http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=32595
User: sahlberg
Date: 2010/04/29 01:41 AM
Log:
It is becomming more common that iscsi vendors use iscsi-redirectors and redirect
initiators to a different host/port and thus often redirect to non-3260.
The heuristics to detect iscsi is quite weak since there is very little
in the average iscsi header that can be used to semi-reliably identify
something as iscsi and not random data/something else.
As such, the heuristics also use/rely on the port being 3260 in order
to reduce the otherwise massive numbver of false positives that would arise.
Add decoding of the text key/value pairs and trigger on TargetAddress.
This field would describe a address/port where we can quite reliably
assume that this traffic is indeed iscsi and not something else.
When seeing the iscsi redirect/TargetAddress, use this as a signalling hint
and register a conversation dissector for TCP to that address/port so that
any future packet to/from this port is sent to the iscsi dissector.
If the signalling/redirect is not in the capture, wireshark will not detect
the traffic as iscsi and the user will have to use DecodeAs. and manually
\set it to iscsi.
Directory: /trunk/epan/dissectors/
Changes Path Action
+108 -9 packet-iscsi.c Modified