Page 1 of 1

Cansniffer, Wireshark, etc for Can Mapping

Posted: Sun Apr 09, 2017 3:25 pm
by boggie1688
After digging deeper into RCP I can 'tseem to find much info around can sniffing. Although RCP provides a simple can sniffer, it is too simple.

There are some of the shelf programs, that are free, the have filtering capabilities when watching the can bus. Instead of displaying every packet sent, they can filter the packets down to only those IDs that have changing bits.

This makes can sniffing so much easier.

The wiki suggest hyperterminal and some others, but using this ots software would be simpler. I don't have my RCP yet, but has anyone tried using Wireshark or cansniffer? Although the RCP is sold as a dataloggers, it has all the abilities of can sniffer hardware. If there are more.robust tools available for sniffing and mapping I'd imagine the community would grow and adoption would go up.

So what tools are you using to sniffer smarter?

Posted: Mon Apr 10, 2017 11:07 pm
by GTIspirit
I've heard of it but haven't actually used ETA Busmaster
https://rbei-etas.github.io/busmaster/

Supported hardware
https://github.com/rbei-etas/busmaster/ ... re-support

Posted: Mon Apr 10, 2017 11:36 pm
by boggie1688
This looks very powerful. Maybe overkill, but the more tools the better.

You linked the supported device page, but I don't see RCP. I assume you are referring to a microcontroller inside the RCP3? Do you know what the model is?

My other issue right now is how easily it is to get something like wireshark to datalog from the RCP3. I can't confirm until the RCP3 is delivered.

Posted: Tue Apr 11, 2017 1:33 am
by GTIspirit
ETAS Busmaster is the software tool, supports many 3rd party hardware interfaces which are commonly used in the industry. Sorry Brent, RCP isn't quite up there with ETAS tools, yet :lol: Actually, we don't want that because those blue boxes are not affordable for private use.....

Some of those 3rd party CAN interface tools are around $300. Which is a lot compared to RCP, but cheap compared to Vector or other industry tools.

I'm curious if Busmaster works with the Ross-Tech (VCDS) tools. I have my suspicions that the VCDS tool is something like IME Actia or others. USB CAN dongles are pretty ubiquitous and a lot support standard J2534 pass-thru interface so I wouldn't be surprised if more work with Busmaster than are listed.

Posted: Tue Apr 11, 2017 2:27 am
by boggie1688
My short list of tools:

http://www.cananalyser.co.uk/candoapp.html

https://github.com/linklayer/cantact-app/releases

And Wireshark

Let's see which of these can actual communicate with the rcp3

Posted: Wed Apr 12, 2017 4:38 pm
by brentp
You could probably get RCP's CAN sniffing data into wireshark through a couple of steps:

* modify the script to make something easy to parse, like a JSON message
* pass that through a script that can make something compatible with the wireshark format
* load it in wireshark

If you have the ability / inclination it could be a pretty quick project. :)

Posted: Wed Apr 12, 2017 5:24 pm
by boggie1688
Ability... :roll:

Inclination.... :wink:

I'd like to have the data in realtime. I'm not 100% sure what I'm doing, but I'll get there. Hopefully.

It sounds like the RCP3 is just sending the raw data over USB and the software is decoding it on the fly. Which is great!

I've already setup my Wireshark with USBPCAP, and can log data over any of my usb ports. Wireshark already has a CAN dissector built in. So if my guess is right, I can plug the RCP3 into my laptop, turn on wireshire, select the appropriate USB port, begin logging, and apply the CAN dissector.

Fingers crossed it is that easy!!!!

Posted: Wed Apr 12, 2017 5:33 pm
by brentp
Well, no. unfortunately it's not like that.

If you enable the CAN bus logger script on RCP, and then connect to RCP's USB serial port using a terminal program, and then issue the 'viewLog' command, you'll see the dump coming from RCP's Lua script.

But it won't be in wireshark format. This output will need to be converted to a format Wireshark can understand, first.

It's all possible with enough time / effort :)

Posted: Wed Apr 12, 2017 5:41 pm
by boggie1688
Gotcha. I didn't realize the script had to be running first before using terminal to dump the the info.

Before I speculate a storm, I'll wait for my RCP3.

Posted: Thu Apr 13, 2017 12:44 am
by MrBlahh
cant you just DIY it with an arduino + canbus shield ?

Posted: Thu Apr 13, 2017 4:31 pm
by boggie1688
Yes, I could and it would be an easier route considering my weak programming skills.

Time is on my side, and I'll play around this weekend and report back.