Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Fibre Channel decoding question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Fri, 2 Jul 2004 12:00:45 -0700 (PDT)
Rydeen, Mike said:
> Hopefully this will be a quick question/answer, but you never know.
> Looking through the Ethereal supported protocols it appears that you
> support a large part of the Fibre Channel standard protocols (FC, FC-dns,
> FC-FCS, etc).  After decoding the libpcap file format, I was able to
> create a supported Ethereal file out of a series of raw Fibre Channel
> frames.  Currently I am using the IP over FC (122 - 0x7a) as my link layer
> type, but it appears that this LL does not decode the Common Transport
> layer, it is only looking for the payload IP contents from the Network
> Header, SNAP and down the list.

Correct.

To quote the comment in libpcap 0.8[.x]'s "pcap-bpf.h" before the
definition of DLT_IP_OVER_FC:

/*
 * This is for RFC 2625 IP-over-Fibre Channel.
 *
 * This is not for use with raw Fibre Channel, where the link-layer
 * header starts with a Fibre Channel frame header; it's for IP-over-FC,
 * where the link-layer header starts with an RFC 2625 Network_Header
 * field.
 */

On the systems where DLT_IP_OVER_FC (122 - DLT_ values are given in
decimal, not hex, as the people who assign them have only 10 fingers :-))
is used, the link-layer header on packets supplied by the packet capture
mechanism is the Network_Header field specified in RFC 2625; the
lower-layer FC headers aren't supplied (perhaps because the FC card strips
them off before supplying IP-over-FC frames to the host).

> Looking through the libpcap/tcpdump code I did not really see any other LL
> type.

If you want a link-layer type for raw Fibre Channel, send mail to
"tcpdump-workers@xxxxxxxxxxx" asking for one; once one is assigned,
support for it could be added to Ethereal.

Please indicate whether the frames would start with the R_CTL field or if
there'd be some other stuff before it.