When you click on links to various merchants on this site and make a purchase, this can result in this site earning a commission. Affiliate programs and affiliations include, but are not limited to, the eBay Partner Network.
CAN BUS SNIFFING - The hardware & software you need
Guys,
If you want to do as title said, I will show you where I made my mistake, so you dont have to do the same.
I am until now, still in a mission to want to install this AUX light, but I need to get the High Beam & better if Low Beam command too from my car CAN BUS system, channel CAN E2 to be precise.
During my first run to Bali, I realized I need much more powerful high beam and wider spread low/high beam for extra safety in the night when not in PAID highways and roads has tight curve ahead where steering wheel is still straight,
so my ILS LED 641 curve light is not in action yet. Or on roads where there is no lines on the side to show me from a distance the edges of the road.
Road like below in Bali is decent, because the white marker on the left still can up to a point showed the edges of the road.
However, if anyone cross the road which is very often and motorbike will cross the road like a walking pedestrian, the High Beam reach and brightness is poor, well 35 watts LED per side, too low a power.
Viofo A119 V3 until today is the best Low Light dashcam I have seen.
If similar road but the side is a padi field or dirt on a GoPro Hero5, you guys will freak out and thought my headlights are dead hahahah, see below :
I contacted 3 suppliers of CAN BUS Interface module which their device can extract the High Beam command from the CAN BUS and output simple relay signal for me to turn ON the AUX light.
I explained my model is already the ILS LED 641 and is facelift and has auto high beam 628+, because their device was designed for pre-facelift W212 simple Xenon or Halogen, I need to emphasize my headlight type.
This one seems popular, because Lazer uses this company's product as interface accesories : https://www.canm8.com/can-bus-interf...-highbeam.html
None replied to me. I emailed them twice !!
So it seems I need to learn more on CAN BUS and how to sniff the command.
I came across this nice guy Adam Varga utube channel and took me 2 days of migrain to simply follow his instructions on how to do it and he is so kind to MAKE the ready to use program too in his GitHub page. https://github.com/adamtheone/canDrive
**https://www.youtube.com/c/AdamVarga20/videos** remove the 2 + 2 asteriks
I wrote to him a thanks note on his part 3 video.
Thanks you x 3,000 Adam. A thousand each for part 1, 2 & 3
I am one VERY dumb guy when it comes to IT stuff, got migrain for 2 days trying to copy your device...LOL.
Anyhow, managed to get the CAN signals, but damn my car send out 106 messages simply from opening the door, without key in Ignition.
I am trying to trace the HIGH BEAM command and still unable to see the pattern on the signal yet. So many IDs are alive and changing even when high beam is OFF or ON.
Too many diagnostic signals I think each modules are sending. I wish it is as easy as how you find the buttons on your steering wheels.
After like 10 minutes sniffing, the sniffer slows down so much till keyboard respond lagging by 5 seconds or so.
I will keep on trying. Just drop by to say thank you once more. Great tutorial and kindness.
Kind Regards. SP
==================
I bought Arduino Uno and CanBus Shield V2 DF Robot and in fact a 16 Mhz one for the CAN BUS instead of 8Mhz Adam was using.
I bought genuine branded ones to reduce the risk of IT-Stupid-Me from failing to run Adam's program due to hardware quality problem.
I failed to sniff the command !!!
I did not give up yet.
I know now I have to get a more powerful sniffer unit and its software too.
The lowest cost PROPER and assumed Powerful enough unit is from CSS Electronics and the software SavyCAN is free , from a super nice guy called Collin Kidder. https://www.csselectronics.com/produ...terface-cl2000 << Their reviews from professional engineers/OEM are awesome. https://www.savvycan.com/
All the way from Denmark, approx 30% import duty.
Will continue...................
Last edited by S-Prihadi; 06-15-2022 at 09:48 PM.
Reason: typo
Finally, with a powerful hardware : the CL2000 and software SavyCAN, I know now why the DIY grade Arduino and Can Bus Shield v2 does not produce good enough result for me to detect the High Beam Command.
Its the data frames high load from my W212. Average 1,700ish data frames per second !!! Damn. 50MB of text file from 10 minutes logging and a bit more than 1 million total data frames captured....crazy !!!
I only have 47 modules, 37 of CAN BUS and 10 of LIN. I think some modules can generate more than 1 ID, I got total 107 ID ( devices ) broadcasting on the CAN E2.
I think also some ID are not from CAN E2 only, from other BUS, because there is a N93 gateway re-broadcasting them. I don't know, me CAN BUS stupid for now
Lowest priority at 107th, is ID 0x39F device ( I don't know what it is, that is a Hex ID ) and is transmitting only once per second. The 1,001 is millisecond, so that is 1 second. Device 107 total have broadcast out 306 times.
The above file is part 2 or 4 minutes worth of the total 10 minutes sniffing.
