Byte-Level Reference
Automotive protocols — request & response, byte by byte
A single-page engineering reference for CAN, CAN-FD, LIN, FlexRay, Automotive Ethernet, TCP/IP, MOST and SAE J1939. Field-by-field tables, example hex frames and UDS examples ready for CANoe / CAPL / Python (Scapy) / DoIP stacks.
CAN (Classical)
ISO 11898-1 / -2Differential 2-wire bus, max 1 Mbit/s, 0–8 byte payload. Broadcast — request/response is implemented by higher protocols (UDS, J1939).
Frame format
[SOF:1b][ID:11b][RTR:1b][IDE:1b][r0:1b][DLC:4b][Data:0–8B][CRC:15b][CRC-Del:1b][ACK:1b][ACK-Del:1b][EOF:7b][IFS:3b]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0 | SOF | 1 bit | 0 | Start of frame (dominant). |
| 1 | ID (Std) | 11 bits | 0x7E0 | Arbitration ID, lower = higher priority. |
| 12 | RTR | 1 bit | 0 | 0 = data, 1 = remote. |
| 13 | IDE | 1 bit | 0 | 0 = standard, 1 = extended (29-bit ID). |
| 14 | r0 | 1 bit | 0 | Reserved. |
| 15 | DLC | 4 bits | 0x8 | Data length 0–8. |
| 19 | Data | 0–8 B | 02 22 F1 90 CC CC CC CC | Application payload. |
| — | CRC | 15 bits | auto | CRC over SOF…Data. |
| — | ACK Slot | 1 bit | 0 | Recessive by sender, dominant by receivers. |
| — | EOF | 7 bits | 1111111 | End of frame (recessive). |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 1 | ID (Std) | 11 bits | 0x7E8 | Reply ID per app protocol (e.g. UDS 0x7E8). |
| 15 | DLC | 4 bits | 0x8 | Data length. |
| 19 | Data | 0–8 B | 06 62 F1 90 57 30 4C 00 | Reply payload. |
Example request frames
UDS RDBI VIN — request
07E00222F190CCCCCCCC
ID=0x7E0, DLC=8, ISO-TP SF len=2, SID=0x22, DID=0xF190
Example response frames
UDS RDBI VIN — positive (FF)
07E8101462F19057304C
ID=0x7E8, ISO-TP First-Frame, total len=20, SID=0x62, DID=0xF190, VIN start 'W0L'
UDS example — ReadDataByIdentifier (0x22)
RDBI 0x22 (VIN)
0222F190
PCI=02, SID=22, DID=F190
Positive 0x62
1462F19057304C303030313233343536373839
FF len=0x14, VIN 'W0L00012345 6789'
Negative 0x7F 22 31
037F2231
NRC 0x31 = requestOutOfRange
- Standard frame = 11-bit ID, extended = 29-bit ID (IDE=1).
- ISO-TP (ISO 15765-2) splits >7 byte UDS payloads into SF / FF / CF / FC frames.
- Functional broadcast for OBD-II = 0x7DF, ECU replies 0x7E8…0x7EF.
CAN-FD
ISO 11898-1:2015Same arbitration as CAN; data phase up to ~5 Mbit/s, payload up to 64 bytes, CRC 17/21-bit.
Frame format
[SOF][ID:11/29b][FDF:1b][res][BRS:1b][ESI:1b][DLC:4b][Data:0–64B][CRC:17/21b][CRC-Del][ACK][EOF]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 1 | ID | 11/29 bits | 0x18DA F1 01 | Arbitration ID. |
| — | FDF | 1 bit | 1 | 1 = CAN-FD frame. |
| — | BRS | 1 bit | 1 | 1 = switch to fast bit rate during data phase. |
| — | ESI | 1 bit | 0 | Error state indicator (0=active, 1=passive). |
| — | DLC | 4 bits | 0xF (=64) | 0..8 = bytes; 9..15 ⇒ 12,16,20,24,32,48,64. |
| — | Data | 0–64 B | 10 14 62 F1 90 57 30 4C 30 30 … | Payload. |
| — | Stuff cnt | 4 bits | auto | Required for 17/21-bit CRC. |
| — | CRC | 17 / 21 b | auto | 17 b for ≤16 B payload, 21 b for >16 B. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 1 | ID | 11/29 bits | 0x18DA 01 F1 | Reply ID (e.g. 0x18DAF101 → 0x18DA01F1). |
| — | DLC | 4 bits | 0xA (=24) | Encoded payload size. |
| — | Data | 0–64 B | 62 F1 90 … | Reply payload. |
Example request frames
UDS RDBI VIN over CAN-FD (29-bit)
18DAF101|0222F190
Phys addr tester→ECU, SF UDS 22 F1 90
Example response frames
Positive RDBI VIN
18DA01F1|1462F19057304C303030313233343536373839
Single 24-byte CAN-FD frame, no segmentation needed.
