CAN Traffic Analysis Reference

1. Investigation Overview & Defender Perspective Methodology

Modern commercial trucks rely on Controller Area Networks (CAN) and the SAE J1939 protocol family to interconnect distributed electronic control units. In this CTF track, you analyze vehicle network traffic and diagnostic exchanges from a fleet defender and forensic investigator perspective.

Throughout the challenge series, independent software instances that interface with the CAN bus are consistently designated as Controller Applications (CAs). A single physical Electronic Control Unit (ECU) may host multiple CAs, each possessing its own Source Address (SA) and unique 64-bit NAME.

2. SAE J1939 Protocol Essentials J1939

Commercial vehicle networks use 29-bit Extended CAN Identifiers structured according to the SAE J1939 specification:

+----------+-----+----+-----------------+-----------------+
| Priority | Res | DP | PGN (16 bits)   | Source Addr (8) |
| (3 bits) | (1) |(1) | PF (8) | PS (8) | (8 bits)        |
+----------+-----+----+--------+--------+-----------------+

• Parameter Group Number (PGN): A 24-bit value (composed of Data Page, PDU Format, and PDU Specific) defining the message function and payload structure.
• PDU1 (Destination-Directed): When PF < 240 (0xF0), the PS field designates the target Destination Address (DA).
• PDU2 (Broadcast): When PF >= 240, the message is broadcast to all nodes, and PS serves as an extended group extension.
• Request PGN (59904 / 0xEA00): Used to poll an ECU for a specific PGN (payload contains 3 bytes: target PGN in little-endian order). Global requests use DA 0xFF (e.g. CAN ID 0x18EAFFF1); unicast requests target a specific SA.
• Address Claimed (PGN 60928 / 0xEE00): Broadcast when a CA claims an address or responds to a Request for PGN 60928. The 8-byte payload contains the CA's globally unique 64-bit NAME (identifying Industry Group, Vehicle System, Function, and Manufacturer Code).

3. Diagnostic Services & Dual-CA Architecture Diagnostics

Heavy-duty vehicle networks employ standard diagnostic protocols for maintenance, flashing, and security access. Commercial vehicles and simulator targets frequently host multiple Controller Applications per physical ECU:

Key Diagnostic Service Identifiers:

• 0x10 — DiagnosticSessionControl (e.g. 0x85 for extended/programming session).
• 0x27 — SecurityAccess (odd subfunctions request seed, even subfunctions submit key).
• 0x3E — TesterPresent (maintains active diagnostic session; positive response echoes 0x7E).

4. Recommended Tooling & Defensive Safety Tooling

Select the appropriate software tool depending on your investigation stage:

• In-Browser Analysis: Use SloppyCAN for real-time visual inspection, ID monitoring, and J1939 frame decoding without installing local dependencies. It is suitable for exploring and learning about J1939 and the target simulated vehicle, but to get all the flags some scripting will be required.
• Scripting & Automation: Use python-can with the slcan interface connecting to the public simulation endpoint (e.g. socket://sim.fleetcyberchallenge.com:33939).
• Protocol Exploration: Use Scapy or TruckDevil for craft-and-send investigations and state-machine tracking.
• Offline Packet Analysis: Use Wireshark or tshark for analyzing provided .pcap artifact captures.

5. Quick Reference: Common Commercial Vehicle PGNs Reference