1. What it is
The CAN Analyzer is a two-part tool:
- The analyzer — an ESP32 board wired to a CAN transceiver. It sits on your CAN bus, and creates its own Wi-Fi hotspot.
- The software — a desktop application that joins that hotspot and shows you the traffic.
There is no USB cable between them. The analyzer is powered independently and everything travels over Wi-Fi, so the PC can sit several metres away from the vehicle or test rig.
The analyzer can also log to a microSD card entirely on its own, with no PC present at all.
What you can do with it
| Watch | Every frame on the bus, live, with timestamps |
| Record | To a CSV file on the PC, to a microSD card on the analyzer, or both |
| Transmit | Single frames, repeating frames, or automatic replies to specific IDs |
| Decode | Raw bytes into named signals with engineering units, using a DBC file |
| Filter | Narrow the traffic down to the IDs you care about |
2. Installing the software
You do not need Python or any other software installed. Everything is included.
Windows
- Download
CANAnalyzer.exeand copy it anywhere you like — your Desktop, or a folder such asC:\Tools\CANAnalyzer. - Double-click it.
That is the whole installation. It is a single self-contained file: no installer, no Python, nothing added to your system. To remove it, delete the file.
The first launch takes a few seconds longer than later ones while the program unpacks itself into a temporary folder.
If Windows shows a blue "Windows protected your PC" banner, click More info → Run anyway. This appears because the software is not code-signed, not because anything is wrong with it.
Linux
- Download the
CANAnalyzerfile to your machine. -
Make it executable and run it:
chmod +x CANAnalyzer ./CANAnalyzer
If it refuses to start and mentions a missing library, install the standard Qt runtime packages:
sudo apt install libgl1 libegl1 libxkbcommon-x11-0 libxcb-cursor0 \
libxcb-icccm4 libxcb-keysyms1 libxcb-shape0 libdbus-1-3
3. Connecting to the analyzer
Step 1 — Power the analyzer
Connect the analyzer to power and to your CAN bus. After a few seconds it starts broadcasting its Wi-Fi network.
Step 2 — Join its Wi-Fi network
On your PC, open the Wi-Fi list and connect to:
CAN Analyzer - Wireless
There is no password.
Windows will report "No internet" — that is expected and correct. The network exists only to reach the analyzer.
Note: while connected to this network your PC has no internet access. If you need both at once, use a second adapter (for example a USB Wi-Fi dongle for the analyzer, and your normal Wi-Fi for internet).
Step 3 — Start the software
Launch the application. Within a second or two the analyzer appears in the Device list at the top-left, and the software connects to it on its own:
Device: ● CAN Analyzer - Wireless [CAN RUNNING] Online
- A green ● means the analyzer is present and broadcasting.
- A grey ○ means it was seen recently but has now gone quiet.
- Online / Offline on the right shows whether the data link is up.
That is all. Auto-connect is ticked by default, so it will also reconnect by itself if the link drops or the analyzer is restarted.
If the analyzer does not appear
- Confirm your PC really is on the
CAN Analyzer - Wirelessnetwork — Windows sometimes hops back to your usual network because this one has no internet. - Press Rescan.
- If it still does not show, go to Config Panel → Wireless Link, type
192.168.4.1:3333into Address, and press Connect to Address.
Disconnecting
Press Disconnect. This also unticks Auto-connect, so the software will not immediately reconnect. Tick it again when you want automatic connection back.
4. The main window
The window has three tabs along the top:
| Tab | Purpose |
|---|---|
| Home | Live traffic list, plus the Config and TX panels |
| AT Control Panel | Direct command access and a communication log |
| DBC Live | Decoded signal values |
The Home tab is split: the traffic list fills the left, and a two-tab panel sits on the right holding Config Panel and TX Panel.
The toolbar across the top carries the device selection, connection buttons, the link indicator, and the Theme button, which switches between light and dark.
5. Watching traffic
Everything the analyzer receives appears in the table on the Home tab.
| Column | Meaning |
|---|---|
| Timestamp | When the PC received the frame, to the millisecond |
| DIR | RX = received from the bus · TX = sent by you |
| ID | CAN identifier in hex (3 digits standard, 8 digits extended) |
| IDE | STD = 11-bit · EXT = 29-bit |
| Type | DATA = carries payload · REMOTE = remote request |
| DLC | Number of data bytes, 0 to 8 |
| Data | The payload bytes in hex |
Controls above the table
- Table size (1000–5000) — how many rows are kept. When full, the oldest rows drop off the top. This affects display only; recording is unaffected.
- Display RX only — hides your own transmissions so you see only bus traffic.
- Autoscroll — keeps the newest row in view. Untick it, or simply drag the scrollbar up, to hold your position while traffic continues.
- Clear CAN Data — empties the table. Does not affect any recording.
