ISO 13400
DoIP
Diagnostics over IP — UDS transported over Automotive Ethernet.
Overview
DoIP carries UDS payloads over TCP (port 13400) and UDP (vehicle discovery). It enables fast flashing and remote diagnostics, and is mandatory for many newer ECUs that no longer expose the full diagnostic stack on CAN.
Frame / message structure
| Field | Bits | Description |
|---|---|---|
| Protocol Ver | 8 | 0x02 for ISO 13400-2:2012 |
| Inverse Ver | 8 | Bitwise NOT of version |
| Payload Type | 16 | e.g. 0x8001 Diagnostic Message |
| Payload Length | 32 | Length in bytes |
| Payload | var | Source/Target Addr + UDS message |
Byte structure — request & response
DoIP — ISO 13400 (Diagnostic Message)
Frame template
[Ver 1B][~Ver 1B][PayloadType 2B][Length 4B][SrcAddr 2B][TgtAddr 2B][UDS bytes]Request
| Off | Size | Field | Value | Description |
|---|---|---|---|---|
| 0 | 1 B | Protocol Ver | 0x02 | ISO 13400-2:2012. |
| 1 | 1 B | Inverse Ver | 0xFD | Bitwise NOT of version. |
| 2–3 | 2 B | Payload Type | 0x8001 | Diagnostic Message. |
| 4–7 | 4 B | Payload Length | 00 00 00 07 | Length of payload (7 bytes here). |
| 8–9 | 2 B | Source Address | 0E 80 | Tester logical address. |
| 10–11 | 2 B | Target Address | 10 01 | ECU logical address. |
| 12–14 | 3 B | UDS payload | 22 F1 90 | ReadDataByIdentifier VIN. |
Response
| Off | Size | Field | Value | Description |
|---|---|---|---|---|
| 0–7 | 8 B | Header | 02 FD 80 02 00 00 00 05 | Payload Type 0x8002 = Diagnostic Message Positive Ack. |
| 8–9 | 2 B | Source | 10 01 | ECU. |
| 10–11 | 2 B | Target | 0E 80 | Tester. |
| 12 | 1 B | Ack code | 0x00 | 0x00 = ACK; followed by a second 0x8001 frame carrying the UDS reply 62 F1 90 … |
DoIP runs over TCP/13400 for diagnostics and UDP/13400 for vehicle discovery (Payload Type 0x0001 / 0x0004).
Use cases
- · High-speed ECU flashing
- · Remote diagnostics
- · Pass-through workshop tools
Pros
- High bandwidth
- Standard networking stack
- Routing through gateways
Cons
- Requires Ethernet
- More complex than direct CAN diagnostics
Request / Response examples
Routing activation
Request
02FD00050000000B0E80000000000000000000
Response
02FD0006000000090E8000001000000000
Tester (0x0E80) requests routing; gateway responds with success code 0x10.