We're now a non-profit! Support open source packet analysis by making a donation.

Ethereal-dev: Re: [Ethereal-dev] Fibre Channel decoding question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <[email protected]>
Date: Fri, 2 Jul 2004 12:00:45 -0700 (PDT)
Rydeen, Mike said:
> Hopefully this will be a quick question/answer, but you never know.
> Looking through the Ethereal supported protocols it appears that you
> support a large part of the Fibre Channel standard protocols (FC, FC-dns,
> FC-FCS, etc).  After decoding the libpcap file format, I was able to
> create a supported Ethereal file out of a series of raw Fibre Channel
> frames.  Currently I am using the IP over FC (122 - 0x7a) as my link layer
> type, but it appears that this LL does not decode the Common Transport
> layer, it is only looking for the payload IP contents from the Network
> Header, SNAP and down the list.


To quote the comment in libpcap 0.8[.x]'s "pcap-bpf.h" before the
definition of DLT_IP_OVER_FC:

 * This is for RFC 2625 IP-over-Fibre Channel.
 * This is not for use with raw Fibre Channel, where the link-layer
 * header starts with a Fibre Channel frame header; it's for IP-over-FC,
 * where the link-layer header starts with an RFC 2625 Network_Header
 * field.

On the systems where DLT_IP_OVER_FC (122 - DLT_ values are given in
decimal, not hex, as the people who assign them have only 10 fingers :-))
is used, the link-layer header on packets supplied by the packet capture
mechanism is the Network_Header field specified in RFC 2625; the
lower-layer FC headers aren't supplied (perhaps because the FC card strips
them off before supplying IP-over-FC frames to the host).

> Looking through the libpcap/tcpdump code I did not really see any other LL
> type.

If you want a link-layer type for raw Fibre Channel, send mail to
"[email protected]" asking for one; once one is assigned,
support for it could be added to Ethereal.

Please indicate whether the frames would start with the R_CTL field or if
there'd be some other stuff before it.