Wireshark today supports SCSI dissectors for iSCSI.
In the QEMU system emulator we have an emulated SCSI target which
handles devices for SCSI Parallel Interface (SPI), USB Mass Storage
Device, and now supports the new virtio-scsi transport (for efficient
virtual machine SCSI I/O).
Cong and I would like to add pcap support to the emulated SCSI target
in QEMU, making it easy to use Wireshark for SCSI debugging and
analysis. I'm looking for advice on getting started because we are
not familiar with Wireshark/dissector internals.
I believe the SCSI dissector does not support raw CDB dissection - it
requires a SCSI transport dissector (currently iSCSI). A few options
come to mind:
1. Change the SCSI dissector to support top-level dissecting of raw
SCSI CDBs without transport information (initiator, target, and other
metadata).
2. Add virtio-scsi and perhaps SPI SCSI transport dissectors.
3. A simpler approach I'm missing? :)
Suggestions appreciated.
Stefan
