Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 12832] New: iSCSI Display Filter does not return iSCSI Read responses correspo

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	12832
Summary	iSCSI Display Filter does not return iSCSI Read responses corresponding to certain iSCSI Read requests, when preference tcp.desegment_tcp_streams is FALSE.
Product	Wireshark
Version	2.0.5
Hardware	x86
OS	Windows 7
Status	UNCONFIRMED
Severity	Major
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	khnospam-wireshark@yahoo.com

Created attachment 14887 [details]
Pcap file z.pcap.gz

Build Information:
Version 2.0.5 (v2.0.5-0-ga3be9c6 from master-2.0)

Copyright 1998-2016 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with Qt 5.3.2, with WinPcap (4_1_3), with libz 1.2.8, with
GLib 2.42.0, with SMI 0.4.8, with c-ares 1.11.0, with Lua 5.2, with GnuTLS
3.2.15, with Gcrypt 1.6.2, with MIT Kerberos, with GeoIP, with QtMultimedia,
with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with locale
English_United States.1252, with WinPcap version 4.1.3 (packet.dll version
4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with
GnuTLS 3.2.15, with Gcrypt 1.6.2, without AirPcap.
       Intel(R) Xeon(R) CPU E5-1620 0 @ 3.60GHz (with SSE4.2), with 8117MB of
physical memory.


Built using Microsoft Visual C++ 12.0 build 40629

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
* Wireshark/Tshark 2.0.5 (RHEL Linux, Windows 7)

* Problem Summary:
  iSCSI Display Filter does not return iSCSI Read responses corresponding to
  certain iSCSI Read requests, when preference tcp.desegment_tcp_streams is
FALSE.


* Problem Details:
  + If:
    a TCP segment contains multiple iSCSI Read requests,
    i.e. contains multiple iscsi.initiatortasktag, AND
    tcp.desegment_tcp_streams is FALSE,

    Then:
    the display filter for Response will NOT return the corresponding
    iSCSI Read responses.

  + This problem is observed for both Wireshark & Tshark.


* Traffic:
  + iSCSI (TCP)
  + MTU=1500
  + Sequential Read(64K), OIO=16
  + 1 TCP connection
  + 1 LUN
  + time=30sec

* Packet capture
  + Inline optical tap
  + SolarFlare
  + Full packet

* Preferences
  + File attached

  + Pref: tcp.sesegment_tcp_streams: *FALSE*
    Bug only observed when this is FALSE.

  + Pref: iscsi.desegment_iscsi_messages: TRUE (default)

* Display Filter
  + [iSCSI Read Request]
    ((iscsi.opcode==0x01) &&
     (iscsi.scsicommand.expecteddatatransferlength > 512) &&
     (scsi_sbc.opcode==0x28) && (scsi.lun==101))

  + [iSCSI Read Response]
    ((iscsi.opcode==0x25) &&
     (iscsi.datasegmentlength>512) &&
     (scsi_sbc.opcode==0x28) && (scsi.lun==101))

* Pcap file
  + z.pcap.gz
  + Frames: 3000


* Problem:
  tshark -r z.pcap -o tcp.desegment_tcp_streams:FALSE -Y '(
(iscsi.opcode==0x25)&&(iscsi.datasegmentlength>512
)&&(scsi_sbc.opcode==0x28)&&(scsi.lun==101) )' -Tfields -e
iscsi.initiatortasktag

0x071e0301


* No Problem:
  tshark -r z.pcap -o tcp.desegment_tcp_streams:TRUE -Y '(
(iscsi.opcode==0x25)&&(iscsi.datasegmentlength>512)
&&(scsi_sbc.opcode==0x28)&&(scsi.lun==101) )' -Tfields -e
iscsi.initiatortasktag

0x071e0301
0x081e0301
0x091e0301
0x0a1e0301
0x0b1e0301
0x0c1e0301
0x0d1e0301
0x0e1e0301
0x0f1e0301

Case 1: (multiple iscsi.initiatortasktag in same TCP seg)
* Problem    (tcp.desegment_tcp_streams: FALSE):
  Frame 2470: Request
              iscsi.initiatortasktag: 0x81e0301, 0x91e0301, 0xa1e0301,
0xb1e0301
  Frame (none): Response

* No problem (tcp.desegment_tcp_streams: TRUE):
  Frame 2470: Request
              iscsi.initiatortasktag: 0x81e0301, 0x91e0301, 0xa1e0301,
0xb1e0301
  Frame 2594: Response
              iscsi.initiatortasktag: 0x81e0301, 0x91e0301, 0xa1e0301,
0xb1e0301


Case 2: (one iscsi.initiatortasktag in same TCP seg)
* No Problem (tcp.desegment_tcp_streams: FALSE)
  Frame 2469: Request
              iscsi.initiatortasktag: 0x71e0301
  Frame 2482  Response
              iscsi.initiatortasktag: 0x71e0301

* No Problem (tcp.desegment_tcp_streams: TRUE)
  Frame 2469: Request
              iscsi.initiatortasktag: 0x71e0301
  Frame 2540  Response
              iscsi.initiatortasktag: 0x71e0301

---

      You are receiving this mail because:

• You are watching all bug changes.