Wireshark-users: Re: [Wireshark-users] Capturing SCSI packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 05 Dec 2006 02:08:11 -0800

Ulf Lamping wrote:

You seem to mix SCSI and iSCSI.

SCSI uses special (parallel) cabling - I don't know any way to capture native SCSI "traffic".

iSCSI uses Ethernet (or probably other alike) cabling to transfer traffic, which WS can capture and decode AFAIK.

In the current SCSI architectural model, there's a transport layer, which could be parallel SCSI, FCP over Fibre Channel, SCSI-over-FireWire, SCSI-over-USB, iSCSI, Serial Attached SCSI, etc..

Above that, there's the level with SCSI commands and responses, transported over those layers.

Wireshark has a dissector for the SCSI command/response level; it also has dissectors for iSCSI and FCP, both of which call the SCSI dissector. iSCSI runs over TCP, so Wireshark can read captures with iSCSI; it can also read captures with Fibre Channel transported over various network layers, e.g. with FCIP.

We have, as you note, no support for parallel SCSI. There do, I think, exist parallel SCSI analyzers that use special hardware, but we don't support reading any capture files that they might write out.