Ethereal-dev: Re: [Ethereal-dev] iSCSI dissector and packets with only data ...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Bill Studenmund <wrstuden@xxxxxxxxxxxxxxxxx>
Date: Mon, 3 Jun 2002 13:46:02 -0700 (PDT)
On Sat, 1 Jun 2002, Mark Burton wrote:

> > I am a bit harrassed today.
>
> It happens.

Indeed.

> > Anyway, does anyone know a good heuristic for deciding that a random
> > packet captured in an iSCSI stream does not really contain an iSCSI header
> > and should be skipped?
>
> Well a really good heuristic that packet-iscsi.c doesn't currently
> implement but should be very reliable would be only recognise iSCSI
> headers whose digest value is correct. Of course, this would require
> both the initiator and target to implement header digests.
>
> If that would be useful I can implement it, please advise.

Another one would be that if there was a preceeding PDU whose TCP write
didn't contain all of the data, then chances are this packet is just data.

Not sure how to actually do this, or if it's done already. :-)

Take care,

Bill