LIN
ISO 17987 (LIN 2.x)Single-wire master/slave bus, ≤19.2 kbit/s, deterministic schedule table. One master, ≤15 slaves.
Frame format
[Break ≥13b][Sync 0x55][PID 1B] | [Data 1–8B][Checksum 1B]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| — | Break | ≥13 bit | 0x00 | Dominant break to start frame. |
| 0 | Sync | 1 B | 0x55 | Fixed 0x55, used by slaves for clock recovery. |
| 1 | PID | 1 B | 0xC1 (ID=0x01) | 6-bit ID + 2-bit parity. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0..N-1 | Data | 1–8 B | 12 34 56 78 | Slave-supplied data (length set by frame ID). |
| N | Checksum | 1 B | 0x77 | Classic = sum of data; Enhanced = sum(PID+data). |
Example request frames
Header for ID 0x01
0055C1
Break, Sync, PID(0x01)+parity
Example response frames
Slave reply 4 B + cs
1234567877
Data 12 34 56 78, classic CS 0x77
- Wakeup = ≥250 µs dominant pulse, sleep command = master sends ID 0x3C with data 0x00 first byte.
FlexRay
ISO 17458 / ISO 10681Time-triggered + event-triggered, dual-channel, 10 Mbit/s per channel. Static + dynamic segment per cycle.
Frame format
[Header 5B][Payload 0–254B][Trailer CRC 3B]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0 | Status bits | 5 bits | 0b00010 | Reserved, payload preamble, null, sync, startup. |
| 0 | Frame ID | 11 bits | 0x005 | Slot identifier (1..2047). |
| 1 | Payload length | 7 bits | 0x08 (16 B) | Words (16-bit) of payload, 0..127. |
| 2 | Header CRC | 11 bits | auto | CRC over Frame ID + length + sync/startup. |
| 3 | Cycle count | 6 bits | 0x0C | 0..63 communication cycle. |
| 5 | Payload | 0–254 B | AA BB CC DD … | Application data, big-endian. |
| tail | Frame CRC | 24 bits | auto | CRC over header + payload. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0–4 | Header | 5 B | FrameID=0x006 | Different scheduled slot for the reply. |
| 5… | Payload | var | 01 OK … | Reply payload (deterministic timing per cycle). |
| tail | CRC | 3 B | auto | Trailer CRC. |
Example request frames
Slot 5, 8 B payload
02808Axx0CAABBCCDDEEFF0011yyyyyy
Example response frames
Slot 6, 8 B reply
02808Cxx0C0102030405060708yyyyyy
- No on-demand request — static slots scheduled in the FIBEX/AUTOSAR schedule.
Automotive Ethernet (SOME/IP + DoIP)
IEEE 802.3bw / 802.3bp + ISO 13400 + AUTOSAR SOME/IP100/1000BASE-T1 single-pair Ethernet. Diagnostics on TCP/UDP 13400 (DoIP); service-oriented comm via SOME/IP on UDP 30490.
Frame format
[Preamble 7B][SFD 1B][DstMAC 6B][SrcMAC 6B][802.1Q? 4B][EtherType 2B][IPv4 20B][TCP 20B / UDP 8B][SOME/IP 16B + payload | DoIP 8B + payload][FCS 4B]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0–6 | Preamble | 7 B | 55 55 55 55 55 55 55 | 0x55 × 7 sync. |
| 7 | SFD | 1 B | 0xD5 | Start-of-frame. |
| 8–13 | DstMAC | 6 B | 00 11 22 33 44 55 | ECU MAC. |
| 14–19 | SrcMAC | 6 B | AA BB CC DD EE FF | Tester MAC. |
| 20–21 | EtherType | 2 B | 08 00 | 0x0800 IPv4. |
| 22–41 | IPv4 header | 20 B | Proto=6 (TCP) | Src/Dst IP, Proto=6/17. |
| 42–61 | TCP header | 20 B | DstPort=0x3458 | DstPort=13400 for DoIP TCP_DATA. |
| 62–69 | DoIP header | 8 B | 02 FD 80 01 00 00 00 07 | Ver|~Ver|PayloadType|Length. |
| 70–71 | Source addr | 2 B | 0E 80 | Tester logical address. |
| 72–73 | Target addr | 2 B | 10 01 | ECU logical address. |
| 74… | UDS payload | var | 22 F1 90 | ISO 14229 bytes. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 62–69 | DoIP header | 8 B | 02 FD 80 01 00 00 00 17 | Same Ver, PayloadType=0x8001 (DiagMsg) or 0x8002 (Ack). |
| 70–71 | Source | 2 B | 10 01 | ECU. |
| 72–73 | Target | 2 B | 0E 80 | Tester. |
| 74… | UDS reply | var | 62 F1 90 57 30 4C … | 0x62 + DID + data. |
Example request frames
DoIP RDBI VIN — request
02FD8001000000070E80100122F190
PayloadType 0x8001, len=7, src=0x0E80, tgt=0x1001, UDS 22 F1 90
Example response frames
DoIP RDBI VIN — positive
02FD80010000001710010E8062F19057304C303030313233343536373839
PayloadType 0x8001, src=0x1001 (ECU), tgt=0x0E80 (tester), 0x62 + DID + 17-byte VIN
UDS example — ReadDataByIdentifier (0x22)
RDBI VIN
22F190
Positive 0x62
62F19057304C303030313233343536373839
Negative
7F2213
NRC 0x13 = incorrectMessageLengthOrInvalidFormat
- DoIP discovery (UDP 13400): Vehicle Identification Request 0x0001, Announcement 0x0004.
