What information you need
If we are talking about Diagnostic on CAN, then to be able to say whether this communication is using UDS protocol you need to know:
- CAN Addressing format
- Addressing Information parameters
- if Normal Addressing format is used:
- if Normal Fixed Addressing format is used, it would be simpler as CAN ID scheme is known, so it is enough to get:
- priority parameter for physical addressing
- priority parameter for functional addressing
- (Source for request, Target for response messages) Address of diagnostic tester
- (Target for request, Source for response messages) Address for each ECU in the vehicle
- if Extended Addressing format is used, it is the hardest as we need:
- pair of (for request and response) CAN Identifiers and Target Address (1 byte) parameters for functional addressing
- pair of (for request and response) CAN Identifiers and Target Address (1 byte) parameters for each ECU that can be physically addressed
- if Mixed Addressing format with 11-bit CAN Identifier is used then we need:
- pair of (for request and response) CAN Identifiers and Addressing Extension (1 byte, the same value for request and response messages) parameter for functional addressing channel
- pair of (for request and response) CAN Identifiers and Addressing Extension (1 byte, the same value for request and response messages) parameter for each ECU that can be addressed physically
- if Mixed Addressing format with 29-bit CAN Identifier is used then we need:
- priority parameter for physical addressing
- priority parameter for functional addressing
- (Source for request, Target for response messages) Address of diagnostic tester
- (Target for request, Source for response messages) Address for each ECU in the vehicle
- Addressing Extension (1 byte, the same for request and response message) for each communication channel (usually the value is unique for each vehicle's network)
How to get them
Certain ways
The only way to be sure that the communication you are observing is diagnostic communication is basing on OEM (e.g. Toyota, FIAT) requirements. So basically, you need to get some piece of documentation or get an access to their standards about diagnostic communication. Those information are either public or have leaked for older car models.
Probable ways
If you have an option to observe diagnostic (UDS) communication, then you would be able to figure out most of the previously mentioned variables/parameters.
In every diagnostic communication you will see Tester Present and Diagnostic Session Control services being used. So you can look for:
Tester Present requests will have following data
might be one byte here 02 3E 00 might be data padding here
might be one byte here 02 3E 80 might be data padding here
Tester Present response will have following data
might be one byte here 02 7E 00 might be data padding here
Diagnostic Session Control request will have following data
might be one byte here 02 10 XX might be data padding here
- XX would usually be equal 01, 02, 03 or 04, but might be any value
Diagnostic Session Control response will have following data
might be one byte here 02 50 XX or 06 50 XX YY ZZ WW VV might be data padding here
- XX be repreated value from request
- YY, ZZ, WW, VV might be various values
Guessing
Just sending blindly requests (e.g. Tester Present) and hoping for a response.
If we assume Normal Fixed Addressing format (which is most likely to be used), this is relatively possible to figure out.