<\/a><\/p>\n\n\n\n

Instructions on the basic idea of building this plugin can be found in the README.<\/p>\n\n\n\n

Note: this is now CAN dissector (it wasn\u2019t in the first commit). It now creates a GVRET and CAN protocol that further CAN dissectors can pull apart.<\/p>\n\n\n\n

Note2: if you’re looking to do this sort of thing then I can say that I first created a LUA script of the GVRET protocol to make sure I could iterate quickly to a working dissector. It was then a lot easier to go to a .c\/.so plugin once that was all working.<\/p>\n\n\n\n

BDC668 Wireshark Dissector<\/h3>\n\n\n\n

Now this is probably what I was really after. <\/p>\n\n\n\n

I wanted a way of showing the messaging going to, and coming back from, the big Brusa BDC668 DC to DC Converter that I have in my project. And further along in the bigger EV conversion project I’ll also want to decode all the traffic to and from the Helix CTi4 inverter. But for the moment I’m going just with the 668 messaging.<\/p>\n\n\n\n

And so it was back to ChatGPT again. This time to create a LUA script that acts as a Wireshark dissector for the BDC668 CANBus messaging. <\/p>\n\n\n\n

First of all I got CANMatrix to generate a LUA script from a DBC file I have from Brusa. This gave me the basic CAN ID’s, fields and flags that I needed. But that didn’t work straight away in Wireshark. <\/p>\n\n\n\n

Between ChatGPT and myself we then set about fixing the problems with the basic port of the DBC file, as well as adding all the scaling and offsetting needed to turn the raw CANBus fields into voltages, currents etc. We also converted all the states and modes into textual fields to be displayed in Wireshark.<\/p>\n\n\n\n

Unfortunately, I can’t publish this LUA script as the contents are covered under an NDA. But here’s a screenshot of it in action.<\/p>\n\n\n\n

\"\"
Wireshark directing GVRET protocol followed by Brusa BDC668 CANBus messaging<\/figcaption><\/figure>\n\n\n\n

And there we go. That probably took about a week of work to get the GVRET dissector plugin and then the BDC668 messaging stack LUA script going.<\/p>\n\n\n\n

One thing I nearly got into but didn’t quite (yet), is to switch the ESP32RET project over to doing UDP rather than TCP. One of the limitations of the setup I have is that when the wifi stack on the ESP32RET device gets busy, its concatenates GVRET frames together so I get a compound frame arriving in Wireshark. Meaning I have many different BDC668 messages in the same Wireshark window\/frame\/buffer. So looking at what’s going on is less intuitive. I tried to force ESP32RET to send more often (and therefore less compounding), but I failed so far. And one solution to this problem would be to use UDP rather than TCP as the transport – making sure to send one CANBus frame per UDP packet. I’m on a high speed Wifi… so I probably won’t get a lot of loss that TCP is typically protecting against (again I spent 30 odd years sending audio and video over UDP… I think I understand some of the problems and pitfalls there \ud83d\ude09 ). And of course one CANBus frame per UDP packet would be a lot of overhead (UDP headers etc), but for what I want to do, it probably would be ok. But that’s for future John to worry about… it’s mostly working fine as it is now!<\/p>\n\n\n\n

This is still early days on these two dissectors, but I thought it would be useful to document a bit of the process before I get bogged down in the stuff.<\/p>\n\n\n\n

Happy Blatting, J<\/p>\n","protected":false},"excerpt":{"rendered":"

