can-utils
Linux SocketCAN command-line toolkit: bring up an interface, sniff, dump, replay, and inject CAN bus frames against ECUs and industrial gear.
can-utils is the Linux SocketCAN command-line toolkit for working with CAN bus, the two-wire network behind almost every modern vehicle and a great deal of industrial machinery. It turns a CAN interface into something you can sniff, log, replay, and inject onto with a handful of small, composable commands, the tcpdump/netcat of the automotive world.
What it is
SocketCAN is the Linux kernel's CAN networking stack: it presents a CAN adapter as a network interface (can0, or a virtual vcan0) that you configure with ip link. can-utils is the userspace toolkit on top of it. Each tool does one job: candump prints frames, cansniffer highlights changing bytes, cansend transmits one frame, canplayer replays a log, cangen floods random traffic. Because CAN is a broadcast bus with no source addressing, every tool sees every frame, and any frame you send is seen by every node.
Why it matters
A vehicle's ECUs, its dashboard, door controllers, and engine management, coordinate over CAN with no authentication. If you can reach the bus (an OBD-II port, a spliced pair, a bench harness), you can observe the messages that carry speed, RPM, lock state, and warning lamps, then transmit your own frames to actuate the same functions. The workflow is always the same: capture, find the id that controls a function, then replay or craft that id to reproduce the effect. can-utils is how you do every step of that from a laptop.
How to use it
sudo ip link set can0 up type can bitrate 500000 # bring up the interface at 500 kbit/s
candump can0 # print every frame live
candump -l can0 # log to candump-<timestamp>.log
cansniffer -c can0 # colourise only the bytes that change
cansend can0 123#DEADBEEF # send id 0x123, payload DE AD BE EF
canplayer -I candump-*.log # replay a captured log 1:1
cansniffer is the fastest way to map the bus: wiggle a physical control (a window switch, the brake) and watch which id's bytes move. Once you know the id, cansend reproduces it, and canplayer replays a whole captured sequence with original timing. To rehearse safely, create a virtual bus with modprobe vcan; ip link add vcan0 type vcan; ip link set vcan0 up and run the exact same commands against vcan0.
Pitfalls
- The bitrate must match the bus exactly or you see only error frames; 500k and 250k are the common automotive rates, try both.
- CAN needs 120 ohm termination at each physical end. Tapping a bench harness without correct termination gives reflections and bus-off errors.
- Injecting on a live vehicle bus can flood arbitration and set fault codes or trigger limp mode. Understand what an id does before you flood it, and prefer a bench ECU for experiments.
- A frame you send competes for arbitration; a lower id number wins the bus. High-priority safety traffic can starve your injection.
What it pairs with
A usb-can-adapter (or a native SocketCAN interface) is the hardware that puts you on the bus. Higher-level UDS/ISO-TP diagnostics ride on top of raw CAN, so pair can-utils with an ISO-TP tool (isotpsend/isotprecv, shipped in can-utils) for multi-frame diagnostic sessions. For a portable, backend-agnostic take on the same send/dump verbs, probe's can medium runs the identical operations against a virtual lab target or real socketcan.