ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 8131] usb dissector fails to identify SCSI payload (MASSTO

Date: Mon, 24 Dec 2012 11:22:06 +0000

Comment # 3 on bug 8131 from
(In reply to comment #2)
> (In reply to comment #1)
> > There is no possibility to recognize that device as MassStorage.
> 
> According to
> 
>     http://bobcopeland.com/blog/2011/07/my-pal-scsi/
> 
> "USB storage is a successful example of taking an existing protocol (SCSI
> command set) and wholesale wrapping it in a different wire protocol. Each
> USB storage transfer is initiated by the host sending a Command Block
> Wrapper (CBW) — a 31-byte USB packet starting with ‘USBC’, typically
> containing a SCSI command as a payload. Next, a block of data is transferred
> if this command represents a read or write. Finally, the device completes
> the transaction by sending a Command Status Wrapper (CSW), a 13-byte packet
> beginning with the string ‘USBS’."
> 
> If that's the case, perhaps there should either be a dissector table that
> looks at the 4 bytes in question or, if no USB spec indicates that those are
> a protocol identifier field, a heuristic dissector list allowing a "USB mass
> storage" dissector to look for USBC or USBS.

Hmm.. So probably there is no any heuristics dissectors (nobody use it?),
because I see heuristic tables  (like register_heur_dissector_list("usb.bulk",
&heur_bulk_subdissector_list);)
but those tables are empty. Should we add to mass storage dissector something
like:
"    heur_dissector_add("usb.bulk", dissect_usb_ms_bulk, proto_usb_ms);"?


You are receiving this mail because:
  • You are watching all bug changes.