The log files I on purpose set it at 20MB size each, because 20MB for a TEXT file or CSV is already very big.
Highest priority ID is 0x003 in Hex, in decimal that means 3rd. The lower the Hex ID, the said device wins and gets to broadcast first. In CAN BUS the who gets first to talk mechanism is called arbitration.
The 107th ID is 0x39F in Hex and in decimal that is 927th. https://www.kvaser.com/about-can/the...n%20idle%20bus.
So in just 4 minutes, ID 0x003 per 10millisecond broadcast, has broadcasted 30,128 data frames.
Near 10 minutes worth of sniffing, near 50MB log files in 3 splits, that is a lot. CL2000 is not only a live stream sniffer, it is also a smart Logger. I really like it.
These are the device ID and the messages for High Beam Toggle , permanent ON, stalk push forward) ...... and
Blip-Momentary ON, stalk push towards us the driver ...and
Low Beam
Option 1 :
I will contact this company, https://www.canm8.com/can-bus-interf...-highbeam.html
I will tell them I have the messages to make their device works on my car. If they are willing to program their module, its all and good, I shall buy ready to use unit.
When either one of the 2 is a success and passed my test, only then I will order the Lazer Linear 18 i-LBA SMART version.
This will still be a long process and a fun one too
If anyone wants to SNIFF the CAN BUS and your knowlegde is as poor as mine, here are some things I learnt :
01. Do not Sniff from the OBD2 port unless your device can do a "request". I do not know what is the request but the N93 gateway is guarding the OBD2 data channel.
So if you want only the standard OBD2 data, it is easy, get those OBD2 gauges and set your sniffer to SILENT/LISTEN ONLY MODE, you will get OBD2 data when your gauges are connected to OBD2 port
because OBD2 gauge will do the data "request".
If you want MB CAN-BUS messages at OBD2 port, I need my Autel to be hooked up and let it be in diagnostic mode, standy-by but already sending the proper propietary MB "request".
Easiest is to tap direct at the CAN High and Low wires at device you want to target, like I did with the headlight as that is not protected and messages will start flowing as soon as you play with the lights.
No need my Autel to do any data "request".
The messages I got from ID45 is I am sure is generated by the N80 steering column, High Beam stalk/stick unit. This is why I said I am getting other CAN channels data via the N93 gateway most likely,
as channel CAN E2 is not where N80 is at. N80 is at CAN E1 and the headlight is at CAN E2.
The command for Momentary-ON or Toggle Permanent-ON is not a locked/latching command ( I hope I use the correct term ), but is repeated per every 100 millisecond for as long as the light is ON.
Before seeing this, I was wondering about how CAN-BUS command actually works for a headlight. Latching or not ?
In analog 12V DC, we maintain a non-stop 12V DC to a common mechanical relay. So this seems to be the same, but just that it is 10 times of ON-ON-ON-ON per 1 second compared to full time 12V DC.
Certain Solid State Relays are latching type, so only 1 time to signal ON/Close and 1 time to signal OFF/Open.
Do note, 12V Power to headlights for my car is Circuit 30, so it is always HOT, power available always......unless battery disconnected.
I did another video logging to see the per100 milliseconds High Beam command repetetion for High Beam activation to be sure.
This is easier view for seeing the High Beam Stalk mechanical action vs Instrument Cluster indication for High Beam and the headlight high beam itself.....
Actually the SavyCAN csv saved file if we want to collect/analyze single device to see the time stamp of the commands repetition, its data started at D1 = Data 1, so ending is Data 8.
The software itself when sniffing, the data 1 is called DATA Zero, so ends at Data 7.
I did another video logging to see the per100 milliseconds High Beam command repetetion for High Beam activation to be sure.
This is easier view for seeing the High Beam Stalk mechanical action vs Instrument Cluster indication for High Beam and the headlight high beam itself.....
Actually the SavyCAN csv saved file if we want to collect/analyze single device to see the time stamp of the commands repetition, its data started at D1 = Data 1, so ending is Data 8.
The software itself when sniffing, the data 1 is called DATA Zero, so ends at Data 7.
.
Hi Sir,
Thank you for the great experiments. It is helpful for those who are trying to sniff the traffic of can bus.
My car is E300 2018, should be w213. As you did, now I am trying to sniff and control the unit by can bus B. As you mentioned, the can bus D on OBD2 is not helpful. I was able to sniff the messages from ODB2 using ESP32 TWAI interface. But It is only for diagnostic and SOS purpose.
Most units are controlled by can bus B. Now I am stuck how to locate the wires if can bus B? Someone says it is beneath the front passenger seat, others say it under the driver and front passenger mat.
Could you share how did you connect to the can bus B? Did you remove the carpet or other easier wires to connect to?
Now back to your needs.
