Mastering Wireshark SOME/IP: Analysis and Simulation Techniques with ANDi

This article follows the previous one titled “Automotive Ethernet Protocol SOME/IP (Part 1),” introducing how Wireshark analyzes the SOME/IP protocol and using ANDi to simulate sending SOME/IP & SOME/IP-SD packets.

Wireshark Analysis of SOME/IP Protocol

Since the release of Wireshark 3.2, SOME/IP support has been available, allowing the analysis of SOME/IP data in Wireshark. In the GitHub Wireshark repository, you can find the parsing code for SOME/IP in epan/dissectors/packet-someip.c and epan/dissectors/packet-someip-sd.c.

All operations will use version 3.6.3 of Wireshark.

First, find some SOME/IP data online to test, which can be found at https://github.com/thunder2005/SOMEIP:

After simply dragging the vsomeip capture file .pcapng into Wireshark, it is apparent that the packets are not being parsed:

To have Wireshark automatically parse SOME/IP protocol packets, you need to enable the protocol, as follows:

After configuration, the packets are automatically parsed:

In addition, you can use Lua scripts to parse. At https://github.com/jamores/eth-ws-someip, there are SOME/IP and SOME/IP-SD Wireshark LUA parsers. vsomeip.lua is a Lua plugin for Wireshark to parse SOME/IP protocol.

To enable the plugin in Wireshark, configure as follows:

1. Ensure Wireshark locates the user-created plugin path.

Help -> About -> Folders

2. After downloading the project, copy the following files into the specified plugin directory:

After performing the above operations, an error occurred when dragging the packet into Wireshark:

The error indicates a name duplication because Wireshark natively supports SOME/IP already, so here, modify the p_someip = Proto(“someip”, xx) in the someip.lua plugin as follows:

At this point, another error will occur:

The cause of the above error lies in this line:

The parameter of Dissector.get was originally someip, keeping its parameter consistent with the modified name in p_someip = Proto(“someip”, xx) will resolve it.

Using ANDi to Simulate Sending SOME/IP & SOME/IP-SD Packets

ANDi is a dedicated automotive Ethernet simulation testing software, developed and launched by Technica Engineering in 2009.

In 2012, Technica provided SOME/IP testing services for BMW.

In 2013, Technica, together with BMW, Valeo, and Broadcom, successfully implemented the world’s first in-vehicle Ethernet mass production project, the BMW X5 surround-view system, in 2013.

In 2016, Technica provided SOME/IP testing services for Audi.

On November 1, 2019, the creator of the SOME/IP standard, Lars Völker, joined Technica.

ANDi tools have both free and paid versions.

Free version download:

https://files.technica-engineering.de/ANDi%20Free

Paid version download: https://files.technica-engineering.de/ANDi/

After trying the free version, it functions similar to Wireshark, directly analyzing SOME/IP packets.

According to the official website introduction, the paid version, ANDi Premium, can simulate sending SOME/IP and SOME/IP SD traffic. Refer to the simulation sending tutorial:

https://files.technica-engineering.de/ANDi/Documentation/Tutorials/ANDi_frequent_use_cases.html

The application process for the paid ANDi Premium is not complicated, and the version downloaded this time is the latest SetupANDi_v1.0.0.exe.

After installation, create a request file through the prompted “Request License”, and the request file looks like:

Then, send an email to “[email protected]”, stating the desire to apply for an ANDi Premium trial, and attach the request file as an attachment.

In the email reply, technica-engineering will provide a personal portal link. After registration and login, under “Product Trial Questions,” ask a question. The content of the query can be the same as the one sent in the previous email, clarifying the intention to obtain an ANDi Premium trial opportunity.