Yes, have a bus probe running. There is a ton of traffic on that bus and it's quite difficult to isolate the single commands I'm looking for. I suspect what is happening is there are a lot of "acknowledge" CAN messages in response to the code I'm interested, lock unlock all doors.
I'll keep searching. Maybe I'm close and just need some more focus time to zero in in the right ones.