No traffic showing? The CAN controller may be stopped. Go to Config Panel and press Start CAN. Also check the baud rate matches your bus — a mismatch produces no frames at all rather than corrupted ones.
6. Configuring the analyzer
Home → Config Panel. Each setting has its own button; the change is sent to the analyzer when you press it, and Last action shows Success or Failed.
CAN Baud
Choose from 25, 50, 100, 125, 250, 500, 800 or 1000 kbit/s, then press Set BAUD. 500 kbit/s is the most common in vehicles.
The new rate takes effect the next time the CAN controller starts. Press Stop CAN then Start CAN to apply it immediately. The setting is stored on the analyzer and survives a power cycle.
CRC
Adds a checksum to every frame travelling between the analyzer and the PC. Wi-Fi already guarantees delivery, so this is normally left disabled. Enable it only if you suspect data corruption.
Autostart
With Autostart ON, the analyzer begins receiving CAN traffic the moment it powers up, without waiting for the PC. Recommended if you use SD card logging, so recording starts at power-on.
Start CAN / Stop CAN
Starts and stops the CAN controller. While stopped, the analyzer stays connected to the PC but ignores the bus entirely.
7. Filtering by CAN ID
Home → Config Panel → Filters. Filters run on the analyzer, so filtered traffic never crosses the Wi-Fi link at all. This is the most effective way to cope with a busy bus.
Modes
Pick a mode and press Send Mode:
| Mode | Effect |
|---|---|
| Allow ALL | Everything (the default) |
| STD only | 11-bit identifiers only |
| EXT only | 29-bit identifiers only |
Specific IDs
- Exact ID — type an ID in hex, choose STD or EXT, press Add Exact.
- Range — enter start and end IDs in hex, choose STD or EXT, press Add Range. Both ends are included.
Every filter you add appears in the list. Adding any specific ID switches the analyzer out of "allow all" — from then on, only what you have listed gets through.
Clear Filters removes everything and returns to Allow ALL.
Important: filters apply to messages you send as well as those you receive. If you have filtered down to ID
100and then try to transmit ID200, the analyzer will silently discard it. Clear your filters before transmitting on an ID you have filtered out.
8. Recording data
There are two independent recorders. You can run both at once.
To the PC
On the Home tab:
- Log CSV — tick it, choose a filename, and every frame is written continuously as it arrives. Untick to stop and close the file.
- Export RAW CSV — writes whatever is currently in the table to a file. A snapshot, limited by the Table size setting.
To the analyzer's SD card
Home → Config Panel → SD Card Logging. This records on the analyzer itself, independently of the PC — it keeps running if the Wi-Fi drops or the PC is shut down.
| Field | Meaning |
|---|---|
| Card | Whether a card is detected and whether logging is on |
| Log file | The file currently being written, and the card size |
| Written | Frames and bytes recorded so far, plus any dropped |
- Insert a FAT32-formatted microSD card. It is detected within about two seconds — no restart needed.
- Enable / Disable Logging — this preference is remembered across power cycles.
- New File — closes the current file and starts a fresh one. Useful for separating test runs.
- Refresh — updates the display immediately (it also refreshes on its own every few seconds).
Files are named CANLOG000.CSV, CANLOG001.CSV and so on, in the
card root. A new file is started each time the card is mounted and whenever you press New File. Numbering
continues from where it left off, so earlier logs are never overwritten. The columns are identical to the PC's
CSV export.
About timestamps. The analyzer has no battery-backed clock. It learns the time from the PC
when the software connects. Frames recorded before that first connection are stamped with the time since the
analyzer powered up (for example 47.512), and frames after it get a real date and time. A
single file can therefore contain both formats — if you need consistent timestamps, connect the
software before starting a recording.
9. Sending messages
Home → TX Panel. The analyzer must be running — press Start CAN first.
A single message
Fill in ID (hex), STD or EXT, DATA or REMOTE, the DLC, and the data bytes as space-separated hex
(11 22 33 44). Press Send Now.
If you enter fewer bytes than the DLC, the rest are padded with zeros.
Repeating messages
Same fields, plus Interval (ms). Press Add and it begins transmitting immediately and repeats until stopped. Add as many as you need — they all run together and are listed in the box.
Stop All halts every repeating message at once.
Automatic replies
Makes the analyzer answer a specific incoming ID with a frame of your choosing — useful for simulating a module that is not physically present.
- Match ID and ID Type — the incoming frame to watch for.
- Data mask (optional) — see below.
- Reply ID / Type / Frame Type / DLC / Data — the frame to send back.
- Press Add Auto Reply Rule.
- Tick Enable Auto Replies to arm all rules.
Rules only fire while that box is ticked. Clear Rules removes them all.
