----- Original Message -----
From: "Guy Harris"
Sent: Saturday, January 05, 2002 6:56 AM
Subject: Re: [Ethereal-dev] NDMP patch.
> > perhaps it is time to implement packet-scsi.c since both ndmp and iscsi
> > would benefit from that one
>
> Probably a good idea. Heck, somebody may decide to add a scheme to log
> Fibre Channel traffic (or parallel SCSI traffic, or IEEE 1394 traffic)
> to a file at some point, adding even more SCSI transports.
This would be very useful.
Even more useful would be if somtime in the future, patches to libpcap and
selected system kernels
would materialize which would make it possible to sniff a block device such
as scsi adaptors in the same
way as we can sniff network devices.
Best of all would be if such changes to libpcap and the block device drivers
would even allow us to
sniff passively on say an external SCSI bus. Then what we would get would be
a real scsi analyzer, something one could plug
in on a scsi bus to sniff and troubleshoot traffic.
Ah, dreams.
>
> > i would be very interested in aquiring ndmp captures to test it with,
>
> I may get some at some point (although they may be huge, and may contain
> stuff I'd need to edit out before sending it).
I would only need a few specific packets containing the CDB commands. Not
anything else.
Use editcap to just select a few such packets.
Also you could just edit the packet payload to clear out any sensitive data
with null bytes.
Dont worry if such changes messes up the checksums. It is easy for me to
just disable the checksum
calculations when testing the dissectors.
Though, packet-scsi.c is nothing more than an idea (albeit a nice and
perhaps useful one) at this point.