Home

/

Knowledge Base

/

How to Read pcapng Automotive Ethernet Diagnostic Logs

Knowledge Base

Last Updated: 2026-07-02

How to Read pcapng Automotive Ethernet Diagnostic Logs

If you are new to automotive Ethernet captures, the first obstacle is turning raw packets into a usable diagnostic story.

What to Look For

Start by identifying whether the file contains vehicle discovery, routing activation, and diagnostic request or response exchanges rather than generic background traffic.

Once those flows are clear, the next step is relating them to the point where flashing, coding, or diagnostics stopped behaving as expected.

Why Structure Matters

Reading thousands of hex bytes line by line is slow and error-prone when the real goal is understanding sequence, direction, and failure point.

A parser that restructures the capture into sessions and anomalies gives workshops and engineers a faster path to action.

A Practical Reading Order

Start at the beginning of the diagnostic exchange: identify discovery traffic, confirm routing activation, then trace the first meaningful UDS request and follow the response chain forward.

Do not start by scrolling randomly through payload bytes. Start by finding session boundaries and control transitions.

When an Online Parser Helps

If the file is technically readable but operationally too dense, the best next step is to convert it into a timeline of requests, responses, and anomalies.

That is the gap between having a capture and understanding why the vehicle interaction failed.

Capture-Backed Evidence

These examples are drawn from real capture files available in the project evidence pool. They give the article something stronger than generic protocol theory.

A public-safe multi-ECU baseline can come from a derived subwindow, not a whole file

Multi-ECU DoIP readout before the first pending state

Evidence reference: EVID-CLEAN-SUBWINDOW-SRS-01

Node roles in this case

  • tester: the diagnostic client
  • gateway: the DoIP entry point
  • target ECU group: multiple queried diagnostic nodes

This derived window is cut from a longer real vehicle capture and shows why a clean teaching sample should be defined at subwindow level rather than file level.

Evidence signals

  • The window contains routing activation, UDS request traffic, and positive SID 0x62 responses across multiple target nodes.
  • It stops before the first pending state appears, so the reader can study the clean interaction pattern first.
  • Because it is a derived window, it reflects real mixed-network captures without forcing the impossible standard of an all-DoIP full file.

Timeline

  • Routing activation opens the diagnostic path.
  • The tester queries multiple target nodes with repeated read requests.
  • Several target nodes answer positively before the window ends, preserving a clean baseline for comparison.

This is the strongest example in the project for explaining that useful public evidence often comes from a well-chosen slice of a long real capture.

A second clean baseline can be much shorter than a full successful file

WCM readout window with clean activation and positive UDS replies

Evidence reference: EVID-CLEAN-SUCCESS-WCM-01

Node roles in this case

  • tester: the diagnostic client
  • gateway: the DoIP entry point
  • target ECU: the ECU answering the read requests

This compact window shows that a public-safe success baseline does not need a long flash or data session. A short activation-plus-read sequence can be enough to teach what a healthy DoIP exchange looks like.

Evidence signals

  • The window contains Routing Activation Request and Response before the first UDS read.
  • The tester issues SID 0x22 and receives positive SID 0x62 responses without an actionable negative response in the same compact slice.
  • Because the sample is short and clean, it is useful as a baseline contrast against later pending, reject, or disconnect cases.

Timeline

  • The tester opens the DoIP path through a routing activation exchange.
  • A read request is sent to the target ECU and acknowledged at the transport level.
  • The target ECU answers positively with SID 0x62, completing a clean teaching-grade loop.

This complements the longer SRS-derived baseline by showing that a short, well-chosen success slice is often the clearest way to teach packet reading.

A mixed teaching window can stay public-safe while still showing real protocol density

Node-flow case with repeated read and status transitions across multiple targets

Evidence reference: EVID-MIXED-TEACHING-NODEFLOW-01

Node roles in this case

  • tester: the diagnostic client
  • primary target: the first node in the read/status cycle
  • secondary target: a second node reached in the same window
  • tertiary target: another node appearing later in the same sequence

This is a stronger mixed-signal teaching case because it shows multiple protocol pairs in one compact slice. The reader has to track more than one target and more than one service family, but the window still stays readable.

Evidence signals

  • The window contains repeated SID 0x22 / SID 0x62 read pairs and SID 0x19 / SID 0x59 status-style pairs.
  • More than one target node appears in the same compact slice, which makes it realistic without becoming opaque.
  • The window stays free of an immediate actionable negative response, so it works as a teaching sample rather than a failure-only sample.

Timeline

  • The tester queries one target and receives positive read responses.
  • The same flow then includes a status-style request/response pair before the sequence moves to another target node.
  • A second and then a third target appear with similar positive read traffic, forcing the reader to follow the protocol story across nodes rather than reading one packet in isolation.

This is the closest current evidence sample to the real-world situation where a useful capture is not purely simple, but still readable if the engineer follows service families and target roles in order.

Common Misreads

These are the interpretation traps that real packet evidence helps avoid.

  • Starting from random hex payloads is slower than starting from session boundaries and transport events.
  • A large pcapng file can still be 'healthy' and worth reading even when the root cause is not visible in the first screen of packets.
  • If a capture already shows active nodes, transport version, and pending or negative responses, you are past the point of simple file validation.

Related Diagnostic Guides

Use nearby guides to move from protocol filtering to root-cause troubleshooting without leaving the knowledge base.

Wireshark Filter for Port 13400 and DoIP TrafficHow to Diagnose UDS NRC 0x31 Request Out Of RangeHow to Read UDS NRC 0x78 Response Pending Timeouts

Frequently Asked Questions

What should I identify first in a DoIP pcapng file?

Start with discovery, routing activation, and the first meaningful UDS request or response chain. Those markers define the session structure.

When should I stop reading packets manually?

Once you know the file contains the right traffic but can no longer track sequence, failure point, or control transitions reliably, it is time to switch to a parser.

Open the analyzer and turn raw packets into a readable timeline

Best for first-pass triage when the file is readable but operationally too dense to interpret quickly.

Browse all seeded guides