Tracer: communication history

Tracer displays messages in observed order. Use it to find requests, inspect responses, compare bytes and reconstruct the sequence of events.

Data source

Tracer works with connected sources and loaded trace files. A connected source is captured automatically. Save saves the accumulated trace; it does not start capture. After disconnecting, the current trace remains available for viewing and saving until the document is closed or replaced.

Passive observation

For analysis through an adapter, prepare a line that already carries traffic and configure the connection. Tracer shows the message sequence, while Monitor summarizes the latest values and communication state. Opening these tools does not start polling devices: requests may come from an external master or diagnostic tester.

However, when enabled, active adapter detection sends data to devices at startup and when you click Rescan, potentially generating unwanted bus traffic. Disable this setting beforehand to avoid traffic from detection while observing the line.

Without a device, load a trace file in Tracer. Viewing a static file does not start playback for Monitor or send messages to the physical bus. Separate active MCP operations are described alongside the required local permissions.

CAN layers

UI layer	CANopen	Automotive VAG	Filter fields
Physical	Source CAN frames	Source CAN frames	trace.*, can.*
Transport	No separate layer	ISO-TP and TP2.0	protocol.type, isotp.*, tp20.*
Protocol	CANopen messages	UDS and KWP2000	protocol.type and canopen.*, or uds.*, kwp.*

Modbus RTU uses its own decoded message table and modbus.* fields; the three CAN layers do not apply to it.

For messages to appear on the selected layer, the trace needs the relevant traffic and sufficient context. For example, capturing TP2.0 dynamic channel setup helps decode later messages.

Hardware ISO-TP

In VAG, while hardware acceleration is active, the Transport and Protocol layers show complete ISO-TP and UDS messages, including long responses. The driver does not expose individual CAN frames, flow-control frames, or their timing. The Physical layer therefore shows Physical CAN frames unavailable; select Transport or Protocol and check the separate filters for those layers.

Timestamps refer to complete messages; timing between individual CAN frames is unavailable. The current profile session provides a history of up to 16,384 messages, available when Tracer is reopened. This history is not included in trace exports.

If the application reports a trace recording error, some traffic may be missing from the history.

Columns

The CAN table contains Time, Flow, Layer, Address / Id, Type, Length, Data and Description. At higher layers, the address and data belong to the corresponding protocol message.

Modbus RTU shows Time, Response time, Flow, ID, Function, Data and Description. Response time appears when the exchange can be matched. A missing value alone does not prove a timeout.

Flow is the semantic role: request, response or broadcast, when known. Incoming adapter traffic does not necessarily mean a response: passive capture also receives requests sent by an external master.

Filtering

1. Select a layer for CAN.
2. Enter a filter expression in Filter expression.
3. Wait for it to apply or press Enter. When suggestions are open, the first Enter accepts the selected suggestion.
4. Check the filter status message.

Fields and suggestions depend on the layer. Each CAN layer has an independent filter expression: filtering the Physical layer does not restrict messages on the Protocol layer. Fields from different layers cannot be combined in one condition.

To filter by protocol in VAG, use protocol.type from the selected layer's catalog. See the VAG reference for values and examples, and the filter language reference for how suggestions update.

An invalid expression is not applied; the previous valid filter, if any, stays active. Clear the input to restore all rows. In VAG, also check the TesterPresent toggle: it combines with the protocol-layer expression.

See syntax and missing fields.

Labels and further analysis

Add label and Delete label are available in the context menu. Labels name moments such as “Check started” or “Response after changing a setting”. They are attached to source records, not row positions after filtering.

The default quick-label shortcut is Ctrl+L. Change it in Settings → Tracer → Capture → Quick label shortcut.

The context menu also copies a selected row or cell. If automatic scrolling has stopped, use Resume auto-scroll to return to the latest messages.

Clear starts a new visible document range. Old rows are excluded from subsequent saves of that range. Use Save first if you need them.

Message details

Select a row to open the details panel, showing available fields and bytes. Copy all bytes copies the message bytes; Keep details visible pins the panel even when nothing is selected.

Drag the panel header below or to the right of the table. With the header focused, use Alt+Down or Alt+Right. Position, size and pin state are saved and shared across profiles.

Traffic analysis

Open the summary through the transport name in the status bar, then click Expand traffic analysis. The panel shows physical line utilization, history and traffic composition. Clicking the graph moves a linked table to the corresponding interval while preserving its layer and filter.

See line utilization and transport statistics for Cur, Max, Avg, interval selection and the Messages, Bytes and Wire time modes. Tracer filtering does not change the overall load.

See saving and loading, CAN fields and Tracer settings.