DoIP (Diagnostics over Internet Protocol)

What is DoIP?

DoIP is a thin header on top of TCP and UDP that carries UDS between a tester and a vehicle. Every DoIP message starts with an 8-byte generic header: protocol version, its inverse, a 2-byte payload type and a 4-byte payload length. The important payload types are 0x0001 vehicle identification request, 0x0004 vehicle announcement, 0x0005 routing activation request, 0x0006 routing activation response, 0x8001 diagnostic message and 0x8002/0x8003 positive and negative acknowledgement.

A routing activation request from tester address 0x0E00 looks like 02 FD 00 05 00 00 00 07 0E 00 00 00 00 00 00: version 02, inverse FD, type 0005, length 7, source address, activation type 00, four reserved bytes. After a positive response, 02 FD 80 01 00 00 00 07 0E 00 10 01 22 F1 90 sends ReadDataByIdentifier for the VIN to the ECU with logical address 0x1001.

Where is it defined?

ISO 13400-2 defines the protocol: header, payload types, vehicle discovery, routing activation, alive check, diagnostic messages and their acknowledgement codes. ISO 13400-3 covers the wired physical layer and the activation line on the diagnostic connector. ISO 14229 defines the UDS content, and ISO 14229-5 maps UDS onto IP.

What it means in practice

DoIP moves diagnostics onto a network. The gateway that terminates DoIP decides which target addresses a tester may reach, from which source address and after which activation type. That decision is where we regularly find problems: gateways that route to ECUs that should be blocked from the external port, routing activation accepted for any source address, or diagnostics available on interfaces other than the diagnostic connector.

On a vehicle-level penetration test the DoIP gateway was the quickest route from the OBD connector to ECUs that were well protected on their own CAN bus. The UDS findings are the same as on CAN; the reach is larger.

How AutoST tests it

AutoST performs vehicle discovery over UDP, handles routing activation and then runs the transport-generic UDS engine over the DoIP link: session and service enumeration, DID and routine scanning and SecurityAccess checks. It also tests DoIP gateway routing, so you see which logical addresses answer through the gateway and which should not.

Common misunderstandings

DoIP is not a different diagnostic protocol; it is a transport for UDS. A positive routing activation is not authentication unless the OEM adds a check behind activation type 0xE0 or uses TLS. And protecting an ECU on CAN does not protect it when a gateway forwards DoIP traffic to it.