How to Read pcapng Automotive Ethernet Diagnostic Logs

Wireshark Clean Multi-ECU Baseline

Generated from the redacted sample for EVID-CLEAN-SUBWINDOW-SRS-01.

Wireshark Compact Success Slice

Generated from the redacted sample for EVID-CLEAN-SUCCESS-WCM-01.

Wireshark Mixed Node-Flow Snapshot

Generated from the redacted sample for EVID-MIXED-TEACHING-NODEFLOW-01.

Analyzer Summary Screenshot

Generated from the redacted teaching windows used by the pcapng reading page.

A public-safe multi-ECU baseline can come from a derived subwindow, not a whole file

Multi-ECU DoIP readout before the first pending state

Evidence reference: EVID-CLEAN-SUBWINDOW-SRS-01

This derived window is cut from a longer real vehicle capture and shows why a clean teaching sample should be defined at subwindow level rather than file level.

Evidence signals

• The window contains routing activation, UDS request traffic, and positive SID 0x62 responses across multiple target nodes.
• It stops before the first pending state appears, so the reader can study the clean interaction pattern first.
• Because it is a derived window, it reflects real mixed-network captures without forcing the impossible standard of an all-DoIP full file.

This is the strongest example in the project for explaining that useful public evidence often comes from a well-chosen slice of a long real capture.

A second clean baseline can be much shorter than a full successful file

WCM readout window with clean activation and positive UDS replies

Evidence reference: EVID-CLEAN-SUCCESS-WCM-01

This compact window shows that a public-safe success baseline does not need a long flash or data session. A short activation-plus-read sequence can be enough to teach what a healthy DoIP exchange looks like.

Evidence signals

• The window contains Routing Activation Request and Response before the first UDS read.
• The tester issues SID 0x22 and receives positive SID 0x62 responses without an actionable negative response in the same compact slice.
• Because the sample is short and clean, it is useful as a baseline contrast against later pending, reject, or disconnect cases.

This complements the longer SRS-derived baseline by showing that a short, well-chosen success slice is often the clearest way to teach packet reading.

A mixed teaching window can stay public-safe while still showing real protocol density

Node-flow case with repeated read and status transitions across multiple targets

Evidence reference: EVID-MIXED-TEACHING-NODEFLOW-01

This is a stronger mixed-signal teaching case because it shows multiple protocol pairs in one compact slice. The reader has to track more than one target and more than one service family, but the window still stays readable.

Evidence signals

• The window contains repeated SID 0x22 / SID 0x62 read pairs and SID 0x19 / SID 0x59 status-style pairs.
• More than one target node appears in the same compact slice, which makes it realistic without becoming opaque.
• The window stays free of an immediate actionable negative response, so it works as a teaching sample rather than a failure-only sample.

This is the closest current evidence sample to the real-world situation where a useful capture is not purely simple, but still readable if the engineer follows service families and target roles in order.

Symptom: The file is dismissed as unreadable because it contains too many packets.

Packet truth: A smaller subwindow can still preserve a clean and teachable protocol story.

Risk: The analyst gives up before extracting a useful baseline from the file.

Symptom: The first visible noise on screen is mistaken for the main diagnostic story.

Packet truth: The useful path usually starts at routing activation and the first meaningful request/response chain, not at the first random hex block.

Risk: Manual reading effort is spent on background traffic instead of on the diagnostic branch.