How the data mask works. Leave it empty to reply to any frame with that ID. If you do supply one, each non-zero mask byte lists bits that must all be set in the corresponding data byte of the incoming frame. Zero bytes are ignored. For example a mask of
0F 00means "the low four bits of byte 0 must all be 1; byte 1 doesn't matter".
10. Signal decoding with a DBC
A DBC file describes what the bytes on your bus actually mean. Load one and the DBC Live tab turns raw frames into named signals with real units.
Starting from the template
If you do not already have a DBC for your bus, a starter file called template.dbc
is supplied with the software.
- Copy it and rename the copy — for example
my_vehicle.dbc. Keep the original as a reference. - Open your copy in any text editor (Notepad works; a DBC file is plain text).
- Change the message names, identifiers and signals to match your bus.
- Load it with DBC Live → Load DBC.
The template is deliberately generic — it assumes nothing about what your bus carries. Its four messages
(ExampleStandardMessage, ExampleSignedMessage,
ExampleBigEndianMessage, ExampleExtendedMessage) exist only to show the cases you
are most likely to need: scaled values, an offset, a signed signal, a single-bit flag, named enumerated
values, big-endian byte order and a 29-bit extended identifier. Each is explained by a comment in the file.
Rename them to suit your system and delete whichever you do not need.
Loading
DBC Live → Load DBC, then pick your .dbc file. The tree fills with every
message and signal it defines.
As matching frames arrive, values update live:
| Column | Meaning |
|---|---|
| Message / Signal | Name from the DBC |
| Value | Current decoded value, scaled into engineering units |
| Unit | rpm, °C, km/h … |
| Last Update | When that message was last seen |
Messages defined in the DBC but not present on the bus simply stay blank.
Remove DBC unloads it and returns to raw bytes only.
Recording decoded values
- Continuous DBC CSV — tick it and choose a filename to record decoded signal values
continuously. Each column is one signal, named
MessageName.SignalName. - Export DBC CSV — writes the currently displayed values as a snapshot.
The DBC editor
DBC Editor lets you inspect and adjust message and signal definitions — start bit, length, byte order, scaling, offset, min/max and unit. It warns you if two signals would overlap.
Changes are temporary. The editor modifies the definitions loaded in memory for the current session only. It does not write back to your
.dbcfile, and everything reverts when you unload the file or close the software.So the workflow is: copy
template.dbc, edit the copy in a text editor to make lasting changes, and use the DBC Editor only to experiment — for example nudging a start bit until a value reads correctly, then writing that change into the file yourself.
11. AT control panel
Direct access to the analyzer's command set, and a log of everything exchanged.
- Manual AT Command — type a command and press Send. Press the ? button for the full list.
- AT Debug Log — every command sent and every reply received, timestamped. Clear Logs empties it.
You do not need this for normal use — everything is available through the panels. It is useful for diagnostics and for settings without a UI control.
A good first command is AT+STATS?, which reports frame counters, queue drops and free memory.
See Appendix A.
The routine keepalive traffic is deliberately hidden from this log, so what you see is only what you or the panels actually sent.
12. Reading the status bar
Along the bottom:
RX: 152430 (2145/s) TX: 12 (0/s) backlog: 320 dropped: 0 bad frames: 0
| Field | Meaning |
|---|---|
| RX | Frames received in total, and the current rate per second |
| TX | Frames you have sent, and the current rate |
| backlog | Frames received but not yet drawn. Brief spikes are normal |
| dropped | Frames discarded because the PC could not keep up |
| bad frames | Frames that failed their integrity check |
dropped and bad frames are hidden while they are zero — if you never see them,
nothing is being lost.
If dropped climbs steadily, the bus is producing more than the PC can display.
Add filters (section 7) to cut the volume at the source, or reduce the Table size.
Config Panel → Wireless Link additionally shows which analyzer you are connected to and the current throughput in each direction.
13. Troubleshooting
The analyzer never appears in the Device list
- Check the PC is actually joined to
CAN Analyzer - Wireless. Windows will quietly move back to a network that has internet. - Press Rescan.
- Enter
192.168.4.1:3333under Config Panel → Wireless Link and press Connect to Address. - Some corporate laptops block ad-hoc networks by policy; try another PC to confirm.
It connects, then keeps dropping
- Move the PC closer — this is an ESP32 hotspot, not a full access point.
- Check the analyzer's power supply. Wi-Fi transmission draws current in bursts, and an undersized supply causes resets.
Connected, but no frames appear
- Press Start CAN in the Config Panel.
- Confirm the CAN Baud matches your bus. A wrong rate yields silence, not errors.
- Check your filters — Clear Filters to rule them out.
- Verify CAN High / CAN Low are not swapped, and that the bus is terminated (120 Ω at each end).
Frames are being dropped
- Add ID filters so the analyzer discards unwanted traffic before it reaches the PC.
