Wireshark · Ethereal-dev: [Ethereal-dev] Re: best option for decoding iscsi?

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

What options are you referring to?

The ones that are really important to configure correctly in order to
decode them properly are :

Protocol version :   here you should use draft 13 since that one is
the one that became standard.
Never use anything other than draft 13 unless you work with
pre-RFC(pre-draft13) implementations (they do exist, draft 8 was
popular and even shipped by vendors long time ago).

Enable Data digest :  This one MUST be configured and specified
correctly, i.e. to match the settings used by the hosts in the
capture.
Setting this to the wrong value will make ethereal loose track of
where in the tcp bytestream the next PDU starts at and thus the next
PDU will not be dissected.

(Ethereal does try to (and as far as I can tell, successfully) 
autodetect whether HeaderDigest is sued or not, but that is reasonably
simple,   detecting Datadigest is "difficult" since that fiels most of
the time are so many packets later than the initial header packet.)




On 5/26/05, Ming Zhang <mingz@xxxxxxxxxxx> wrote:
> I am wondering what is the best options to decode iscsi traffic?
> 
> Different options can give me different output. some packets are
> malformed in one option combination but not in another.
> 
> thanks.
> 
> ming
> 
> 
>