CAN Spy is a universal tool for working with the CAN bus, designed for monitoring and analyzing data exchange within an automotive CAN network. The program also allows users to independently configure devices manufactured by Navtelecom for transmitting parameters obtained from the CAN bus to a telematics server.
CAN Spy is included in the NTC Configurator software package. The latest version of the configurator can be downloaded via the link.
CAN Spy is launched from the “Advanced” menu.

When launched for the first time, the main program window will open.

The CAN Spy interface is organized into functional areas, providing convenient navigation and efficient data analysis.
At the top of the window, there is a menu bar containing the following items:
The CAN interface configuration area includes:
More details → Channel configuration
The program workspace includes tabs and panels, each intended for a specific stage of analysis:
Messages
Main table with raw CAN messages: ID, DLC, data bytes, MS.
Message Search
Panel for highlighting messages containing specific data values.
Byte-by-byte Analysis
Displays each message byte with visual bit-level breakdown.
Decode by File
Displays decoded CAN parameters using predefined decode files or custom *.decode files.
Record Log
Controls recording of the current CAN message stream.
Editor
Creation and editing of custom decode files (*.caf and *.decode).
Scripts
Working with scripts for CAN bus interaction.
The Messages, Message Search, Byte-by-byte Analysis, and Editable Parameter Chart windows can be moved to any part of the interface: top, bottom, right side, outside the main window, or to a separate monitor. To reopen them, use the menu View → Messages.

To start working with CAN data in the CAN Spy window, you must select a data source. It can be:
By clicking the “Open log file” button, you can open the folder containing previously saved logs. By default, the following directory is opened:
C:\Users\Public\NAVTELECOM\NTC Configurator v3\Data\can-logger
After selecting a file, press the Start button to begin log playback. The data will be displayed in the same way as when directly connected to the CAN bus via USB.
If the log folder was archived, the files must be extracted before playback.

By expanding the tooltip, you can import logs in .csv and .trc formats. The selected log file can also be exported to .csv and .trc.
When selecting the CAN interface as the data source (CAN1 or CAN2), ensure that the device is physically connected to the CAN bus correctly. The connection points to CAN bus wires depend on the specific vehicle or equipment.
![]() |
Button for opening the “Message Filtering” window |
While configuring the source, the Message Filtering window can be opened using the corresponding button.

The next step in channel configuration is setting the CAN interface speed.
![]() |
Button “Detect bus speed” |
If the CAN bus data rate is unknown, you can use the automatic detection function. To do this, click the Detect bus speed button.
In the Bus speed (bit/s) field, you can:
If the bus speed is detected automatically, incoming CAN messages with data packets will begin appearing in the Messages window.

Passive mode is used for safe connection to a vehicle CAN bus. In this mode, the device only listens to the bus without acknowledging received messages or transmitting data — sending commands or requests is not possible.
If only a single message is displayed in the Messages window, this may indicate that there is no second active module or receiving device on the CAN bus, which is required for proper data exchange.

In such cases, it is recommended either to switch to Active mode or to try connecting to another point of the CAN network where communication between two or more modules is present.
Switching to Active mode in CAN Spy is possible only if the program has already received at least one message in Passive mode at the selected bus speed.

To switch to Active mode, follow these steps:
If the configured CAN interface speed does not match the actual vehicle bus speed, operating the device in Active mode may disrupt electronic systems, trigger ECU errors, or cause module shutdown.
The CAN bus profile status indicator allows quick assessment of connection parameters and operational activity.

When hovering over the indicator, a tooltip window displays extended information for each bus profile (for example, CAN1, CAN2).
Information displayed in the indicator:
![]() |
Device is not connected to CAN Spy |
![]() |
CAN interface is disabled in settings |
![]() |
Speed detection and message search |
![]() |
Speed detected, but no data from the decode file |
![]() |
Data is being decoded according to the decode file |
The Messages tab displays CAN bus messages and their values in a table format. This feature allows visual analysis of parameter changes using cell highlighting.

