--- title: "Automotive Ethernet and SOME/IP" --- # Automotive Ethernet and SOME/IP Open pcap and pcapng captures as traces with SOME/IP and DoIP decoded from the AUTOSAR description, follow service discovery, measure link load, capture live through your dumpcap, act as a SOME/IP client or simulated service, and see the description's Ethernet topology with live state. **State:** modelled. SOME/IP, SOME/IP-SD, SOME/IP-TP and DoIP are read frame by frame as Wireshark's tshark 4.2.2 reads them; link load equals tshark's io,stat; the SOME/IP node is checked against vsomeip 3.7.6; live capture runs through Wireshark's dumpcap. Payload decoding rests on the AUTOSAR specification and unit tests only: no independent SOME/IP payload serialiser was available. No vendor tool, customer project, vendor logger or vehicle network was tried, and nothing has run on Windows. ## Open a capture `.pcap` and `.pcapng` files open in the **Ethernet Trace** editor; use **Open as Ethernet Trace** for `.cap`. The reader takes pcap in both byte orders and resolutions and pcapng with its sections and interfaces; Ethernet II (with FCS), stacked VLAN tags, Linux cooked capture, raw IP and loopback; IPv4 and IPv6 with fragments reassembled; UDP; and TCP streams in order, with holes reported and the stream picked up again. The editor has tabs **Messages**, **DoIP**, **DLT**, **Services**, **SD Timeline**, **Statistics**, **Link Load** and **Problems**, with background reading, progress and cancel. ## SOME/IP SOME/IP is found on the SD port, on the endpoints the capture's own offers and subscriptions announce, on the endpoints the AUTOSAR description names, or by its structure; each message says which. - **Messages:** every message type and return code named, several messages per datagram, SOME/IP-TP segments reassembled, requests paired with their response or error and the response time. - **Payloads** decoded from the workspace's ARXML: service interfaces, SOME/IP deployments and serialization properties; booleans, integers, floats, strings, fixed and dynamic arrays, structs and unions, with length fields, alignment and either byte order; value labels and linear scalings with units. What is not interpreted (TLV, C++ implementation data types, application data types, Classic Platform PDU payloads and others) is listed in the Problems tab with its file and line, never guessed. - **Filter** with `service`, `method`, `client`, `session`, `iv`, `type`, `rc`, `len`, `src`, `dst`, `addr`, `sport`, `dport`, `port`, `proto`, `vlan`, `name` and the flags `sd`, `tp`, `event`, `problem`, `unanswered`, `e2e` and `e2efail`. - **Statistics** per method and event: requests, responses, errors, unanswered requests, response times, notification intervals per sender, TP segments and bytes. - **E2E** on protected events: see [E2E and SecOC](https://neuralinverse.com/docs/modules/automotive/e2e-and-secoc/). ## Service discovery - **Services** tab: each service instance with who offered it, its endpoints, offers sent, last TTL, first and last offer and its state at the end (offered, stopped, TTL expired), and under it each eventgroup subscription with its state (acknowledged, refused, not answered, stopped, expired). Subscriptions to services never offered are listed too. - **SD Timeline** tab: every entry in order with sender, receiver, service and eventgroup names, TTL, options and the packet of its answer; reboots of a sender. - Double-click a service or a subscription for its messages. ## DoIP in captures The **DoIP** tab reads UDP and TCP on port 13400 with the same codec the diagnostics use: each message with its generic header, payload type by name, sender, logical addresses and fields (vehicle identification, routing activation with every response code, alive check, entity status, power mode, diagnostic messages, acknowledgements with every NACK code, generic header NACKs). The UDS service of each diagnostic message is named. Answers are paired and timed, including a UDS request's final response after "response pending". Messages split over or joined in TCP segments are read at the segment that completes them. DoIP over TLS on port 3496 is listed as encrypted, never decoded. ## Link load The **Link Load** tab shows each capture interface, and each VLAN when frames are tagged, in intervals of 10 ms, 100 ms, 1 s, 10 s or 60 s (the **Interval** button): frames, bytes, Mbit/s and load, with the bit rate of SOME/IP, SOME/IP-SD, DoIP, DLT and other traffic. Load adds IEEE 802.3's per-frame overhead over the link speed from the capture's `if_speed`, or one you set with **Link Speed...** (10 Mbit/s to 10 Gbit/s). An interval over capacity is marked. Opening an interval shows the Messages tab there. ## Capture live 1. Run **Start Ethernet Capture...**. It runs your Wireshark `dumpcap` (`neuralInverse.automotive.dumpcapPath`, PATH, then Wireshark's install folders) as a separate process. 2. Pick the interface from dumpcap's list and, optionally, a capture filter. 3. A live Ethernet Trace tab shows everything above as packets arrive. 4. **Stop Ethernet Capture**, then **Save Ethernet Capture As...** to keep it as pcapng. Closing an unsaved capture asks. No capture library is bundled; on Windows, Wireshark's installer installs Npcap. ## SOME/IP client and simulated services **Start SOME/IP Node** starts the Editor's SOME/IP node on the address you pick (or `neuralInverse.automotive.someip.localAddress`), over UDP and TCP, with service discovery on the SD port and multicast group. **Stop SOME/IP Node** stops it. The SD timing, client ID and request timeout come from the `neuralInverse.automotive.someip.*` settings (see [Reference](https://neuralinverse.com/docs/modules/automotive/reference/)). As a client: - **Find SOME/IP Service...**; offers tracked with their endpoints; - **Call SOME/IP Method...** over UDP or TCP, with the payload as JSON from the description's types (physical values where a linear scaling applies, the raw value shown as you type) or hex, and the decoded response or return code; fire and forget; SOME/IP-TP for large requests; - **Subscribe to SOME/IP Eventgroup...** and **Stop a SOME/IP Subscription**, renewed on every offer. As a server, for rest-of-system simulation: - **Simulate SOME/IP Service...** offers a service from the description, with initial repetitions and cyclic offers, answers finds and acknowledges subscriptions; - **Set SOME/IP Method Response...** sets the response, an error return code or E_NOT_READY; field getters and setters work, and a set notifies; - **Send SOME/IP Event...** sends to the subscribers, with SOME/IP-TP for large events; - **Stop Simulating SOME/IP Service...** stops the offer. The **SOME/IP** panel shows the node, offered services, its subscriptions, the simulated services with their subscribers, and its latest messages. ## Ethernet topology **Show Ethernet Topology** opens the **Ethernet Topology** view in the SOME/IP panel: the Ethernet clusters of the workspace's AUTOSAR files as a tree, with each channel's VLANs, the ECUs and machines on it, their controllers (MAC address, coupling ports, VLAN memberships, the port at the other end) and connectors, the SOME/IP service instances each provides and consumes, the switches and network endpoints. Only what the description states is shown. Live state is laid over it: "answered service discovery", "seen in" a running capture, "offered by", "offer stopped" and "simulated by the IDE". Opening any item opens its element in the AUTOSAR file. **Not verified:** no capture from a vehicle or a vendor logger, no commercial AUTOSAR stack, and no description written by DaVinci, ISOLAR or EB tresos. DoIP is read on ports 13400 and 3496 only. The SOME/IP node offers with the settings' timing, not the description's. The live load is that of what dumpcap captured.