CAN BUS SNIFFING - The hardware & software you need
Since my knowledge of CAN networks is zero, everything is conjecture for me, and perhaps the use of Arduino causes me these doubts, but I don't think so.
So I come to the forum for feedback from the experts.
I put you in situation:
I analyze messages sent by vediamo, coding, for example, long messages that are decomposed into frames, but... the first bit has three digits, is this possible?
Ejemplo:
Message Trace Vediamo
15:32:04 Request:
22 02 07
15:32:04 IC_204:
62 02 07 00 CC 00 AE 00 8E 00 52 00 2A 00 14 00
00 03 84 06 A4 0D 48 10 68 12 8E 05 50 76 11 00
CC 00 B6 00 A2 00 76 00 4A 00 14 00 00 01 F4 03
E8 09 C4 0F 3C 15 7C 01 2C 07 D0 0F A0 17 70 1F
40 27 10 00 00 00 18 00 2F 00 47 00 5E 00 76 20
1E 12 57 08 56 3C 1E 19 14
message in arduino
ID: 60A, Data: 82 3E 0 0 0 0 0 0
ID: 481, Data: 82 7E 0 54 0 11 9 3
ID: 481, Data: 83 7F 22 78 0 11 9 3 request
ID: 481, Data: 810 59 62 2 7 0 CC 0
ID: 481, Data: 821 AE 0 8E 0 52 0 2A
ID: 481, Data: 822 0 14 0 0 3 84 6
ID: 481, Data: 823 A4 D 48 10 68 12 8E
ID: 481, Data: 824 5 50 76 11 0 CC 0
ID: 481, Data: 825 B6 0 A2 0 76 0 4A
ID: 481, Data: 826 0 14 0 0 1 F4 3
ID: 481, Data: 827 E8 9 C4 F 3C 15 7C
ID: 481, Data: 828 1 2C 7 D0 F A0 17
ID: 481, Data: 829 70 1F 40 27 10 0 0
ID: 481, Data: 82A 0 18 0 2F 0 47 0
ID: 481, Data: 82C 8 56 3C 1E 19 14 57
ID: 60A, Data: 82 3E 0 0 0 0 0 0 hasta aqui codigo
The captured bits are faithful to the source, so I don't think Arduino is playing tricks on me.
Can someone tell me this is normal and correct?
I don't see anything similar on the internet and I'm stuck in doubts that don't let me move forward with firm steps, because I can't do the next step, which is to replicate these messages.
Greetings
Last edited by bv9900; Jul 30, 2024 at 02:37 PM.




The issue at the binary level is you won't be able to deferenciate good from bad signaling.
The last copy of the IC I have doesn't match very closely, I've tinkered around quite a bit since then. I will have to make a new copy to study and confirm the theory, although I don't really want to go in there, it is very laborious.
Trying to send these messages should work.
What do I focus on?
study? send messages trying different things as if it were a donkey asking for food?
Its the data frames high load from my W212. Average 1,700ish data frames per second !!! Damn. 50MB of text file from 10 minutes logging and a bit more than 1 million total data frames captured....crazy !!!
I only have 47 modules, 37 of CAN BUS and 10 of LIN. I think some modules can generate more than 1 ID, I got total 107 ID ( devices ) broadcasting on the CAN E2.
I think also some ID are not from CAN E2 only, from other BUS, because there is a N93 gateway re-broadcasting them. I don't know, me CAN BUS stupid for now

Lowest priority at 107th, is ID 0x39F device ( I don't know what it is, that is a Hex ID ) and is transmitting only once per second. The 1,001 is millisecond, so that is 1 second. Device 107 total have broadcast out 306 times.
The above file is part 2 or 4 minutes worth of the total 10 minutes sniffing.
The log files I on purpose set it at 20MB size each, because 20MB for a TEXT file or CSV is already very big.
Highest priority ID is 0x003 in Hex, in decimal that means 3rd. The lower the Hex ID, the said device wins and gets to broadcast first. In CAN BUS the who gets first to talk mechanism is called arbitration.
The 107th ID is 0x39F in Hex and in decimal that is 927th.
https://www.kvaser.com/about-can/the...n%20idle%20bus.
So in just 4 minutes, ID 0x003 per 10millisecond broadcast, has broadcasted 30,128 data frames.
Near 10 minutes worth of sniffing, near 50MB log files in 3 splits, that is a lot. CL2000 is not only a live stream sniffer, it is also a smart Logger. I really like it.
These are the device ID and the messages for High Beam Toggle , permanent ON, stalk push forward) ...... and
Blip-Momentary ON, stalk push towards us the driver ...and
Low Beam
https://youtu.be/tkk8snrjT9A
Apology for the first 1 minute of the video, I was choked by the smell of Baygon insect spray I just sprayed because there was a cockroach.
.
This gentlemen has a good video showing on how he uses SavyCAN on a Land Rover. He is lucky his CAN BUS load is low, under 700 frames per second.
https://youtu.be/tyHpL1LmgWg
WILL CONTINUE.....................
The Best of Mercedes & AMG
First of all I wouldn't use notepad, canhacker or excel; not anymore

Savvy or Cangaroo is a free and good tool designed for exactly what you need. Excel is fine but only for playback data, not live.
Right now I use esp32 and savvy. Imo old espwroom32 is much better than stoneage unor3 with his all shields. There are many opensource projects like for arduino.
It allows read/write data with builtin wifi over lan or even internet. It's powerfull gpio device with internet connection if you want make your projects but it's other srory.
But you will need some coding knowledge; 10 minutes youtube solutions never work

If you're looking for a cheap, ready-to-use device, I've heard a lot good things about the Canable 2.0, a few dollars from myfriends, but I haven't tried it myself.
Modern models like 213 has canfd - one frame is sent with different speeds. MCP modules with arduino or even cl2000 can't read it, Canable2 apparently can do.
Back to your 212 CHASSIS2; signals under 45, 69 and 283 IDs from youtube
Also here are IDs you are curious about.
As you noticed single device may have many IDs according to the data inside. Lower ID - more important message and priority in transmit.
So first IDs are ezs/eis (usually 0), brakes, srs, gearbox, engine, sam etc.
One device may appear in several bus under the same ID, fox example 39F is cluster which appears in can-b, can-e and can-e2 and it has 3 CANs in wiring. Some data between different buses may be also exchanged thru ZGW.
I share you some dbc files for savvy and 212lift. In savvy go file/dbc file mnger and load filters appropriate for the tested bus.
Some random of my can-e logs from 212prelift below with dbc.