Table column description:
ID – message identifier in HEX.
DLC – data length of the message (in bytes).
D0 – D7 – message data in HEX. Byte numbering starts from “0”, so the first byte is D0, the second is D1, etc.
MS – approximate transmission period of the CAN message on the bus (in milliseconds).
Panel function buttons:
| Icon | Function |
|---|---|
![]() |
Byte-by-byte Analysis — sends the message to the Byte-by-byte Analysis window. |
![]() |
Send to Editor — creates a parameter with the selected ID in the Editor window. |
![]() |
Clear Table — removes all messages from the table. |
![]() |
Reset Highlight Flags — restores default data display. |
![]() |
Settings — opens the message display settings window. |
By default, all received messages remain displayed in the table, even if they are no longer transmitted on the bus. To remove outdated messages:
Automatic cleanup allows you to see only актуальные data.
It is recommended to disable this feature when switching ignition on/off or when analyzing log files.
Whenever a byte value changes, the corresponding cell is highlighted in green. This simplifies the search for target parameters such as:
Additionally, you can enable the Show changes less frequently option to highlight only those bytes that change less often than the specified threshold (for example, 5000 ms). This helps filter out noisy data.
Highlight control can be applied at the level of individual bytes or entire messages. The corresponding flags can be set or cleared both for specific bytes and for message identifiers.
For additional noise filtering, the program provides a history-based highlighting mode. It excludes values that have already appeared before and highlights only truly new data.
This mode allows you to quickly identify bus reactions to user actions (for example, pressing the brake or increasing engine RPM), while ignoring background values that constantly change.
If no values are highlighted:
The identified message can be sent to:
This can be done using the buttons in the table or via the row context menu.
The filtering function allows you to display in the Messages window not the entire stream of CAN identifiers circulating on the bus, but only the portion that is relevant for detailed analysis.
The filter settings window can be opened by clicking the corresponding icon in the Bus/Data Source section or via the Tools menu.

If a filter is active, this will be indicated in the Bus/Data Source settings field.

In the Message Filtering window, you can specify the mask, the range of allowed values, and the RTR bit value.
IDE allows you to quickly set a mask for 11-bit messages, 29-bit messages, or PGN.
RTR = Any – the RTR bit state is ignored during filtering
RTR = No – only messages with RTR bit = 0 will appear in the table
RTR = Yes – only messages with RTR bit = 1 will appear in the table
ID range – only messages with IDs within the specified range will appear in the table.
The “Reset” button disables filtering.
All changes in the Message Filtering window are applied after clicking OK.
After applying a filter, click Clear Table to refresh the message table.
If Automatic message cleanup is enabled, filtered-out messages will be removed automatically.
Example of filter configuration to display 11-bit messages with IDs in the range from 300 to 400:

Example of filter configuration to display J1939 messages with PGN greater than FE00:

Example of filter configuration to display J1939 messages with source address 25:

The “Byte-by-byte Analysis” window is designed for detailed monitoring of changes in individual bytes of CAN bus messages. It allows you to:
The tool is useful for:

Panel function buttons:
![]() |
Update ID — transfers the ID of the selected entry from the Messages table to the corresponding field. |
![]() |
Send to Editor — creates a parameter with the selected ID in the Editor window. |
![]() |
Pause — stops data updates in the panel. |
![]() |
Clear Table — removes all messages from the table and charts. |
![]() |
Settings — opens the message display settings window. |
Allows you to configure the condition under which a message will be displayed on the chart and in the history table. It is used to filter parameters that depend on the value of specific bytes.
In the FMS (Fieldbus Message Specification) standard, the first byte (D0) indicates the axle number, while bytes D1 and D2 contain the load value for that axle. To obtain the value for axle No. 2:
- Set the mask value for byte D0 tof0
- In the “Value” field, set10

For each byte in the mask and value row, you can quickly set:
00 using the button to the left of the byte field,ff using the button to the right of the byte field.Additional buttons allow setting 00 or ff simultaneously for all eight bytes — they are located on the right side of the panel.
Allows you to hide unnecessary data and highlight only the relevant bytes. The mask specifies which bits should be considered during analysis.
This block helps to:

As in the “Reception Condition” block, mask values can be quickly set:
00 — using the button to the left of the byte field,ff — using the button to the right of the byte field,Displays a list of received messages that match the specified conditions and mask. Includes:

Contains 8 separate charts showing changes in each byte value over time.
1, it is highlighted in green.
The chart is displayed and updated in real time, even if no new messages are received. Suitable for high-frequency messages (less than 500 ms).
The chart updates only when a new message is received. If no new data arrives, the chart remains unchanged. Optimal for low-frequency messages (more than 1000 ms).
The Additional Settings block allows you to control the visibility and behavior of interface elements related to data display and filtering.
Available parameters:

This panel is designed for searching and filtering numeric values in CAN bus messages based on specified parameters and conditions. It supports value scaling, bitwise masking, and configuration of data format and byte order.
![]() |
Byte-by-byte Analysis — sends the message to the Byte-by-byte Analysis window |
![]() |
Send to Editor — creates a parameter with the selected ID in the Editor window |
![]() |
Clear Table — removes all messages from the table and charts |
![]() |
Filters — expands additional search settings |
uint8, int8, uint16, int16, etc.DEC — decimal,HEX — hexadecimal.Y = X × A + B. The result of this transformation is used to search for matches in the CAN message stream.(expanded when the Filters option is enabled)
Little-endian or Big-endian.ffffffff means all bits are taken into account.X — user-defined search value,A — scaling factor,B — offset,Y — result that must be found in the message stream.The “Reset” button restores all additional parameters to their default values.
At the bottom of the panel, a table displays messages that match the specified filtering conditions. Each row contains:
Y = X × A + B for the detected data segment matching the entered value.The bytes where a match is found are highlighted in green, allowing quick identification of the value location within the message.
To exclude unnecessary or interfering messages from analysis, you can use the identifier blacklist (ID).
After adding:
![]() |
If the list is empty, the icon appears inactive. |
![]() |
If IDs are present, the icon becomes active. |
Access management via the dropdown button:

The menu provides two actions:

When the blacklist filter is active, messages included in it will not appear in the table even if they fully match the search conditions.
The “File Editor” window allows you to create custom files that define CAN message decoding rules. Files are saved in the *.caf format. This format takes into account the specifics of CAN bus processing algorithms used in Navtelecom devices.
Custom *.caf files created in the Editor can be compiled into a special *.decode format for subsequent upload to Navtelecom devices.
Files in the
*.decodeformat are closed: they cannot be exported from the device and cannot be opened or modified in the Editor window.
To verify the operation of*.decodefiles, use the Decode by File tab.
The Editor window also allows importing CAN files from other formats:
.dbc (CAN DBC).bim (ACE_Lab)The main file management controls are located on the top panel of the editor:
![]() |
Create new file opens a window where you need to specify the vehicle description and CAN bus |
![]() |
Open file — load a previously saved .caf. |
The dropdown menu also contains an “Import” button, which is used to import CAN decoding files in *.dbc (CAN DBC) and *.bim (ACE_Lab) formats.

![]() |
Save - saves the current *.caf file. |
In the dropdown menu, the “Save as” button allows saving the file under a new name.

![]() |
Compile *.decode file. See details in custom file compilation |
In the dropdown menu there is also a button “Upload decode file to device” for uploading a previously compiled *.decode file to the device.

![]() |
Vehicle description |
![]() |
Add bus |
![]() |
Add parameter to the selected bus |
The parameter dropdown menu contains parameter addition options.

![]() |
Delete selected parameter or bus |
When CAN Spy is launched for the first time, the “File Editor” window offers a new file template with one pre-created parameter (“Parameter1”) inside.

Data marked with the
*symbol is not saved. When closing the CAN Spy window without saving, all file data and Parameter values marked with this symbol will be lost. To save changes, click Save
To create a new file, click Create new file. In the window that appears, fill in the vehicle description whose CAN bus you are connected to. You must specify the vehicle make and model. It is also recommended to enter production years and connection comments. This information will be saved in the file with the detected parameters and will be useful for future work.
The vehicle description can be edited at any time by clicking the corresponding button.

