Successful connection on the Model S internal Ethernet network

[nlc]

Funny, I was just thinking the exact opposite. Finally a thread were people are talking about something I understand.

It's great, I need help
Yesterday I captured and analysed some frame, filtered by type. For example I captured VehiclePowerStatus frame.
Doing nothing a bit in a byte is changing sometime, and it seems a 32 bits value is growing on each frame, as it was total Ah or Wh consumed on the pack.

I just worked 10 or 15 minutes because my 4 year and 2 year sons played in the car and it was not easy to work....

 

[tom66]

You should try turning on the A/C or heater, see if that changes the power consumption figure. Presumably there's a power remaining figure, and power currently being consumed/regened. I'd expect them to be floating or fixed point.

 

[nlc]

The power being consumed is not in this frame, because I tried to switch on/off the A/C, and set heater to max, and no other data changed. But the growing value was fasted I believe.

In a first time to play with the vehicle data I am interested to found the real time consumed power (It is somewhere because the dashboard display the real time power consumption), and the speed.
Because with the frame datation, it will be easy to determine precisely the 0-60mph speed, and draw the torque/power/speed curve (because with the power and speed because of the fixed ration we can calculate the torque).

 

[nlc]

It seems I am alone to work on ethernet !?? I need help, no one to investigate with me ? :smile:
It's really easy with a 4 pin 2 row 2mm pitch header to build the ethernet cable and connect to the car !

Today I see when rebooting the central console while driving, the instantaneous power is displayed correctly on the dash screen. Thus the power value probably comes from the third device which probably manage the powertrain.
Now I need to capture frame during driving to try to see something interesting

 

[widodh]

It seems I am alone to work on ethernet !?? I need help, no one to investigate with me ? :smile:
It's really easy with a 4 pin 2 row 2mm pitch header to build the ethernet cable and connect to the car !

Today I see when rebooting the central console while driving, the instantaneous power is displayed correctly on the dash screen. Thus the power value probably comes from the third device which probably manage the powertrain.
Now I need to capture frame during driving to try to see something interesting

Give me some time! I'm on vacation driving with my S. Next week I'll dive into this.

 

[nlc]

Great :wink:
For me vacation is next week :smile:

 

[beck.christopher]

It seems I am alone to work on ethernet !?? I need help, no one to investigate with me ? :smile:
It's really easy with a 4 pin 2 row 2mm pitch header to build the ethernet cable and connect to the car !

Today I see when rebooting the central console while driving, the instantaneous power is displayed correctly on the dash screen. Thus the power value probably comes from the third device which probably manage the powertrain.
Now I need to capture frame during driving to try to see something interesting

I can help with this once my car arrives by the end of the month. Is there anything you need help with from a software side or data analysis that I can help with while I wait for my car?

 

[nlc]

You can send me your email in PM, I will send you some capture I done if you want. I don't want to put them public because there is porbably personnal data in some frame :smile:

 

[brianman]

@nlc (and maybe some of our modders...)

How hard (and expensive) would it be to combine your device with a storage mechanism like a USB hard drive? With a week or two of log data, it would be much easier to see patterns.

 

[lolachampcar]

Netbook time

 

[bradhs]

I'm in to help if this gets organized enough and we can all focus on specific areas/goals.

I think a quick way to hack it will be to packet capture while an update is being downloaded and installed. If they get the file to one device and that device then has to put to another in open text, bingo... User, pass, directories, etc...

Who's still on old firmware? We need to do what @brianman said, packet capture 24x7 in hopes to catch the car getting files from Tesla and moving them around between the networked devices.

@nlc (and maybe some of our modders...)

How hard (and expensive) would it be to combine your device with a storage mechanism like a USB hard drive? With a week or two of log data, it would be much easier to see patterns.

 

[brianman]

We need to do what @brianman said, packet capture 24x7 in hopes to catch the car getting files from Tesla and moving them around between the networked devices.

That's more than I said, but that's a good idea too.

 

[HankLloydRight]

I think a quick way to hack it will be to packet capture while an update is being downloaded and installed. If they get the file to one device and that device then has to put to another in open text, bingo... User, pass, directories, etc...

It the developers are worth their weight in salt, it's all done via SSH/SCP, so no plain text login credentials.

 

[wonko]

I will join in as soon as my car arrives. I have hacked a few protocols and I am positive that we will have quite some power through this link. At least until a software upgrade will plug that hole.

The X11 port may actually be insanely useful if we manage to put graphics over the Tesla graphics, which may very well be possible. X11 does have all we need, and according to the Tesla Browser data, it uses X11/Qt.

Extracting the parameters from the USP block can be done using WireShark with the right filter setting to get only a single packet type. Then, change something in the car, and check if the values in the package change.

Lastly, since the ssh port seem open, it would be interesting to see if any one of the devices remotely logs into another device after a reset. That would bring us the logging data on a silver platter.

- - - Updated - - -

USP -> I meant UDP

 

[widodh]

I sniffed the WiFi traffic for some time and all the communications went over OpenVPN, so there wasn't anything useful in there.

The internal network is not encrypted, but I doubt you'll see the firmware flying over that network.

It might be more successful to actually open the center screen and get out the storage device which is probably a 32GB SSD with some crazy specs.

 

[pgiralt]

It seems I am alone to work on ethernet !?? I need help, no one to investigate with me ? :smile:
It's really easy with a 4 pin 2 row 2mm pitch header to build the ethernet cable and connect to the car !

I tried building a cable but I guess the header I bought is not the right one because the pins seem to be too thick to fit into that connector. Either that, or I'm just afraid of breaking it. Can you point out where you got the header you used? Soldering the wire onto those little pins without melting the plastic that holds the header was a challenge so I was bummed when I wasn't able to get it to fit into the connector.

 

[wonko]

Pinout :

View attachment 44438

AFAIK, this is a standard M8 Ethernet connector that should be available via the usual resources (Farnell, RS, etc.). There are complete M12-to-RJ cables out there, but I have not verified the pin-out:

http://infosys.beckhoff.com/english...ng/html/bt_ec_cabling_components_plug.htm&id=

 

[Mark Petersen]

can you try look at what is being transmitted when the car is off
and when it is booting

 

[markwj]

AFAIK, this is a standard M8 Ethernet connector that should be available via the usual resources (Farnell, RS, etc.). There are complete M12-to-RJ cables out there, but I have not verified the pin-out:

http://infosys.beckhoff.com/english...ng/html/bt_ec_cabling_components_plug.htm&id=

Are you sure?

We're guessing Fakra (not M8). But unable to find specific variant.

 

[wonko]

Are you sure? We're guessing Fakra (not M8). But unable to find specific variant.

No, I am not sure. I was just guessing from the few photos that I saw. I will hopefully get my car next week and then I will do a more extensive search.

Who knows, maybe the European models have different plugs than the US models here as well.