Cansniffer, Wireshark, etc for Can Mapping

boggie1688 · Post by **boggie1688** » Sun Apr 09, 2017 3:25 pm

After digging deeper into RCP I can 'tseem to find much info around can sniffing. Although RCP provides a simple can sniffer, it is too simple.

There are some of the shelf programs, that are free, the have filtering capabilities when watching the can bus. Instead of displaying every packet sent, they can filter the packets down to only those IDs that have changing bits.

This makes can sniffing so much easier.

The wiki suggest hyperterminal and some others, but using this ots software would be simpler. I don't have my RCP yet, but has anyone tried using Wireshark or cansniffer? Although the RCP is sold as a dataloggers, it has all the abilities of can sniffer hardware. If there are more.robust tools available for sniffing and mapping I'd imagine the community would grow and adoption would go up.

So what tools are you using to sniffer smarter?

GTIspirit · Post by **GTIspirit** » Mon Apr 10, 2017 11:07 pm

I've heard of it but haven't actually used ETA Busmaster
https://rbei-etas.github.io/busmaster/

Supported hardware
https://github.com/rbei-etas/busmaster/ ... re-support

boggie1688 · Post by **boggie1688** » Mon Apr 10, 2017 11:36 pm

This looks very powerful. Maybe overkill, but the more tools the better.

You linked the supported device page, but I don't see RCP. I assume you are referring to a microcontroller inside the RCP3? Do you know what the model is?

My other issue right now is how easily it is to get something like wireshark to datalog from the RCP3. I can't confirm until the RCP3 is delivered.

GTIspirit · Post by **GTIspirit** » Tue Apr 11, 2017 1:33 am

ETAS Busmaster is the software tool, supports many 3rd party hardware interfaces which are commonly used in the industry. Sorry Brent, RCP isn't quite up there with ETAS tools, yet

Actually, we don't want that because those blue boxes are not affordable for private use.....

Some of those 3rd party CAN interface tools are around $300. Which is a lot compared to RCP, but cheap compared to Vector or other industry tools.

I'm curious if Busmaster works with the Ross-Tech (VCDS) tools. I have my suspicions that the VCDS tool is something like IME Actia or others. USB CAN dongles are pretty ubiquitous and a lot support standard J2534 pass-thru interface so I wouldn't be surprised if more work with Busmaster than are listed.

boggie1688 · Post by **boggie1688** » Tue Apr 11, 2017 2:27 am

My short list of tools:

http://www.cananalyser.co.uk/candoapp.html

https://github.com/linklayer/cantact-app/releases

And Wireshark

Let's see which of these can actual communicate with the rcp3

Post by **brentp** » Wed Apr 12, 2017 4:38 pm

You could probably get RCP's CAN sniffing data into wireshark through a couple of steps:

* modify the script to make something easy to parse, like a JSON message
* pass that through a script that can make something compatible with the wireshark format
* load it in wireshark

If you have the ability / inclination it could be a pretty quick project.

boggie1688 · Post by **boggie1688** » Wed Apr 12, 2017 5:24 pm

Ability...

Inclination....

I'd like to have the data in realtime. I'm not 100% sure what I'm doing, but I'll get there. Hopefully.

It sounds like the RCP3 is just sending the raw data over USB and the software is decoding it on the fly. Which is great!

I've already setup my Wireshark with USBPCAP, and can log data over any of my usb ports. Wireshark already has a CAN dissector built in. So if my guess is right, I can plug the RCP3 into my laptop, turn on wireshire, select the appropriate USB port, begin logging, and apply the CAN dissector.

Fingers crossed it is that easy!!!!

Post by **brentp** » Wed Apr 12, 2017 5:33 pm

Well, no. unfortunately it's not like that.

If you enable the CAN bus logger script on RCP, and then connect to RCP's USB serial port using a terminal program, and then issue the 'viewLog' command, you'll see the dump coming from RCP's Lua script.

But it won't be in wireshark format. This output will need to be converted to a format Wireshark can understand, first.

It's all possible with enough time / effort

boggie1688 · Post by **boggie1688** » Wed Apr 12, 2017 5:41 pm

Gotcha. I didn't realize the script had to be running first before using terminal to dump the the info.

Before I speculate a storm, I'll wait for my RCP3.

MrBlahh · Post by **MrBlahh** » Thu Apr 13, 2017 12:44 am

cant you just DIY it with an arduino + canbus shield ?

boggie1688 · Post by **boggie1688** » Thu Apr 13, 2017 4:31 pm

Yes, I could and it would be an easier route considering my weak programming skills.

Time is on my side, and I'll play around this weekend and report back.