For each vehicle, you can add one or several CAN buses by clicking the button
Profile represents the CAN interface configuration applied after uploading the decode file to the device. This setting is relevant for devices with two CAN interfaces and allows specifying which physical CAN interface the settings of this bus will apply to in the device. If the decode file is intended for devices with a single CAN interface, the profile “CAN1” must be selected.
Bus speed - the data transfer rate on the selected bus. It is set automatically according to the speed detected when connecting to the device or playing back a log. This setting can be edited later.
If the CAN interface speed is selected incorrectly in the file, the device will not be able to receive data from the bus. Operating in active CAN mode may disrupt the vehicle CAN bus, cause controller errors, and may also lead to onboard electronics failure.
Device address - a setting required when sending requests to the bus in J1939 format. If necessary, specify the source address, that is, the device’s own address from which it will send requests to the vehicle bus.
By default, the bus name is Bus1, profile CAN1, communication speed 500 kbit/s, source address 0xff.
The bus name can be changed by the user at their discretion.
Parameters in the custom file can be added manually or by using built-in mechanisms for searching and reusing already described parameters.

The Add parameter from decode file button opens a functional window where you can select a decode file and the parameters to be added to the custom decode file.

In the added parameter, the content is hidden, but you can change its name and FLEX parameter.

| Field | Description |
|---|---|
| Name | Unique parameter name for identification (required field) |
| ID | Message identifier in HEX (11/29 bit or PGN for FMS/J1939) |
RTR — Remote Transmission Request (frame without data)ISO-TP (OBD-II) — Standardized diagnostic protocolSAE J1939 — Protocol for commercial vehicles| Option | Description | Value range |
|---|---|---|
| Analog | Floating-point number (Float) | Depends on bit length |
| Counter | 32-bit integer | 0...4 294 967 295 |
| Discrete | Logical value | 0 (False) / 1 (True) |
Signed — Most significant bit as sign (e.g., -128...127 for 1 byte)Unsigned — Positive values only (0...255 for 1 byte)LE (Little Endian) — Least significant byte first (used in J1939)BE (Big Endian) — Most significant byte firstFor parameters, the allocated size corresponds to the FLEX standard.
When working with J1939, it is recommended to use LE byte order.
Defines the conditions under which data will be parsed from the message:
Configuration:
Example — using the If equal condition for the parameter Axle 2 load

This setting allows transforming raw data using a coefficient and offset to obtain values in the required measurement units:
Result = Value * (Coefficient) + Offset
The coefficient and offset values can be calculated in the Scaling Calculator. The raw value from the bus is entered as input data, and the desired scaled value is entered as output data. If two points are specified, both the coefficient and the offset can be calculated.

The calculated values can be immediately applied to the parameter by clicking OK.
Measurement units - optional, not used in decoding
The range parameters of valid values are used to filter out incorrect data.
For example, for a fuel level parameter it is recommended to set a non-zero lower limit, since when the ignition is turned on, the value 0 may be briefly transmitted on the bus, which leads to distorted reports.
The maximum value may also be used by the device to indicate the absence of актуальные data and should be excluded from processing.
The FLEX Parameter is a parameter of the FLEX protocol in which the parameter values are transmitted from the device to the monitoring system server.
The parameter consists of:
sc1–80, ac1–255, bc1–92, ic)0.1 l, %, 0.005 km, etc.)UInt32, UInt16, Bit, etc.)Important! If the monitoring system supports the FLEX protocol, parameters with sc tags will be additionally scaled on the server side according to the parameter resolution. This must be considered when selecting the coefficient.
An incorrectly specified resolution may lead to distorted data in the monitoring system.
For example:
sc6: Total vehicle mileage, 0.005 km
will be multiplied by0.005to convert the value to kilometers.
Parameters with ac and bc tags are configured as custom parameters (FLEX 207–252) and are not automatically scaled on the server side.
In the Result field, the last decoded parameter value is displayed in three representations:
These values are also saved in the results table with a timestamp counted from the moment data reception started in the channel.
The value is additionally displayed next to the parameter name in the decoding file tree.

