Diagnostic Knowledge Base

Port 13400 is the default destination engineers look for when narrowing Wireshark captures down to Diagnostic over IP traffic.

NRC 0x31 usually means the ECU received a service request whose parameters or preconditions did not fit the allowed range.

In UDS semantics, NRC 0x78 indicates that the ECU has not completed processing the request and will provide a later response.

BMW ENET and similar DoIP workflows can fail either during routing activation itself or immediately after activation when the session never becomes operationally stable.

Routing Activation analysis starts with the response and TCP stream state. A rejection before UDS, a confirmation-required state, and later session instability are different branches that require different evidence.

A 0x8002 acknowledgement proves that the DoIP entity accepted the diagnostic message. It does not prove the request reached a vehicle bus or that an ECU received or answered it.

This retained window is wider than the ACK-only page: it shows gateway acknowledgement and later downstream-path activity, but does not establish causal propagation or final target completion.

If you are new to automotive Ethernet captures, the first obstacle is turning raw packets into a usable diagnostic story.

DoIP Entity Status Request (payload type 0x4001) queries basic DoIP entity attributes. The resulting response describes gateway-level entity state but cannot prove downstream ECU reachability, forwarding, or root cause.

A UDS 0x10 response proves only the matching response observed inside its approved, redacted evidence window. It does not prove later services, session longevity, or ECU root cause.