CAN Bus (Controller Area Network)

What is CAN?

CAN is a multi-master broadcast bus. Each frame carries an identifier, a data length code (DLC), up to 8 data bytes on classic CAN, a 15-bit CRC and an acknowledge slot. The identifier names the content and sets the priority, not the sender: when two nodes start at the same time, the one with the lower identifier wins arbitration because a dominant 0 bit overwrites a recessive 1.

In candump notation a UDS request to an engine ECU looks like 7E0#0322F19055555555: identifier 0x7E0, eight bytes, of which 03 22 F1 90 is the ISO-TP single frame with ReadDataByIdentifier for the VIN.

Where is it defined?

ISO 11898-1 defines the data link layer and physical signalling, including the frame formats, arbitration, bit timing and fault confinement; ISO 11898-2 defines the high-speed physical layer. The current ISO 11898-1:2015 also covers CAN FD. Diagnostics on top of CAN use ISO 15765-2 (ISO-TP) as transport and ISO 14229 (UDS) as application layer.

What it means in practice

Whoever is on the bus can send anything. A device on the OBD port, a compromised telematics unit or a tester on a bench can transmit frames with any identifier, and the receivers cannot tell who sent them. CAN also has fault confinement: a node that sees too many transmit errors goes error passive and finally bus-off, which an attacker can provoke on purpose to silence a node.

On the bench this shows up as ECUs that act on any frame with the right identifier, diagnostic identifiers that answer from every bus segment because the gateway forwards them, and ECUs that misbehave when a message arrives with an unexpected DLC or out-of-range signal values. A wrong bitrate or sample point is the most common setup error: the bench fills with error frames and the ECU never answers.

How AutoST tests it

AutoST talks to CAN through SocketCAN adapters on Linux, for example PEAK or Kvaser, and Vector hardware on Windows through the XL driver library, with configurable bitrate and sample point. UDS runs over ISO-TP on CAN. The CAN fuzzing engine sends random classic and FD frames on arbitration identifiers taken from your DBC, with a seed for exact replay, and flags an ECU that stops answering TesterPresent or changes its DTC count.

Common misunderstandings

A CAN identifier is not a sender address and proves nothing about origin. Gateways reduce exposure but are not authentication. And CAN is not obsolete: CAN FD extends it, and most diagnostic access to ECUs still starts on a CAN bus.