Automotive Ethernet and SOME/IP

State: modelled. SOME/IP, SOME/IP-SD, SOME/IP-TP and DoIP are read frame by frame as Wireshark's tshark 4.2.2 reads them; link load equals tshark's io,stat; the SOME/IP node is checked against vsomeip 3.7.6; live capture runs through Wireshark's dumpcap. Payload decoding rests on the AUTOSAR specification and unit tests only: no independent SOME/IP payload serialiser was available. No vendor tool, customer project, vendor logger or vehicle network was tried, and nothing has run on Windows.

Open a capture

.pcap and .pcapng files open in the Ethernet Trace editor; use Open as Ethernet Trace for .cap. The reader takes pcap in both byte orders and resolutions and pcapng with its sections and interfaces; Ethernet II (with FCS), stacked VLAN tags, Linux cooked capture, raw IP and loopback; IPv4 and IPv6 with fragments reassembled; UDP; and TCP streams in order, with holes reported and the stream picked up again.

The editor has tabs Messages, DoIP, DLT, Services, SD Timeline, Statistics, Link Load and Problems, with background reading, progress and cancel.

SOME/IP

SOME/IP is found on the SD port, on the endpoints the capture's own offers and subscriptions announce, on the endpoints the AUTOSAR description names, or by its structure; each message says which.

• Messages: every message type and return code named, several messages per datagram, SOME/IP-TP segments reassembled, requests paired with their response or error and the response time.
• Payloads decoded from the workspace's ARXML: service interfaces, SOME/IP deployments and serialization properties; booleans, integers, floats, strings, fixed and dynamic arrays, structs and unions, with length fields, alignment and either byte order; value labels and linear scalings with units. What is not interpreted (TLV, C++ implementation data types, application data types, Classic Platform PDU payloads and others) is listed in the Problems tab with its file and line, never guessed.
• Filter with service, method, client, session, iv, type, rc, len, src, dst, addr, sport, dport, port, proto, vlan, name and the flags sd, tp, event, problem, unanswered, e2e and e2efail.
• Statistics per method and event: requests, responses, errors, unanswered requests, response times, notification intervals per sender, TP segments and bytes.
• E2E on protected events: see E2E and SecOC.

Service discovery

• Services tab: each service instance with who offered it, its endpoints, offers sent, last TTL, first and last offer and its state at the end (offered, stopped, TTL expired), and under it each eventgroup subscription with its state (acknowledged, refused, not answered, stopped, expired). Subscriptions to services never offered are listed too.
• SD Timeline tab: every entry in order with sender, receiver, service and eventgroup names, TTL, options and the packet of its answer; reboots of a sender.
• Double-click a service or a subscription for its messages.

DoIP in captures

The DoIP tab reads UDP and TCP on port 13400 with the same codec the diagnostics use: each message with its generic header, payload type by name, sender, logical addresses and fields (vehicle identification, routing activation with every response code, alive check, entity status, power mode, diagnostic messages, acknowledgements with every NACK code, generic header NACKs). The UDS service of each diagnostic message is named. Answers are paired and timed, including a UDS request's final response after "response pending". Messages split over or joined in TCP segments are read at the segment that completes them. DoIP over TLS on port 3496 is listed as encrypted, never decoded.

Link load

The Link Load tab shows each capture interface, and each VLAN when frames are tagged, in intervals of 10 ms, 100 ms, 1 s, 10 s or 60 s (the Interval button): frames, bytes, Mbit/s and load, with the bit rate of SOME/IP, SOME/IP-SD, DoIP, DLT and other traffic. Load adds IEEE 802.3's per-frame overhead over the link speed from the capture's if_speed, or one you set with Link Speed... (10 Mbit/s to 10 Gbit/s). An interval over capacity is marked. Opening an interval shows the Messages tab there.

Capture live

1. Run Start Ethernet Capture.... It runs your Wireshark dumpcap (neuralInverse.automotive.dumpcapPath, PATH, then Wireshark's install folders) as a separate process.
2. Pick the interface from dumpcap's list and, optionally, a capture filter.
3. A live Ethernet Trace tab shows everything above as packets arrive.
4. Stop Ethernet Capture, then Save Ethernet Capture As... to keep it as pcapng. Closing an unsaved capture asks.

No capture library is bundled; on Windows, Wireshark's installer installs Npcap.

SOME/IP client and simulated services

Start SOME/IP Node starts the Editor's SOME/IP node on the address you pick (or neuralInverse.automotive.someip.localAddress), over UDP and TCP, with service discovery on the SD port and multicast group. Stop SOME/IP Node stops it. The SD timing, client ID and request timeout come from the neuralInverse.automotive.someip.* settings (see Reference).

As a client:

• Find SOME/IP Service...; offers tracked with their endpoints;
• Call SOME/IP Method... over UDP or TCP, with the payload as JSON from the description's types (physical values where a linear scaling applies, the raw value shown as you type) or hex, and the decoded response or return code; fire and forget; SOME/IP-TP for large requests;
• Subscribe to SOME/IP Eventgroup... and Stop a SOME/IP Subscription, renewed on every offer.

As a server, for rest-of-system simulation:

• Simulate SOME/IP Service... offers a service from the description, with initial repetitions and cyclic offers, answers finds and acknowledges subscriptions;
• Set SOME/IP Method Response... sets the response, an error return code or E_NOT_READY; field getters and setters work, and a set notifies;
• Send SOME/IP Event... sends to the subscribers, with SOME/IP-TP for large events;
• Stop Simulating SOME/IP Service... stops the offer.

The SOME/IP panel shows the node, offered services, its subscriptions, the simulated services with their subscribers, and its latest messages.

Ethernet topology

Show Ethernet Topology opens the Ethernet Topology view in the SOME/IP panel: the Ethernet clusters of the workspace's AUTOSAR files as a tree, with each channel's VLANs, the ECUs and machines on it, their controllers (MAC address, coupling ports, VLAN memberships, the port at the other end) and connectors, the SOME/IP service instances each provides and consumes, the switches and network endpoints. Only what the description states is shown.

Live state is laid over it: "answered service discovery", "seen in" a running capture, "offered by", "offer stopped" and "simulated by the IDE". Opening any item opens its element in the AUTOSAR file.

Not verified: no capture from a vehicle or a vendor logger, no commercial AUTOSAR stack, and no description written by DaVinci, ISOLAR or EB tresos. DoIP is read on ports 13400 and 3496 only. The SOME/IP node offers with the settings' timing, not the description's. The live load is that of what dumpcap captured.