- Routing Activation (TCP) = 0x0005 / 0x0006 BEFORE diagnostic messages.
Ethernet + TCP/IP
IEEE 802.3 + RFC 791 / RFC 793Layer-2 Ethernet II frames carrying IPv4 + TCP/UDP for any application protocol (HTTP, SOME/IP, DoIP, MQTT).
Frame format
[Eth 14B][IPv4 20B][TCP 20B | UDP 8B][App payload]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0–13 | Ethernet hdr | 14 B | … 08 00 | DstMAC + SrcMAC + EtherType. |
| 14 | IP Ver+IHL | 1 B | 0x45 | 0x45 = IPv4 + 5×4=20 B header. |
| 15 | DSCP/ECN | 1 B | 0x00 | QoS / congestion bits. |
| 16–17 | Total Length | 2 B | 0x002C | IP header + payload bytes. |
| 18–19 | Identification | 2 B | 0x1C46 | Used for fragmentation. |
| 20–21 | Flags+FragOff | 2 B | 0x4000 | DF/MF + 13-bit offset. |
| 22 | TTL | 1 B | 0x40 | Time-to-live. |
| 23 | Protocol | 1 B | 0x06 | 6 = TCP, 17 = UDP, 1 = ICMP. |
| 24–25 | Header CSum | 2 B | auto | 1's complement IP header checksum. |
| 26–29 | Src IP | 4 B | C0 A8 01 0A | IPv4 source. |
| 30–33 | Dst IP | 4 B | C0 A8 01 14 | IPv4 destination. |
| 34–35 | Src Port | 2 B | 0xC000 (49152) | TCP/UDP source port. |
| 36–37 | Dst Port | 2 B | 0x3458 (13400) | TCP/UDP dest port. |
| 38–41 | Seq # | 4 B | 0x00000001 | TCP only — sequence number. |
| 42–45 | Ack # | 4 B | 0x00000000 | TCP only — acknowledgement. |
| 46 | Data Off+Flags | 2 B | 0x5018 | Header length (4b) + flags (SYN/ACK). |
| 48–49 | Window | 2 B | 0xFAF0 | TCP receive window. |
| 50–51 | Checksum | 2 B | auto | TCP/UDP checksum (incl. pseudo-hdr). |
| 54… | App payload | var | 02 FD 80 01 … | DoIP / SOME/IP / HTTP … |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 26–29 | Src IP | 4 B | C0 A8 01 14 | Server IP (swapped). |
| 30–33 | Dst IP | 4 B | C0 A8 01 0A | Client IP (swapped). |
| 34–35 | Src Port | 2 B | 0x3458 | Server port (e.g. 13400). |
| 36–37 | Dst Port | 2 B | 0xC000 | Client ephemeral. |
| 46 | Flags | 2 B | 0x5012 | TCP SYN-ACK / ACK / PSH-ACK. |
| 54… | App reply | var | 02 FD 80 01 00 00 00 17 … | Application response bytes. |
Example request frames
TCP SYN to DoIP server (ports only)
C000345800000001000000005002FAF000000000
SrcPort 49152, DstPort 13400, SYN, win=64240
Example response frames
TCP SYN-ACK
3458C00000000064000000025012FAF000000000
SrcPort 13400, DstPort 49152, SYN+ACK, ack=2
MOST
ISO 21806 (MOST25/50/150)Optical/electrical ring for infotainment. Frame divides into Sync (audio/video), Async (packet), Control (function blocks).