The table can be cleared using the "Clear points" button. The Show graph button opens the results graph in a separate window.
The graph supports real-time display mode and floating scale mode, similar to byte-by-byte analysis. The Y-axis range is determined automatically based on the minimum and maximum parameter values or can be set manually.
To compile the decoding file, click the Compile decoding file and upload to device button. The decoding file creation wizard will open.
Contains information about the vehicle and the file version.

Allow selecting the buses that will be used for data decoding within the corresponding profile.

Contains a table of parameters, file characteristics, and limitations.

The table includes the following columns:
Displayed on the right side of the window and include:
After completing the setup, the file can be:
The “Decoding using a decoding file” interface block is intended for searching, verifying, and uploading a suitable CAN data decoding file to the device. It allows you to select the file source, find the required file in the library using filters, review the list of parameters that the file can decode (as shown in the table below), and load it for operation.
First, choose where to get the decoding file from:
.decode file from your computer.The selected mode changes the available settings.


These settings are visible only in “Standard” mode.

To find a suitable file in the library, you can use:
Once a file is selected (from the library or from your computer), click the “Upload file” button to send it to the device.

Important: The “Upload file” button will be inactive (disabled) if CAN bus scanning is running. To upload a file, stop the scanning first.
The Record log tab allows saving CAN messages exactly as they were transmitted on the bus at the time of recording. This is especially useful when access to the vehicle is limited.
Log files should also be provided to Navtelecom technical support in the following cases:

Before starting the recording, you must create a Vehicle object using the Add new vehicle button.
In the window that opens, specify:

After clicking Add, the vehicle will appear in the drop-down list.

The following buttons will also become available:
![]() |
Edit selected vehicle |
![]() |
Delete selected vehicle |
Click Add CAN bus to specify the connection to a particular CAN bus.

The added bus appears in the drop-down list. The following buttons will also become available:
![]() |
Edit selected CAN bus |
![]() |
Delete selected CAN bus |
If logs need to be recorded from multiple buses of the same vehicle, each one should be added with the corresponding connection point description.
After selecting the CAN bus to which the device is connected, you can proceed to log recording.
When you click Record new log, the recording window opens, displaying vehicle data and the connection point. In the drop-down list, select the log type that needs to be recorded.
In most cases, it is sufficient to record two background logs:

After selecting the appropriate template, click Start recording and follow the instructions displayed in the log recording wizard window.
Additionally, you can:
At the top of the wizard window, the CAN bus data reception status is displayed. The following notifications are possible:
After the process is complete, click Finish - the log will be saved to the computer.
To capture changes that occur when a discrete sensor is triggered, use the “Custom discrete sensor” template.
During recording, you must:

This allows capturing the corresponding changes in CAN messages related to the operation of the discrete signal.
The “Custom analog sensor” template is used to search for analog sensor values in CAN bus data.
During recording, follow the instructions in the wizard and step by step specify one of the following states in the Value type field:

This method allows correlating changes in CAN messages with known analog signal values.
This template is recommended for recording logs where parameter changes are observed over an extended period of time.
By default, the recording duration is 5 minutes. If necessary, the Log recording duration parameter can be changed by the user.
Additional information about external conditions or specific details of the recording process can be entered in the Note field.

To send CAN bus logs to Navtelecom technical support, you need to generate an archive containing the corresponding log files for the selected vehicle. The archive is created automatically when you click the Generate report file button.

In the window that opens, you can select the logs to be included in the archive.

By default, logs and report archives are saved on the computer in the directory:
C:\Users\Public\NAVTELECOM\NTC Configurator v3\Data\can-logger
The completed archive should be sent to: support@navtelecom.ru
Recommended email subject: CAN logs. [Make] [Model] [Year]
For example: CAN logs. Lada Granta 2022
In the email body, specify the reason for sending the logs. Possible reasons:
The more detailed the description, the easier it will be to perform a repeated log analysis later.
The Scripts tab provides tools for creating, editing, and executing visual block-based scripts designed for interaction with the CAN bus.
Scripts can receive and transmit CAN messages, use conditions, delays, repeat loops, and finish with a defined result. They are used for debugging, diagnostics, and automation of CAN equipment interaction.
![]() |
Add script – create a new script |
The drop-down menu contains the Import file button, which allows opening previously created scripts.