This is a quick post about another non-quick rabbit hole. This Wireshark plugin sits on the same PC as SavvyCan and sniffs the interaction between SavvyCan and an ESP32RET CANbus sniffer. It uses the Wireshark SocketCAN format to expose the GVRET can packets to further Wireshark dissectors such as ISO-TP etc. If you\u2019re just after […]<\/p>\n","protected":false},"author":1,"featured_media":11176,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Ultra nerdy look at using Wireshark to decode CANBus messaging in my EV project.","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[51,20,38],"tags":[],"class_list":["post-11194","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-caterham-blog","category-ecu-diagnostics","category-electric-vehicles"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/Screenshot-2026-02-15-at-16.56.02-scaled.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8yl38-2Uy","jetpack-related-posts":[{"id":4782,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/07\/ecu-diagnostics-part-4-wireshark-patching-and-obd-ii-results\/","url_meta":{"origin":11194,"position":0},"title":"ECU Diagnostics – part 4 : Wireshark Patching and OBD-II Results","author":"John Martin","date":"September 7, 2019","format":false,"excerpt":"When Wireshark first appeared, it was called Ethereal... and its motto was: \"Sniffing the glue that holds the internet together\" Wireshark sniffs the packet-glue that holds the internet together and is one of the most influential pieces of open source software there is.\u00a0 That's a pretty bold statement and I\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/cano7-OBD-II-working.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":11168,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2026\/02\/15\/esp32ret-on-an-adafruit-esp32-s3-tft\/","url_meta":{"origin":11194,"position":1},"title":"ESP32RET on an Adafruit ESP32-S3 TFT","author":"John Martin","date":"February 15, 2026","format":false,"excerpt":"Well, this was another one of those rabbit hole projects. I'd got myself a home grown CANbus sniffer that talked in the Lawicel format to SavvyCan and allowed me to sniff CANbus data reasonably reliably.\u00a0 BUT, I had to be connected to the sniffer over a serial interface and that\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2026\/02\/ES32RET-on-S3-TFT-scaled.jpeg?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":4769,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/01\/ecu-diagnostics-part-3-test-setup\/","url_meta":{"origin":11194,"position":2},"title":"ECU Diagnostics – part 3 : Test Setup","author":"John Martin","date":"September 1, 2019","format":false,"excerpt":"Ok, so we have an OBD port\/connector on our cars that connects directly to the ECU. How are we going to figure out how to talk the right communications protocols to the car to get at its internal data? We need a test rig to do some experiments with. If\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/Test-Setup-Diagram.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":8125,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2022\/09\/30\/seven-index\/","url_meta":{"origin":11194,"position":3},"title":"Putting the EV in sEVen – Index","author":"John Martin","date":"September 30, 2022","format":false,"excerpt":"In this project we're converting a Caterham Seven Supersport SV from being powered by an Internal Combustion Engine (ICE), into one powered by an electric motor and batteries (BEV - Battery Electric Vehicle) This page is an index of articles relating to Putting the EV in sEVen. You can find\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2022\/09\/Cartoon-Seven-Vector-with-EV-Purple-Bumper.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":5008,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/09\/15\/ecu-diagnostics-part-8-easimap-uses-isotp\/","url_meta":{"origin":11194,"position":4},"title":"ECU Diagnostics – part 8 : Easimap uses ISOTP (sort of)","author":"John Martin","date":"September 15, 2019","format":false,"excerpt":"Ok, that's enough of the theory about mapping. Lets get back to what Easimap is doing when it talks to the car. When we left this subject last we had got to the point where we could see what Easimap was sending and receiving on the CAN bus, but we\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/09\/CANBus-Header-Diagram.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":4765,"url":"https:\/\/purplemeanie.co.uk\/index.php\/2019\/08\/31\/ecu-diagnostics-part-2-ecu-obd-and-can\/","url_meta":{"origin":11194,"position":5},"title":"ECU Diagnostics \u2013 part 2 : ECU, OBD and CAN","author":"John Martin","date":"August 31, 2019","format":false,"excerpt":"ECU Caterhams, like all modern cars, have an Engine Control Unit (ECU) - a black box full of electronics, controlled by a microprocessor that manages how the engine runs. \u00a0And because it has a microprocessor it means it runs some software to control everything. It also connects to a bunch\u2026","rel":"","context":"In "Caterham Blog"","block_context":{"text":"Caterham Blog","link":"https:\/\/purplemeanie.co.uk\/index.php\/category\/caterham-blog\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/purplemeanie.co.uk\/wp-content\/uploads\/2019\/08\/9A4.jpg?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/11194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=11194"}],"version-history":[{"count":18,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/11194\/revisions"}],"predecessor-version":[{"id":11271,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/11194\/revisions\/11271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media\/11176"}],"wp:attachment":[{"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=11194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=11194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/purplemeanie.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=11194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}