CAN bus (automotive) sniffing tools? - Page 1
Forum section: electronics / testgear

author: linux-works
author_rank: Super Contributor
timestamp: March 01, 2018, 05:02:29 pm
content: I'm wondering how good the rigol scopes are, for example, in decoding CAN bus signals? I think the 2000 series (or is it just 4000 series?) can do CAN, but how well does it do it?salae, maybe? with a level converter or MCP transceiver?we have Vector tools at work but they are very expensive and we only have a few of them to go around, so I am looking into using digital scopes for this, for realtime display and even if we buy multiple scopes, it will still be cheaper than just ONE vector brand dongle-based tool (sigh).I know linux can support CAN nicely, but really like the idea of a scope being able to see the can-hi and can-low signals as well as decode them.what are your experiences in this area?

author: tridentsx
author_rank: Regular Contributor
timestamp: March 01, 2018, 05:14:50 pm
content: I have used sigrok with a cheap LA + CAN transceiver on Linux. Not sure if you need to troubleshoot the electrical interface of CAN it should be handled by the transceiver chip.

author: abraxa
author_rank: Frequent Contributor
timestamp: March 01, 2018, 11:04:35 pm
content: Depends on what you want to do. If you're only interested in the data that's going over the bus, I'd say a RPi with a CAN shield (e.g.http://skpang.co.uk/catalog/pican2-canbus-board-for-raspberry-pi-23-p-1475.html) is going to be nice. If you want to examine the signal timings and such on a low level, sigrok can help you out.A scope is mostly useful for checking signal integrity, it's not going to replace a logic or protocol analyzer because of the dead time and the limited acquisition memory.

author: linux-works
author_rank: Super Contributor
timestamp: March 02, 2018, 03:40:54 am
content: ok, it seems that there's not a lot of fans of using scopes to decode serial when LA's can do it more easily.I did get hold of a 'logic' clone and installed sigrok. quite good, in fact! price is right, too.thx

author: Performa01
author_rank: Super Contributor
timestamp: March 02, 2018, 07:51:07 am
content: Quote from: linux-works on March 02, 2018, 03:40:54 amYes, indeed, even though some folks seem to look at serial decoding as the single most important feature of a DSOYet certain scopes could be a near perfect match for the job, especially the 4000 series for on-site and automotive, but even the 2000 series for general purpose on a tight budget:https://www.picotech.com/products/oscilloscope

author: Fungus
author_rank: Super Contributor
timestamp: March 02, 2018, 08:09:59 am
content: Quote from: linux-works on March 02, 2018, 03:40:54 amTwisting a knob to examine large amounts of serial data just seems like the wrong user interface to me. Entering search values by twisting a knob on a virtual "keyboard" is 100x worse, I want mouse+keyboard.You can get USB logic analyzers for $6, I don't see the point in insisting that a box with a twisty knob as the only user interface should do more than look at the signal integrity.

author: Jeroen3
author_rank: Super Contributor
timestamp: March 02, 2018, 09:01:36 am
content: If you're looking at buying a scope for real time CAN bus, you're doing it wrong. You can only view snapshots after trigger.Just buy a CAN-USB interface from Kvaser or Peak.

author: georgd
author_rank: Regular Contributor
timestamp: March 02, 2018, 10:15:28 am
content: As mentioned her there are three solution:- scope with CAN decoder and with trigger on various CAN event- USB logic analyzer like saleae or USBEE- USB-CAN interface like PeakI have all of three and use all of them in different situations. Scope is good for checking physical layer or use it's trigger unit when hunting for protocol violations or rare frames CAN.Most of time I use USB-CAN interface in connection with Wireshark. A simple software written by me grabs Peak's output converts it into Wireshark capture format and put it in a named queue.In Wireshark you can parse data with LUA and present it in format suitable for protocol you working on like TP2.0 or ISOO15765.I like to emphasize two things otherwise rare mentioned in conjunction with serial decoding: triggering on serial event on scope and as second present serial data in format suitable for higher level protocol.Georg

author: m_t
author_rank: Contributor
timestamp: March 02, 2018, 01:22:30 pm
content: You could just use a Linux single board computer of your choice, a CAN controller (if not already included) and a CAN transceiver. Then you can use SocketCAN to receive CAN messages. Here is a simple test program I wrote some time ago:https://github.com/m-thu/sandbox/tree/master/socketcanYou can even test this without any physical CAN bus by using the virtual CAN interface provided by the SocketCAN networking layer:Code:makemake vcan./receiver vcan0And in another terminal:Code:./sender vcan0

author: Gabri74
author_rank: Regular Contributor
timestamp: March 02, 2018, 02:25:23 pm
content: I second buying an USB/CAN adapter and using Wireshark.I've bought this and I'm very happy, best price/performance ratio in my opinion:https://www.8devices.com/products/usb2canA note of caution: stay away from the cheap ebay/aliexpress/cineese USB adapters that pretend to work in Linux, they are often based on a serial interface via USB(CAN <--> SERIAL <--> USB) and are not worth even the cheap price.And the Windows drivers are really shady... I would never install them ;-)Last minute edit: for fast analysis you could also use candump utility in linux, it has timestamps, filters, etc and for simple task is helpful.

