Maritza Muguira wrote:
> I understand that it doesn't recognize it as iSCSI when I first read in the
> capture file because we are using a different port number. However, I
> thought I could force it to "Decode As" whatever protocol I wanted. But,
> iSCSI does not appear in my "Decode As" list.
If the portnumber in Preferences/Protocols/iSCSI/Target port is set to some other value than 0 it is just that port number that is decoded as iSCSI it seems. I guess that this has been added to avoid getting "false" iSCSI decodes for some TCP messages that aren't really iSCSI.
The default value is "Target port: 3260".
At least that is how I think it is working based on some experiments with the capture file in:
http://www.ethereal.com/lists/ethereal-dev/200110/msg00227.html
(By default the messages in that file are not decoded as iSCSI, if you don't change the "Target port" to 0 or 5003).
I also think that it would be good to be able use "Decode As" for the iSCSI protocol (either to enable decoding for packets that Ethereal doesn't think is iSCSI when Target port has another port value, and to disable iSCSI decoding for certain port numbers if you have set "Target port: 0").
However I don't know how difficult it would be to solve this since I'm just an Ethereal user. I have not started to look at the source code yet.