CAN Bus
Differential two-wire vehicle and industrial bus. Frames are broadcast with no addressing and no authentication, so one tap reads and spoofs everything.
CAN (Controller Area Network) is a robust, differential two-wire bus where every node broadcasts message frames tagged with an arbitration ID. There is no source address, no destination, and no authentication: every node hears every frame and any node may transmit. A single tap therefore lets you read all traffic and inject your own.
What it is
CAN is a multi-master broadcast bus. Two wires, CAN_H and CAN_L, carry a differential signal that is highly noise-immune, which is why it survives in cars, trucks, industrial machinery, and robots. A frame is not addressed to a node; it carries an arbitration ID that identifies the message, and receivers filter for the IDs they care about. When two nodes transmit at once, the lower ID wins (dominant bits), a lossless priority scheme with no collisions lost.
| Field | Meaning |
|---|---|
| ID | 11-bit (standard) or 29-bit (extended) arbitration ID |
| DLC | data length, 0 to 8 bytes (classic CAN) |
| Data | the payload bytes |
| CRC | frame integrity check |
Physically, the bus is a single pair with a 120 ohm terminator at each physical end (not at your tap) to kill reflections. Common bit rates are 500 kbit/s (powertrain) and 250 or 125 kbit/s (body/comfort).
Why it matters
Because the bus has no notion of identity or trust, reading is trivial and spoofing is nearly as easy. On a vehicle, the OBD-II connector exposes one or more CAN buses directly. Map an ID to a physical action, unlock, dashboard gauge, throttle request, and you can replay or forge that action at will. Higher-layer diagnostic protocols such as UDS and ISO-TP ride on top of raw CAN and are where security services (seed/key, memory read/write, routine control) live.
How to work it
- Tap the bus with a
usb-can-adapter(CANtact, CANable, or a SocketCAN-capable device), or through the OBD-II port. - Bring up the SocketCAN interface at the correct bit rate:
sudo ip link set can0 up type can bitrate 500000
candump can0 # watch every frame on the bus
- Isolate the frame for an action by triggering it and diffing the capture:
candump -l can0 # log to a candump-<ts>.log file
# ... perform the action once ...
cansniffer can0 # highlights which bytes change live
- Replay or forge the identified frame:
cansend can0 123#DEADBEEF # ID 0x123, payload DE AD BE EF
canplayer -I candump-*.log # replay a captured session
- For diagnostics, drive UDS over ISO-TP with
caringcaribouorisotptools to brute the seed/key and reach memory read/write services.
Pitfalls
- Bit rate mismatch floods your interface with error frames and can disturb the bus. Confirm the rate before going active.
- Injecting badly can put an ECU into a fault state or set diagnostic trouble codes; on a real vehicle that can be unsafe. Work on a bench harness or a car you own and can recover.
- The 120 ohm terminators belong at the two ends of the bus. Adding your own terminator at a tap in the middle unbalances it.
- Extended (29-bit) and classic (11-bit) IDs coexist; tools must be told which you mean, and CAN-FD changes the frame format entirely.