CAN filter fields

This catalog is available on Physical in CANopen and Automotive VAG. It filters source frames. Higher layers use different catalogs.

Start with can.id, can.frameType and can.data in the CAN fields. Direction, labels and source-stream timing are also listed below.

Source frame fields

Field	Type	Meaning and limitation
trace.direction	String	Observed direction: in, out, unknown
trace.flow	String	Known semantic role: request, response, broadcast, unknown
trace.length	Integer	Frame payload length in bytes
trace.label	String	User frame label; absent from unlabeled frames

Direction and role are independent. A request from an external master may also have trace.direction == in. Incoming direction does not prove the message is a response.

CAN fields

Field	Type	Meaning
can.id	Integer	Numeric CAN identifier
can.dlc	Integer	Payload length in bytes in the Tracer model; for CAN FD this is 0–64 bytes, not the four-bit DLC code
can.frameType	String	std for a standard identifier, ext for an extended identifier
can.rtr	Boolean	RTR remote-request flag
can.fd	Boolean	CAN FD flag
can.brs	Boolean	BRS bit-rate switching flag
can.esi	Boolean	ESI error-state flag
can.data	Bytes	Source CAN frame payload; supports contains and indexing

std and ext describe identifier width; they do not replace can.fd. Adapter requirements for this mode are described under CAN FD settings.

Timing

Field	Type	Meaning and limitation
trace.delta	Integer	Interval from the preceding source CAN frame in whole milliseconds, truncated; not from the previous visible row or previous frame with the same ID
trace.time	Integer	Timestamp in source clock ticks, not a date string, milliseconds or Unix time; use the Time column for typical analysis

trace.delta measures the interval between source frames in the overall stream. Filtering by ID does not turn it into that ID's period. Use Monitor for recurring-ID periods.

Examples

One standard-format identifier:

can.id == 0x185 and can.frameType == std

Several identifiers:

can.id in (0x185, 0x585, 0x605, 0x705)

CAN FD with bit-rate switching:

can.fd == true and can.brs == true

First byte equal to 0x01:

can.id == 0x185 and can.data[0] == 0x01

A byte sequence within one source frame:

can.data contains [0x22, 0xF1, 0x90]

Find a label:

exists(trace.label) and trace.label contains "Check"

Intervals of at least 20 whole milliseconds between adjacent source frames:

trace.delta >= 20

The last example selects the frame after the gap. It neither establishes why the gap occurred nor measures the response time of a particular device.

Diagnostic addresses

Use the shared address.type, address.role, address.group, address.requestId, and address.responseId fields to select physical channels and functional requests. See shared diagnostic addressing for semantics and examples. Without a confirmed diagnostic profile, the address remains unknown.