CAN bus (automotive) sniffing tools?

[linux-works]

I'm wondering how good the rigol scopes are, for example, in decoding CAN bus signals?  I think the 2000 series (or is it just 4000 series?) can do CAN, but how well does it do it?

salae, maybe?  with a level converter or MCP transceiver?

we have Vector tools at work but they are very expensive and we only have a few of them to go around, so I am looking into using digital scopes for this, for realtime display and even if we buy multiple scopes, it will still be cheaper than just ONE vector brand dongle-based tool (sigh).

I know linux can support CAN nicely, but really like the idea of a scope being able to see the can-hi and can-low signals as well as decode them.

what are your experiences in this area?

[tridentsx]

I have used sigrok with a cheap LA + CAN transceiver on Linux. Not sure if you need to troubleshoot the electrical interface of CAN it should be handled by the transceiver chip.
 

[abraxa]

Depends on what you want to do. If you're only interested in the data that's going over the bus, I'd say a RPi with a CAN shield (e.g. http://skpang.co.uk/catalog/pican2-canbus-board-for-raspberry-pi-23-p-1475.html) is going to be nice. If you want to examine the signal timings and such on a low level, sigrok can help you out.

A scope is mostly useful for checking signal integrity, it's not going to replace a logic or protocol analyzer because of the dead time and the limited acquisition memory.

[linux-works]

ok, it seems that there's not a lot of fans of using scopes to decode serial when LA's can do it more easily.

I did get hold of a 'logic' clone and installed sigrok.  quite good, in fact!  price is right, too.

thx

[Performa01]

ok, it seems that there's not a lot of fans of using scopes to decode serial when LA's can do it more easily.

Yes, indeed, even though some folks seem to look at serial decoding as the single most important feature of a DSO

Yet certain scopes could be a near perfect match for the job, especially the 4000 series for on-site and automotive, but even the 2000 series for general purpose on a tight budget:

https://www.picotech.com/products/oscilloscope

[Fungus]

ok, it seems that there's not a lot of fans of using scopes to decode serial

Twisting a knob to examine large amounts of serial data just seems like the wrong user interface to me. Entering search values by twisting a knob on a virtual "keyboard" is 100x worse, I want mouse+keyboard.

You can get USB logic analyzers for $6, I don't see the point in insisting that a box with a twisty knob as the only user interface should do more than look at the signal integrity.

[Jeroen3]

If you're looking at buying a scope for real time CAN bus, you're doing it wrong. You can only view snapshots after trigger.
Just buy a CAN-USB interface from Kvaser or Peak.

[georgd]

As mentioned her there are three solution:
- scope with CAN decoder and with trigger on various CAN event
- USB logic analyzer like saleae or USBEE
- USB-CAN interface like Peak

I have all of three and use all of them in different situations. Scope is good for checking physical layer or use it's trigger unit when hunting for protocol violations or rare frames CAN.
Most of time I use USB-CAN interface in connection with Wireshark. A simple software written by me grabs Peak's output converts it into Wireshark capture format and put it in a named queue.
In Wireshark you can parse data with LUA and present it in format suitable for protocol you working on like TP2.0 or ISOO15765.

I like to emphasize  two things otherwise rare mentioned in conjunction with serial decoding: triggering on serial event on scope and as second present serial data in format suitable for higher level protocol.

Georg

[m_t]

You could just use a Linux single board computer of your choice, a CAN controller (if not already included) and a CAN transceiver. Then you can use SocketCAN to receive CAN messages. Here is a simple test program I wrote some time ago: https://github.com/m-thu/sandbox/tree/master/socketcan
You can even test this without any physical CAN bus by using the virtual CAN interface provided by the SocketCAN networking layer:

Code: [Select]

make
make vcan
./receiver vcan0
And in another terminal:

Code: [Select]

./sender vcan0

[Gabri74]

I second buying an USB/CAN adapter and using Wireshark.
I've bought this and I'm very happy, best price/performance ratio in my opinion:

https://www.8devices.com/products/usb2can

A note of caution: stay away from the cheap ebay/aliexpress/cineese USB adapters that pretend to work in Linux, they are often based on a serial interface via USB
(CAN <--> SERIAL <--> USB) and are not worth even the cheap price.
And the Windows drivers are really shady... I would never install them ;-)

Last minute edit: for fast analysis you could also use candump utility in linux, it has timestamps, filters, etc and for simple task is helpful.

