1. Preserve the incident window
Keep a read-only original with logger model, channel, timestamp basis, interface mode and export settings. Work on a small copy. Capture files can contain identifiers and operational information: obtain authorization before sharing, and do not assume an online tool needs the whole recording.
Record the equipment state, symptom and source of the trace in the intermittent-fault event report. A decoder cannot reconstruct context that was never recorded.
2. Confirm what the filter could admit
Use the PGN filter checker with an actual target CAN ID and several expected/unexpected IDs. PDU1 destination is not part of its canonical PGN. Source and priority matching can accidentally narrow a filter. The resulting bit test is not a controller configuration: check driver and extended-frame semantics separately.
3. Audit transport before interpreting diagnostics
Feed a BAM incident window to the BAM capture checker. Keep bus and source identifiers distinct. Review missing sequences, duplicates, restarts and contradictory byte/packet counts. A withheld payload is an evidence boundary, not an invitation to zero-fill it. Unsupported directed transport needs an appropriate protocol analyzer.
4. Decode a complete payload, not fragments
Only after preserving a consistent payload should you use the DM1 payload decoder. Keep the originating PGN and source alongside its lamp and DTC fields. CM=1 and unavailable counts must remain explicit. Numeric SPN/FMI output is not an OEM repair instruction or an OBD-II P-code.
5. Review identity history independently
Use the address claim analyzer to inspect competing NAME observations and address movement. A long recording can show legitimate sequential address reuse. A short one can omit the negotiation entirely. Review timing and equipment changes before labeling either observation a collision.
Handover the evidence, not a certainty claim
Copy or print a current result with input bytes, row references, URL and limits. If the input changes, run again: old results are invalidated. Separate a missing captured frame from a proven transmitter failure, and a no-DTC marker from proof of healthy equipment. Changes to a live bus belong to an authorized maintenance procedure, outside these tools.