Open / standardized
CAN bus
A broadcast, priority-arbitrated serial bus originally designed for vehicles and widely reused in mobile and machine automation.
N/ATwo-wire differential serialEncryption: No
How it works
Frames carry an arbitration identifier and data; every node sees every frame and filters by identifier.
Communication patternBroadcast frames with ID-based arbitration.
Fact sheet
TransportTwo-wire differential serial
PortsN/A
AuthenticationNone
PurdueLevel 1 – Level 0
EnvironmentsVehicles, Mobile equipment, Machine internals
DevicesECU, Controller, Sensor
IndustriesTransportation, Mining, Manufacturing
Why should I care?
Understanding CAN bus is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Periodic status frames
- Command frames
- Diagnostics (e.g. UDS on CAN)
Security concerns
- No authentication or sender identity
- Physical access to a connector often reaches the whole bus
- Diagnostic services can alter node behaviour
What normal looks like
- Fixed set of CAN IDs at consistent rates
What deserves attention
- Unknown CAN IDs
- Diagnostic session activity outside service events
Hunting ideas
- new-device-control-zone
Defensive controls
- Physical connector control
- Gateway separation between diagnostic and control buses
Related ATT&CK for ICS techniques
T0842
Sources & further reading