[Jeroen3]

(CAN <--> SERIAL <--> USB) and are not worth even the cheap price.

They're not fast enough to handle average frames/s.

[AndyC_772]

I use a PEAK USB-CAN interface to record and analyse the data on the bus, and an Agilent MSO-X3000 scope with the (very fast, hardware) CAN decoding option to look at signal quality and timing. Both are equally valuable depending on what I'm debugging, and neither could replace the other.

[teste_]

Use Busmaster: a free tool made by ETAS
https://rbei-etas.github.io/busmaster/
This software requires a CAN interface, which can be PEAK USB, Kvaser, some ETAS and even Vector hardware.

I like the Kvaser Leaf Light v2. It cost around 350USD. PeakUSB is cheaper (~180EUR)

It is also compatible with J1939 databases (you must convert the files from .dbc to .dbf)

edit: typo

[Jeroen3]

Kvaser also has an excellent driver to build custom applications around. No serial port rubbish. One API for all their devices, even the networked ones.

[nctnico]

The relatively cheap Canusb adapter from Lawicel and 'CAN monitor pro' software from WGSoft work well for me for occasional use. Like AndyC_772 I use an oscilloscope to look at the signal quality. I use the Canusb +   'CAN monitor pro' to look at the data and packet rates.

[gedass2000]

TouCAN USB to CAN bus non serial converter works under Linux (SocketCAN).
Using opensource QT.io GUI you can easy analyze CAN bus.
www.rusoku.com/products

[sokoloff]

I have had great experiences with the PiCAN hat for an RPi. You could buy a dozen of those setups for $1000 and use those typically. Having the filtering and recording capability of the Linux subsystem is very helpful (arguably critical) in automotive CAN reverse engineering.

[Rerouter]

I should flag that a number of tools struggle depending on what you want to do, There is 11 bit can, mainly used in cars, there is 29 bit can mainly used in trucks, and there is now the new CANFD which most of the older tools do not like (newer protocol),

I mentioned the identifier lengths as some buses and trucks like to mix them for no good reason, and a number of tools don't like trancieving both standards at once.

This has resulting in us using an IAXXT and a USB based ELM327 device hooked up to a Y Splitter cable. so we know we can handle whatever it throws in most situations.

I do also have access to a vector (Ironically got from an Expo, its stupid money, but hey freebie), However its not that nice to drive as the others at least for me. you tell it to send a message once, it didn't see an ACK so sent it 22 times, fun stuff like that, that needs far more digging into the driver definition than I cared to.

[can2sky]

Hi to all!

There are many users who try to scan onboard CAN bus networks of cars with a help of CAN utils. Result of scan is raw test output. Someone who is experienced enough to recognize some CAN IDs in raw log but it is difficult to analyze anyway.
I've tried to make things easier with a cloud CAN bus decoder which can use raw output file.
It is completely free and you can use it here - can2sky.com

main idea:


some screenshots





You can upload your log and analyze data if service already has decoder for your vehicle. Some of parameters will be recognized, some not. Service has tools for manual decoding of parameters. Now we are working over sharing logs and decoders between users to establish collaborative decoding.

manual
https://drive.google.com/open?id=1ik4rbaMyAFXXszg3OeMeZ5QGxne66nFdd2u_GT8W8kE

I hope you will like it.
Regards, Andrew

[Gabri74]

Impressive work, thanks for sharing 

May I suggest you to open a dedicated thread? I think this project deserves its own thead!

[CalMachine]

I use a picoscope at work for decoding CAN.  It works decently well

Sometimes when an automobile manufacturer updates their CAN protocol with proprietary messages, this is what is used to sniff those new messages out.

[Miti]

Microchip has a CAN bus analyzer tool.

https://www.microchip.com/DevelopmentTools/ProductDetails/PartNO/APGDT002