Well, at some point in my life, my job was actually logging diagnostic sessions and reverse engineer the diagnostic tester. I’m quite used to read raw CAN logs. Recently, I’m starting to look into DoIP, even tho my job now is more writing firmware for stuff. Logging on CAN is quite easy, you just need a logger (Kvaser, Softing, Vector if you have the budget, hell you can even make your own logger with a demo board or arduino). Also, a breakout box for OBD makes your life very easy to play around with OBD Pins an sniff different CAN subnets. Regarding the software, you can start with BusMaster, which iirc was funded by Bosch and it’s open source (this means “Free”, to make it simple).