Let me know which module you want to sniff on the assumed CAN B you speak of and what command you are looking at ?
I will try to get the wiring diagram for you. I never even take a peek at W213 CAN BUS wiring diagram ever , since I dont have the car.
While at it, print a Data Card using your car VIN so that I know what are your car option levels, this will help in sourcing the proper wiring diagram for your specific option/hardware.
If you really want to good deep, go to Ebay and buy the knock-off WIS/EPC 2020 or newer under US$20 I think. This is the same software as what I would help you with for wiring diagram source.
Without WIS/EPC, you go blind and waste energy and time.
Thank you for the reply. I am going to sniff the can bus traffics for the purpose of controlling the Radio, Navigation, Media, Climates, also the adjustable seats. I would say any modules controlled by CAN bus B I like to sniff
Ideally, after the traffics sniffed, I am able to simulate the identical traffic using ESP32 or any other CAN bus modules from mobile phone or computer (I am a software developer).
I appreciate if you can print the diagram for my VINI am going to let you know the VIN with a better way but not just paste here.
I do not know the performance of ESP32 in terms of data capture and how good is the software you use.
I do worry if you may get problem like I did when I used that Arduino based sniffer due to probably lack of power and the software is not as good as the one from CSS https://www.csselectronics.com/pages...rface-savvycan
However I read that ESP32 is decently powerful hardware wise and I hope the software you use is also as good as SavyCAN.
I was sniffing CAN E2 not CAN B and I sniffed it directly at the headlight connector as you can see. So no need to remove carpet to find the CAN BUS distribution blocks which if W212 is located at left and right near door under carpet, depending
on which CAN BUS channels.
Attached what you need to access CAN B
Use your DATA CARD to note down what your car does not have as options when looking at X30/32 CAN BUS distributor block, or mark what your car has, so you do not get confused.
Good luck
ADD : Now go and buy the EPC/WIS 2022 at Ebay and have a full blast
Thank you SP. I am using ESP32 and a very nice utility shared by Adam Varga (https://github.com/adamtheone/canDrive). I successfully sniffed the traffics of CAN bus D via OBD2. So in theory, if the can-h and can-l of ESP32 connect to the CAN bus B, it should be working either.
But I am stuck on how to identify the location of CAN bus B. It says the carpet should be removed to reveal the CAN bus B hub. This is not friendly for me, I am not ready to change a new car
I used Adam's software too , if you read this post thoroughly. It is lagy and will hang if the data volume is like our car.
I can't read properly the changes when I do the command.... using his software, but I was using Arduino which is weaker processor wise compared to ESP32.
Here is the other CAN BUS B distributor block X330/33 location
Thank you for the update, SP. Instructed by your PDFs, I am going to remove the carpet tomorrow. Hopefully, the engine still can be ignited after the removal.
The CAN bus distribution bars are located near the front door thresholds on both sides. You'll want to pop the plastic covers without braking too many of the skinny tabs (hello epoxy glue!).
CAN-B is the brown-red twisted pair, it serves all the accessories ie. 3/4 of the modules rely on that same bus for commands. Naturally it's the one that is able to deliver chaos performce and proper sleepless battery drains.
As mentioned above by Master Surya, power hungry modules are supplied non-stop over circuit-30 and controlled on/off through the bus. When commands fail to reach, modules stay ON and battery goes flat.
What causes CAN-B disruptions....
Any one member of this busy network can screw it up. This is what brought me to this sniffing thread! I was interested about a decision-tree to diagnose CAN-B partial failure.
Local example of distributed pathways: Bora Bora Intercontinental
Signal analyzer :Whoever comes up with a idiot-proof tool to pass/fail CAN-B issues will make a mint with Bosch CAN architecture.
Right now it's good-luck based oscilloscope wizardry to figure what bumper module is putting statics over the wire: ridiculous!
It's not just premium MBenz, I've been on professional tour coatches in Palm Springs, CA. that had to be restarted regularly to get the tach and 8 wheels TPMS to work temporarily.... ridiculous extraction scheme!
Jin,
Are you able to find the message you are looking for ?
Hi Master SP,
Thank you for the following up, and I am sorry to respond you late because i am tackling with my dissertation.
Quick answer to your question, yes, but not totally. I went to the unofficial vehicle maintenance store on March 3rd, and asked the mechanic to plug 2
pairs of CAN buses in the outlets , one was connected to X30/20, another one was connected to X30/33. Thanks to your diagram of CAN bus schematic. Please see the captures attached.