Frame format
[Preamble 1B][Boundary 1B][Sync data ≤60B][Async data ≤127B][Control 4B]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0 | Preamble | 1 B | 0x00 | Frame sync byte. |
| 1 | Boundary | 1 B | 0x40 | Sync/Async area boundary descriptor. |
| 2 | Sync area | ≤60 B | — | Isochronous PCM/video samples. |
| 62 | Async area | ≤127 B | FBlockID=0x22 InstID=0x01 FktID=0x100 OpType=0x02 Data | Packet-switched data (FBlock SetGet). |
| tail | Control | 4 B | 01 22 01 00 02 | DeviceID + FBlockID + FktID + OpType. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| tail | Control | 4 B | 01 22 01 00 0C | ACK / Status with same FktID, OpType=Status (0x0C). |
| 62 | Async area | var | — | Optional status block reply. |
Example request frames
Set volume (Audio FBlock 0x22, Fkt 0x100, Set=0x02)
01220101000250
Set value 0x50
Example response frames
Status reply
01220101000C50
Status confirms 0x50
SAE J1939
SAE J1939 (over 29-bit CAN)Heavy-duty vehicle protocol over 29-bit CAN. Identifier carries Priority + PGN + Source Address; payload is fixed by the PGN/SPN catalogue.
Frame format
29-bit CAN ID = [Priority:3b][R:1b][DP:1b][PF:8b][PS:8b][SA:8b] + [Data:0–8B]Request structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| 0 | Priority | 3 bits | 0b110 | 0=highest..7=lowest, normally 6. |
| — | Reserved | 1 bit | 0 | Reserved (0). |
| — | DP | 1 bit | 0 | Data page selector. |
| — | PF | 8 bits | 0xEA (Request PGN 59904) | <240 PDU1 (peer-to-peer); ≥240 PDU2 (broadcast). |
| — | PS | 8 bits | 0x00 (engine) | PF<240 → destination addr, ≥240 → group ext. |
| — | SA | 8 bits | 0xF9 (offboard tester) | Source address. |
| 0–2 | Requested PGN | 3 B | 00 EE 00 (Address Claim) | Little-endian PGN to be requested. |
| 3–7 | Reserved (FF) | 5 B | FF FF FF FF FF | Pad with 0xFF. |
Response structure
| Off | Field | Size | Value | Description |
|---|---|---|---|---|
| — | Priority | 3 bits | 0b110 | Same priority. |
| — | PF | 8 bits | 0xEE | 0xEE = Address Claim PGN 60928. |
| — | PS | 8 bits | 0xFF | 0xFF = global broadcast. |
| — | SA | 8 bits | 0x00 | Replying ECU. |
| 0–7 | Data (NAME) | 8 B | 00 00 40 7D 00 00 00 00 | 64-bit NAME (Identity, Mfr code, ECU instance, ...). |
Example request frames
Request Address Claim
ID=18EA00F9|00EE00FFFFFFFFFF
Tester 0xF9 → engine 0x00, request PGN 0x00EE00
Example response frames
Address Claim response
ID=18EEFF00|0000407D00000000
Engine 0x00 broadcasts NAME
- Multi-packet >8 B payloads use Transport Protocol: TP.CM (PGN 60416) + TP.DT (PGN 60160).
- DM1 (active DTCs) = PGN 65226 / 0xFECA.
Cross-protocol comparison
Quick reference — payload size, speed, latency and determinism class for every bus on this page.
| Protocol | Payload | Speed | Latency | Determinism | Topology | Typical use |
|---|---|---|---|---|---|---|
| CAN | 0–8 B | ≤ 1 Mbit/s | 100 µs–1 ms | Priority arbitration | Multi-drop bus | Powertrain, body, UDS |
| CAN-FD | 0–64 B | ≤ 5 Mbit/s | <200 µs | Same arbitration as CAN | Multi-drop bus | Reflash, large UDS |
| LIN | 1–8 B | ≤ 19.2 kbit/s | 5–50 ms | Master schedule table | Single master/multi-slave | Switches, mirrors, seats |
| FlexRay | 0–254 B | 10 Mbit/s × 2 | Cycle-bound (≤5 ms) | Time-triggered TDMA | Dual channel star/bus | X-by-wire, chassis |
| Automotive Ethernet | ≤ 1500 B (jumbo 9 kB) | 100 Mbit/s – 10 Gbit/s | <100 µs (TSN) | TSN / AVB or best-effort | Switched star | ADAS, infotainment, DoIP |
| TCP/IP (any media) | ≤ 1460 B / segment | Media-dependent | Variable | Best-effort | Routed | DoIP, OTA, telemetry |
| MOST | ≤ 60 B sync + ≤127 B async | 25/50/150 Mbit/s | Frame-aligned (≈22 µs) | Synchronous ring | Optical ring | Legacy infotainment audio/video |
| J1939 | 0–8 B (TP up to 1785 B) | 250 / 500 kbit/s | 1–10 ms | Priority + PGN schedule | Multi-drop bus | Trucks, off-highway, agriculture |
Need an interactive simulator? Try the UDS / DoIP / OBD-II / KWP2000 playground or open a protocol page for full background.