Detect if a CAN node is transmitting or receiving
You can easily detect if a node is sending if you hook up something to the Tx pin on the MCU/controller. There is only traffic there if the node is sending, otherwise it is 0V.

So you could build a test rig where you monitor the voltage of the Tx pin of the node, a voltage logger etc with time stamps. If you can compare this with the time stamps in your CAN bus log, you should be able to determine which node that sent a specific message, regardless of the contents.

For example many CAN protocols like CANopen have a boot-up message per node. You would be able to sync both a voltage logger and a CAN logger to such a boot-up message and use it as timing reference for all communication.