DBC CAN Bus Conversion In WireShark: J1939 Example

Being able to stream CAN bus data live is nice.

But wouldn't it be great to be able to load a DBC file and live stream converted human-readable data?

The CANLoggerX000 now supports the *.DBC format for both logged data via CANvas and live streamed data in Wireshark
In short, this means that you can now easily convert raw CAN data to physical values - ready for analysis!

In this article we introduce the CAN bus DBC file format, including how to use it in CANvas and our Wireshark Plugin.

Before you hit the below, we suggest you check out the brief video intro above!



The DBC communications database for CAN contains information on CAN bus Messages and Signals.
The format is used to store rules for converting raw CAN data to human-readable values, aka scaled engineering values. 

For example, the right DBC database file would allow you to take the raw data below ...

Raw CAN Bus Data Example

… and return understandable data like below:

SAE J1939 Scaled Engineering Values Output


How does DBC conversion work? 

The DBC file contains Messages (often equal to CAN IDs), each containing Signals that reflect data parameters (e.g. RPM). 

For each Signal, a specified start bit and bit-length allows you to extract the relevant raw bit string from the CAN data frame. 

To convert a Signal, you take the DEC bit string, multiply it by a Scale and add an Offset specified by the DBC file.

Let’s take an example: 

Assume we extracted raw CAN data from a passenger bus under the SAE J1939 protocol and wish to analyse the RPM parameter. 

To do so, we identify in a J1939.DBC file that RPM (or EngSpeed) is a Signal in the Message EEC1 with PGN F004 (in HEX).

Before moving on, note that J1939 is a bit special in regards to the CAN DBC file format:

  • The ID is extended 29 bit - in DBC context, this means that the the leading bit of the ID is “flipped” and needs to be re-flipped
  • Secondly, the relevant ID is the PGN, i.e. a sub part of the CAN ID (start bit 9, length 18)

Both CANvas and our Wireshark Plugin support J1939 as a special DBC case, taking the above into account.


Once you find the J1939 EngSpeed Signal, you'll note it has a number of parameters linked to it: Name, Start Bit, Length, Min, Max, Scale, Offset etc. 

With this, we identify the relevant bits, turn them into a raw DEC number, X, and convert it using: Offset + Scale*X

With this, we now have a converted RPM value!

However, CAN conversion can be tricky in practice: 

Most standards are proprietary, incl. SAE J1939 and OEM-specific standards for cars. You need a DBC file before you can start!

This is also where CAN bus reverse engineering comes into play as car hackers use CAN sniffing to identify the parameters of a DBC structure to allow conversion of the data.

Several tools exist to create or edit DBC databases, including e.g. the CANDB++ editor by Vector. At CSS Electronics, we mainly focus on supporting the use of the DBC database format to allow easy conversion of data from our CAN bus analyzers.


In the sections below we outline how to convert raw data using DBC files in CANvas and Wireshark.
Would you like to try this out yourself? Then download the relevant files below! (No signups or purchases required)


Using DBC files in CANvas is really simple:

  • Simply go into the Convert mode of CANvas and click the “Open database” icon to load your DBC file
  • Next, you'll select what DBC file column fields to import and specify the ID start bit and length (e.g. for use in the J1939 case)
  • Following this, simply load your log files and choose convert to get human-readable data for use in e.g. Excel analysis



Wireshark does not by default support custom DBC conversion - but our Wireshark Plugin solves that!

With the plugin, you can easily import your DBC file and analyse converted live data using a CANLoggerX000 as interface.

The plugin has several other features incl. OBD2 conversion and the CAN Live view for use in reverse engineering. 
To install, paste it into your Wireshark plugins folder (works with both the regular and Legacy versions of Wireshark).

Below we outline how to load DBC files in Wireshark:

When you stream CAN data in Wireshark, you'll see the raw data, cf. the picture.

  • To load a DBC file, go to Edit/Preferences/Protocols/CAN DBC
  • Click Edit and browse your way to a DBC database
  • Next, specify "DBC type" to distinguish between regular and J1939
  • Finally, right-click a CAN Message and click Decode As and choose “CAN DBC”

Cool! You are now streaming live converted CAN bus data!

The Wireshark Plugin allows for 2 types of CAN DBC conversion views: 

Message View: The result is shown in the picture, where each row is a Message. 

The selected Message is EEC1 with CAN DBC ID 0x8CF004FE. To get the PGN, we apply the mask 0x03FFFF00. The resulting PGN is 0xF004 (DEC 61444) and contains 8 Signals. Some of these are not supported in the data and are marked yellow (as the values fall outside the valid Min/Max). Note also the expanded EngSpeed Signal showing the DBC info incl. the conversion: 0 + 0.125 * 4968 = 621 RPM. 

You're probably thinking: "That's fine for a quick overview, but not for Signal analysis!"

We've got you covered:

Signal View: To easily analyse Signals, check "Signal per row” in the preferences (requires a re-start of Wireshark). 

Re-apply the decoding and you’ll see each Message split in multiple rows (one per Signal), identical to output from CANvas:

DBC Wireshark Signal J1939 Message PLugin View

Above, we've added info in columns. To add a column, select a field from the details window and choose "Apply as Column". 

Pretty cool, right? But wait, there’s more…



In this section, we outline a few cool extra features that the new CAN DBC feature of our Wireshark plugin supports.

Create graphical plots: Data plots are easily done in Wireshark - also in real-time! 

Simply go to Statistics/IO Graph and enter “can-dbc.” in the Y field. This brings up a drop-down to scroll through Messages and Signals of the DBC file. Select one and click the check mark to the left to plot it. Remember to set a reasonable interval frequency to avoid funky plots (e.g. 10s or 1 min).

Filter away invalid data: Wireshark offers great filter options to simplify your views. 

These are set up in the Expressions tab in the upper right corner. For example, you can add the filter, “!can-dbc.signal_max && !can-dbc.signal_min” and hit enter to filter out invalid Signals when in Signal View. 

Export to *.csv, *.txt, *.c and more: Easily export your data in multiple formats!

Simply go to File/Export Packet Dissections to select format (*.txt, *.ps, *.csv, *.psml, *pdml, *.c, *.json) and settings. 

You can export all frames, a selected range or the displayed frames based on filters. Under "Packet Format", we recommend to include the Packet summary line, column headings and packet bytes, while excluding the rest. You can export either raw CAN data or the dissected version.

Load a CANLoggerX000 log file: With the plugin, you can even load a CANLoggerX000 log file into Wireshark. 

This allows you to convert, plot and export the data via Wireshark. For large or multiple log files, we recommend using CANvas for conversion as it is designed for efficient log file conversion. In particular, CANvas handles multiple "split" log files easily with speed. However, for simpler cases the Wireshark solution can offer a quick way to get an overview of your logged data.

Beyond the above, Wireshark offers a ton of other useful features for CAN bus data analysis - check out our recommended articles below for more!


With the added DBC file format support for both streamed and logged data, the CANLoggerX000 is an extremely versatile CAN analyzer.
Pricing starts at 169 EUR (free international shipping), making it highly affordable for a combined logger and interface.

Further, both CANvas and the Wireshark Plugin are 100% free. In fact, our plugin is open source - you can get the full code here.

See also our J1939 intro for tips on choosing the right J1939 data logger.

We continuously add new features - and we'd love to hear your ideas and feedback! Contact us or fill out our 2 min feature survey
For more Wireshark features or general intros to CAN bus, OBD2 and J1939 check out our Intel section!

Liked this article? Please share!


This site uses cookies to enhance your experience

Got it!