After the wires equipped, i was able to sniff the CAN bus B X30/20 on my car. I dumped the traffics during i open/close the windows for one time. Supposedly, there should be some frames generated. See the capture below,
I sorted the frames by count by ascending order. The occurrence of first row with Message ID 500 is 1 time, and number of occurrences of second row with Message ID 451 is 2 times. They are supposed to be the window open/close directives.(I also tried other messages in top 5 rows, but no avail)
But when I was trying to replay (Send) the identical messages to the CAN bus, the window did NOTHING! There are 2 possible reasons for this phenomenon,
1. The Message ID is not valid for window open/close.
2. I guess, besides the primitive messages on wire frames, there should be an application layer protocol, just like the network handshake. That means when a bilateral connection is established, there could be couple of frames back and forth between 2 peers (CAN bus modules), even though the CAN bus is working with broadcast mode. From the perspective of application layer, this is possible, and it makes the CAN bus work more modern. But this is only my assumption.
For possible reason 1, if I have a list (CAN bus database) of codes for the CAN bus commands, it lists the Message ID and the function/operation relates to the ID. If I have the database, I will be able to go further!
For possible reason 2, if have the specification of application layer protocol, i will be able to go further!
To connect to X30/20, the bit baud (speed) is set to 250kbps. I also tried couple of bit bauds on X30/33, none of them worked for me. I am not sure what the evil inside.
Any ideas Master SP?. I will not give it up until it works for us.
On the CAN BUS protocol, me can't help you . me IT Dummy.
But I do not think a command to close or open a window is a 1 time command only as though as a "latching mechanical relay". Are you using the auto open/close the one touch close and open or you do it manually ?
Example my headlight high beam, it is 10 times a second as ON or 100 millisecond per command, same command. This way it is safe, as this is not a "latching" command but a repetitive one ....equal to ON all the time.
Window closing can harm people by accident ( but our window has safety feature), I believe the command will be as fast 5 times a second, I think.
Our window when you give it high friction/load, it will stop moving, safety reason ....just in case a child hand got caught at the glass window going up.
My CLS2000 sniffer is all auto, no need to adjust baud rate, that is why I like it so much, for someone as IT dummy as me ... LOL
X30/33 CAN B - INTERIOR, the document stated 250 kB/sec.
Did the workshop wired wrong ? Maybe CAN H and L swapped ? Have you tried to swap your connection ?
Also maybe bad contact at one of the sniffer wire connected to the distribution block ?
First, I would like to thank you for the very interesting job, and I hope to succeed in achieving my goals as you have.
I have recently begun learning about the CAN BUS system, and I have a Mercedes Benz Actros truck that operates at 24V. I am interested in testing CAN-controlled parts like an Electric AC compressor on my workbench. By sniffing the on/off signal when it works in the truck then transmitting it again after repair without having to reinstall it in the truck
I purchased several CAN interfaces to try to complete this task, compare them, and select the best one later: 1. CAN/LIN CANHACKER device2. UCAN3. Chinese device have CAN/LIN interface4. CAN Bus Data Logger Viewer + Sniffer for use with Arduino Raspberry CANalyst CANOpen from eBay
Here is the link for the truck electronic manual I mentioned in this post.
I read somewhere that as long as the truck has a gateway, it is difficult to sniff through the OBDII port. Is this correct?
Therefore, I need help to determine the appropriate location to connect my sniffer CANH/CANL
The question seems a bit naive: Can I directly connect the sniffer's CANH and CANL wires to the socket of the part that I want to test, especially since I know the CANH and CANL wires in the socket?
Is there a device that can connect to a truck's OBDII port to request a diagnosis and simultaneously sniff the CANH CANL signal from the same port?
Has anyone tried using canhacker with arduino and mcp2515?
with skecth to capture in serial it captures well,
but canhacker crashes with less than 5 frames.
My mission is to sniff ECU, which works at 500 so a clock of 8000 is enough I think.
The number of frames per second is incredible, it is impossible to handle so much information without help programs.
Direct connection to the ECU canhacker already blocks me.
some help? or is this hardware impossible?
the work you do is fantastic
Has anyone tried using canhacker with arduino and mcp2515?
with skecth to capture in serial it captures well,
but canhacker crashes with less than 5 frames.
My mission is to sniff ECU, which works at 500 so a clock of 8000 is enough I think.
The number of frames per second is incredible, it is impossible to handle so much information without help programs.
Direct connection to the ECU canhacker already blocks me.
some help? or is this hardware impossible?
the work you do is fantastic
Get the CL2000 and start from there. Stop using toys from Arduino, like I did. Get a proper tool.
I'm sure it's a good machine, but it's out of my expectation.
At the moment I continue with Arduino scanning in serial.
I think I learned these days that Arduino is far from having enough processor for these networks.
However, I prefer to have a few more headaches, and continue learning without progress.
My idea is to capture a message that Vediamo sends to ecu, and reproduce it, but that will probably be of no use and it will be difficult for me to learn it, I'm a bit of an ***.
Anyway, thank you for your advice, I have no doubt that these are the correct steps to follow.
06-15-2022, 11:43 AM
I am going to let you know the VIN with a better way but not just paste here.