- Lower the Table size.
- Turn off Continuous CSV logging while diagnosing.
The SD card is not detected
- Format it as FAT32. exFAT and NTFS are not supported.
- Reseat the card; detection is retried every two seconds.
- Try
AT+SD=REMOUNTin the AT Control Panel. - Cards above 32 GB often cannot be formatted FAT32 by Windows' standard dialog — use a dedicated formatting tool.
Windows will not run the software
- On the blue "Windows protected your PC" banner, choose More info → Run anyway.
- If the message says "An Application Control policy has blocked this file", your PC has Smart App Control enabled. It judges unsigned programs on reputation, so this can happen to a perfectly good file. Ask whoever supplied the software for the folder-style build, which SAC treats differently, or ask your administrator about Smart App Control.
- Right-click the file → Properties. If there is an Unblock tick-box near the bottom, tick it and press OK — Windows adds that to files copied from another machine or downloaded.
Decoded values look wrong
- Confirm the DBC actually matches this vehicle or device.
- Check byte order (Intel vs Motorola) in the DBC Editor — this is the usual cause of wildly incorrect numbers.
- Remember editor changes are session-only and are lost on unload.
Appendix A — AT command reference
Enter these in the AT Control Panel. All replies begin AT+OK on success or
AT+ERR on failure.
Status
| Command | Purpose |
|---|---|
AT+STATUS? |
CAN state, baud, CRC, autostart, SD state |
AT+CANSTATE? |
CAN controller state only |
AT+VER? |
Firmware version |
AT+WIFI? |
Network name, IP, port, channel, clients connected |
AT+HEAP? |
Free memory (a low figure suggests instability) |
AT+STATS? |
All counters — see below |
AT+STATS=RESET |
Zero all counters |
CAN control
| Command | Purpose |
|---|---|
AT+START / AT+STOP |
Start / stop the CAN controller |
AT+BAUD=500000 |
Set bit rate (25000 – 1000000) |
AT+BAUD=? |
Query current bit rate |
AT+CRC=ON / OFF / ? |
Link checksum |
AT+AUTOSTART=ON / OFF / ? |
Start CAN automatically at power-up |
Filtering
| Command | Purpose |
|---|---|
AT+ID=? |
Show active filters |
AT+ID=ALL |
Accept everything |
AT+ID=STD / AT+ID=EXT |
Accept only 11-bit / only 29-bit |
AT+ID=S_123 |
Accept standard ID 123 (hex) |
AT+ID=E_18DAF110 |
Accept extended ID 18DAF110 (hex) |
AT+ID=R-S_100-200 |
Accept standard range 100–200 (hex) |
AT+ID=R-E_1000-2000 |
Accept extended range |
SD card
| Command | Purpose |
|---|---|
AT+SD? |
Card state, current file, frames and bytes written |
AT+SD=ON / AT+SD=OFF |
Enable / disable logging |
AT+SD=NEW |
Start a new log file |
AT+SD=REMOUNT |
Re-detect the card |
Useful AT+STATS? fields
| Field | Meaning |
|---|---|
CRX / CTX |
CAN frames received / transmitted |
NDROP |
Frames dropped because the Wi-Fi link fell behind |
SDDROP |
Frames dropped because the SD card fell behind |
FDROP |
Frames rejected by your ID filters (expected, not an error) |
BUSOFF |
Bus-off events — indicates a serious wiring or termination fault |
NPRE / NIDLE |
Reconnections that displaced or reclaimed a stale link |
HEAP |
Free memory in bytes |
Appendix B — Hardware connections
CAN bus
| Signal | ESP32 pin |
|---|---|
| CAN TX (to transceiver) | GPIO 5 |
| CAN RX (from transceiver) | GPIO 4 |
| Transceiver standby | GPIO 14 |
The transceiver connects to the bus as usual: CAN High, CAN Low and ground. The bus needs 120 Ω termination at both physical ends.
microSD card (SPI)
| Signal | ESP32 pin |
|---|---|
| SCK | GPIO 18 |
| MISO | GPIO 19 |
| MOSI | GPIO 23 |
| CS | GPIO 21 |
Cards must be formatted FAT32.
Appendix C — Network details
| Item | Value |
|---|---|
| Network name | CAN Analyzer - Wireless |
| Security | Open (no password) |
| Analyzer address | 192.168.4.1 |
| Data port | TCP 3333 |
| Discovery port | UDP 51235 |
One PC at a time. If a second PC connects, it takes over and the first is disconnected. This is deliberate — it means a PC that crashed or went to sleep never blocks you from reconnecting.
Security note. The Wi-Fi network is open, so anyone within range can join it and reach the analyzer — and therefore your CAN bus. Power the analyzer down when it is not in use, and take care on shared premises. A password can be set in the firmware if your situation requires it.