CAN Interface - Live Stream CAN Bus & OBD2 Data [Wireshark]

The Wireshark plugin lets you real-time convert your raw CAN data using your own DBC files (incl. J1939 DBC file support). This is a powerful feature as you'll be able to analyse/plot physical values from e.g. your car, truck, tractor or machine in real-time. For more, see the guide to Wireshark DBC conversion.

For reverse engineering and car hacking, the Wireshark plugin enables the powerful 'CAN Live' trace view. This shows a single row for each CAN ID and colorizes changes in the data bytes of each ID in real-time. It provides an excellent tool for linking CAN IDs to physical events - and identifying bit/byte positions of proprietary CAN bus signals. For more, see the CAN bus sniffing intro.

You can easily adapt Wireshark's column structure. To remove a column, just right-click and click "Remove Columns". To add a data field as a column, right click it in the details pane and choose "Apply as Column".

This is particularly useful for adding columns with OBD2/DBC physical values, min, max, names etc. You can rename the columns "Column Preferences".

To graphically plot converted OBD2 data in real-time, OBD2-decode your data and go to 'Statistics/IO Graph'. Here you can add up to 5 graphs. First, enable 'View as time of day' under X-axis. Under Y-axis, set the Unit to "Advanced...". In the Calc field, choose AVG(*) and in the field to the right write "obd-ii.mode01_" - doing so opens a drop-down from which you can choose various Mode 01 parameters. Once you've selected one, hit "Graph" to plot it. This also works with e.g. J1939 DBC files, where you can plot converted CAN bus signals in real-time.

You can also easily add conditional formatting. For example, if you need to quickly spot the occurrence of a particular CAN message or physical value in your stream, colorization is extremely powerful. By right-clicking a field in the middle part of the window you can e.g. color all occurrences red where a specific CAN message contains a specific range of data bytes. In the OBD2 context you can e.g. color Vehicle Speed yellow when the 'Converted value' goes above 50 km/h and red when above 60 km/h (cf. the figure).

Filters let you truly gain control over your data flows. To add filters, the fastest way is to right-click a data field in the details pane and select 'Apply as Filter'. This will update the upper left text field and you can now edit the details to fit your needs.

Say you're streaming both the OBD2 "requests" (ID 7DF) and "responses" (ID 7E8) and want to look only at the latter? Simply write "can.id == 0x000007e8" in the filter. It'll turn green to show that it's valid and you can click enter - voila! Using the "Expression…" button, you can also build far more advanced filters using various relational operators.

Wireshark lets you easily save your stream session data in various custom formats (incl. *.CSV, *.TXT, *.JSON, *.PCAP, *.C, *.PS and more). Further, you can apply filters to your data and only save the visible selection.

With the plugin, you can load CLX000 log files that you've e.g. recorded in standalone mode (i.e. without a PC). This lets you use all the Wireshark features on your CLX000 log files, incl. OBD2/DBC conversion. It's also very useful in combination with the ability to export to custom formats.