fix(dumpcap): Correctly record can frames

There seems to be a wireshark "fix" which removed
the "Linux Captured" layer from CAN traces. This
caused our filter to match no frames…

src/gallia/dumpcap.py

@@ -118,28 +118,23 @@ async def _compressor(self) -> None:
                     self.ready_event.set()
                 await asyncio.to_thread(f.write, chunk)
 
-    @staticmethod
-    def _swap_bytes_16(x: int) -> int:
-        return cast(int, struct.unpack(">H", struct.pack("<H", x))[0])
-
     @staticmethod
     def _can_cmd(
         iface: str, src_addr: int | None, dst_addr: int | None
     ) -> list[str] | None:
         args = ["dumpcap", "-q", "-i", iface, "-w", "-"]
         # Debug this with `dumpcap -d` or `tshark -x` to inspect the captured buffer.
-        filter_ = "link[1] == 0x01"  # broadcast flag; ignore "sent by us" frames
+        filter_ = ""
 
         if src_addr is not None and dst_addr is not None:
             # TODO: Support extended CAN IDs
             if src_addr > 0x800 or dst_addr > 0x800:
                 logger.error("Extended CAN Ids are currently not supported!")
                 return None
 
-            # Debug this with `dumpcap -d` or `tshark -x` to inspect the captured buffer.
             filter_ += (
-                f"&& (link[16:2] == {Dumpcap._swap_bytes_16(src_addr):#x} "  # can_id is in little endian
-                f"|| link[16:2] == {Dumpcap._swap_bytes_16(dst_addr):#x})"
+                f"link[0:2] == {src_addr:#x} "
+                f"|| link[0:2] == {dst_addr:#x}"
             )
         args += ["-f", filter_]
         return args