To restrict access to script content, passwords can be set. A password-protected script can be uploaded to the device, downloaded from the device, executed by command, or called via a function in Complex Events.
![]() |
Add a protection password for selected scripts |
![]() |
Change password for selected scripts |
![]() |
Remove protection password for selected scripts |
For remote script execution via command or a function call in Complex Events, the script must be uploaded to the device memory.
![]() |
Upload to device – opens the script upload management window |
In the window that opens, two lists are displayed:

Between these fields, there are arrow buttons that allow copying selected items from one list to the other.
To the right of the Device scripts list, there are buttons for managing the order of elements (move up/down) and for deleting selected items from the list.
After forming the final list in the Device scripts field, click Update script list on device. This action writes the scripts to the device memory and replaces the previously saved list.
![]() |
Save selected scripts |
The drop-down menu contains the following buttons:

Script-related actions are also available via the context menu. To open it, right-click on a selected script in the list.

A script can be tested immediately in CAN Spy.
![]() |
Run selected script |
![]() |
Stop running script |
Below are the main blocks available in the visual script editor. Each block represents a logical element of the scenario that performs one or more actions. Blocks are connected sequentially or through conditions.

Allows sending a CAN message with a specified ID and set of bytes.
Block parameters:
Identifier type – select one of three formats:
Message ID (HEX) – identifier used for transmission.
To the right of the ID field there is an Update ID button that automatically inserts the identifier and type from the selected message in the Messages table.
Data (D0–D7) – input fields for each message byte. Entered manually in hexadecimal format.

Adds a delay for the specified number of milliseconds. Useful for creating pauses between actions or testing device response to timing intervals.

Starts a loop with a specified number of repetitions of the nested blocks.

This block defines a condition for receiving a CAN message with a specific identifier and data values. If the condition is met, the nested algorithm inside the block is executed. If the message does not match the specified parameters, execution continues along the main script flow.
Block parameters:
ff – byte fully considered, 00 – ignored).After the condition is met (message received and matches data and mask), the script executes the blocks nested inside this condition. If the condition is not met, execution continues with the next block at the main level.

The Reception condition block waits for one of the nested If received conditions to be fulfilled within the specified time interval. If at least one condition is met, the corresponding nested algorithm is executed. Otherwise, the alternative code from the else section is executed.
Block parameters:
This block is intended for in-depth analysis and comparison of recorded logs. While a standard log view shows a stream of messages over time, this tool allows you to:
The tool switches between two display modes: Graphs and Value Table. Supported file formats: proprietary binary .log, as well as .csv and .trc.
The interface is divided into four main areas:

Log Addition Panel (top)
View Mode Panel (left above the table)
Summary Table (left)
Graph/Table Area (right)

When only one log is loaded, it is treated as the reference, so all cells in the summary table will be marked with its color.
If you click on a row with a message ID:
If you click on a specific marked cell (for example, byte 3):
The main power of the tool appears when multiple logs are loaded for comparison.
In the summary table, markers appear only in those cells (ID + byte) where the sets of values for that byte differ between logs.
If you click on a row with a message ID:
If you click on a cell (even without a marker):
| Action | Result |
|---|---|
| Add log | IDs appear in the summary table, cells are marked with the log color. |
| Click on ID row | The right area displays data for all 8 bytes of the message. |
| Click on byte cell | The right area displays data only for the selected byte. |
| Switch to “Graphs” | The right area shows a visual timeline of value changes. |
| Switch to “Value Table” | The right area shows a text list of unique or differing values. |
| More than one log loaded | Markers show only bytes with differences. Marker color = log with difference. |
This tool is indispensable for identifying anomalies, comparing a reference log with a problematic one, and for deep analysis of CAN message structure.