System to sniff CanBus in Ferrari Models

Looks like ISO14230? At least based on the multi-frame messages.

Is that a California (Based on the frame containing F149 in ascii?)

 

Used the wrong ISO, ISO15765 is what I meant, it's functionally the same for message formatting as 14230. Nothing to do with codes.

ISO14230/ISO15765 (which are functionally the same, just one is over K-line one over CAN) are some of the OBD-II approved transport layers. Those messages look like ISO14230/15765 formatted messages, but I assumed you knew which the transport layer was. It itself has nothing to do with reading anything from the OBDII port. All CAN traffic is formatted using a transport layer (unless a weird single-frame application like volCANo in a pre-UDS Volvo).

CAN itself only can send 8 byte frames. To send multi-frame messages (as displayed on your picture from ID 0x3E0), you need a transport layer over CAN. ISO15765 is one of those. Other common ones are UDS (ISO14229), older VAG uses their own TP2.0 and so on.

In your case, you have a CAN ID 0x3E0 sending a 3-frame message:

00 5A 46 46 46 31 34 39
01 36 31 34 39 34 36 35
02 39 37 34 00 00 00 00

This requires handling the transport layer to work with them correctly, as you can see they are not consecutive in the dump.

The 00 01 02 is the sequence number of the frame, and the 7 characters after it is the payload. This, and the ID numbering looks much like ISO14230 to me, but without actually seeing the traffic handling, it's impossible to say which transport layer it is. As that transfers in ASCII to "FFF149F149465974", The F149 I thought could have suggested it's a California. But it could also be a platform ID and the same unit is used in both FF and Cali.

But if you want to actually see what's going on in the Canbus, you need to handle the transport layer correctly.