author: Jeroen3
author_rank: Super Contributor
timestamp: March 02, 2018, 08:30:12 pm
content: Quote from: Gabri74 on March 02, 2018, 02:25:23 pmThey're not fast enough to handle average frames/s.

author: AndyC_772
author_rank: Super Contributor
timestamp: March 02, 2018, 08:46:04 pm
content: I use a PEAK USB-CAN interface to record and analyse the data on the bus, and an Agilent MSO-X3000 scope with the (very fast, hardware) CAN decoding option to look at signal quality and timing. Both are equally valuable depending on what I'm debugging, and neither could replace the other.

author: teste_
author_rank: Newbie
timestamp: March 04, 2018, 12:35:57 pm
content: UseBusmaster: a free tool made by ETAShttps://rbei-etas.github.io/busmaster/This software requires a CAN interface, which can be PEAK USB, Kvaser, some ETAS and even Vector hardware.I like the Kvaser Leaf Light v2. It cost around 350USD. PeakUSB is cheaper (~180EUR)It is also compatible with J1939 databases (you must convert the files from .dbc to .dbf)edit: typo

author: Jeroen3
author_rank: Super Contributor
timestamp: March 04, 2018, 01:37:43 pm
content: Kvaser also has an excellent driver to build custom applications around. No serial port rubbish. One API for all their devices, even the networked ones.

author: nctnico
author_rank: Super Contributor
timestamp: March 04, 2018, 03:57:54 pm
content: The relatively cheap Canusb adapter from Lawicel and 'CAN monitor pro' software from WGSoft work well for me for occasional use. Like AndyC_772 I use an oscilloscope to look at the signal quality. I use the Canusb + 'CAN monitor pro' to look at the data and packet rates.

author: gedass2000
author_rank: Contributor
timestamp: February 27, 2019, 11:58:31 am
content: TouCAN USB to CAN bus non serial converter works under Linux (SocketCAN).Using opensource QT.io GUI you can easy analyze CAN bus.www.rusoku.com/products

author: sokoloff
author_rank: Super Contributor
timestamp: February 27, 2019, 12:12:37 pm
content: I have had great experiences with the PiCAN hat for an RPi. You could buy a dozen of those setups for $1000 and use those typically. Having the filtering and recording capability of the Linux subsystem is very helpful (arguably critical) in automotive CAN reverse engineering.

author: Rerouter
author_rank: Super Contributor
timestamp: February 27, 2019, 12:19:10 pm
content: I should flag that a number of tools struggle depending on what you want to do, There is 11 bit can, mainly used in cars, there is 29 bit can mainly used in trucks, and there is now the new CANFD which most of the older tools do not like (newer protocol),I mentioned the identifier lengths as some buses and trucks like to mix them for no good reason, and a number of tools don't like trancieving both standards at once.This has resulting in us using an IAXXT and a USB based ELM327 device hooked up to a Y Splitter cable. so we know we can handle whatever it throws in most situations.I do also have access to a vector (Ironically got from an Expo, its stupid money, but hey freebie), However its not that nice to drive as the others at least for me. you tell it to send a message once, it didn't see an ACK so sent it 22 times, fun stuff like that, that needs far more digging into the driver definition than I cared to.

author: can2sky
author_rank: Newbie
timestamp: March 31, 2020, 04:44:32 pm
content: Hi to all!There are many users who try to scan onboard CAN bus networks of cars with a help of CAN utils. Result of scan is raw test output. Someone who is experienced enough to recognize some CAN IDs in raw log but it is difficult to analyze anyway.I've tried to make things easier with a cloud CAN bus decoder which can use raw output file.It is completely free and you can use it here - can2sky.commain idea:some screenshotsYou can upload your log and analyze data if service already has decoder for your vehicle. Some of parameters will be recognized, some not. Service has tools for manual decoding of parameters. Now we are working over sharing logs and decoders between users to establish collaborative decoding.manualhttps://drive.google.com/open?id=1ik4rbaMyAFXXszg3OeMeZ5QGxne66nFdd2u_GT8W8kEI hope you will like it.Regards, Andrew

author: Gabri74
author_rank: Regular Contributor
timestamp: March 31, 2020, 05:10:09 pm
content: Impressive work, thanks for sharingMay I suggest you to open a dedicated thread? I think this project deserves its own thead!

author: CalMachine
author_rank: Frequent Contributor
timestamp: March 31, 2020, 07:43:47 pm
content: I use a picoscope at work for decoding CAN. It works decently wellSometimes when an automobile manufacturer updates their CAN protocol with proprietary messages, this is what is used to sniff those new messages out.

author: Miti
author_rank: Super Contributor
timestamp: March 31, 2020, 07:46:43 pm
content: Microchip has a CAN bus analyzer tool.https://www.microchip.com/DevelopmentTools/ProductDetails/PartNO/APGDT002