I am not an electrical engineer or EE student; I'm a diagnostic technician. AFAIK, a CAN transceiver receives bits by measuring voltage between the network and its ground/low reference (high impedance, minimal current flow?)
When it transmits it pulls the bus to its dominant or recessive logical voltage levels. This could be 3.5 volts. The CAN high and low lines being connected by 60 ohms of terminating resistance could cause a current flow through the CAN transceiver.
The voltage drop over the line could then indicate a transmission is occurring.
But if the transceiver has a high impedance on the low side the current flow will be extremely minimal. The transceiver has to supply enough current to maintain the logical voltage threshold with as much as 50 other nodes sampling it and a 60 ohm short between the two.
I don't know, I just can't tell if it would work.
It's useful because CAN nodes sometimes fail to communicate or to send a message when an event occurs and without detailed introspection of the bus traffic this is opaque. Even if the traffic was decided there is no source address to most communication, making it further opaque where a failure to transmit occurred. CAN networks are extremely busy with general chatter even when a node is inactive so it can't be seen when one starts and stops transmitting.
Best Answer
You can easily detect if a node is sending if you hook up something to the Tx pin on the MCU/controller. There is only traffic there if the node is sending, otherwise it is 0V.
So you could build a test rig where you monitor the voltage of the Tx pin of the node, a voltage logger etc with time stamps. If you can compare this with the time stamps in your CAN bus log, you should be able to determine which node that sent a specific message, regardless of the contents.
For example many CAN protocols like CANopen have a boot-up message per node. You would be able to sync both a voltage logger and a CAN logger to such a boot-up message and use it as timing reference for all communication.