An error detector is configured to identify transmission errors and maintain a transmit error counter (TEC) value and corresponding network identifier for each of a plurality of electronic control units (ECUs) connected to a network bus. The error detector is configured to adjust the TEC values for the ECUs based on error frames and inform an intrusion detection system when an ECU changes error state. In this manner, the error detector is configured to help identify and attribute attacks by an impersonating node when a message is received containing the network identifier of a legitimate ECU that is in a Bus Off state.