Wireshark-bugs: [Wireshark-bugs] [Bug 11250] New: iSCSI: Read(10): shows incorrect "Data In" & "
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 03 Jun 2015 21:41:08 +0000
Bug ID 11250
Summary iSCSI: Read(10): shows incorrect "Data In" & "Response" frame number
Product Wireshark
Version 1.12.5
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter khnospam-wireshark@yahoo.com 

Created attachment 13649 [details]
Pcap (hwiscsi) to reproduce issue.

Build Information:
Version 1.12.5 (v1.12.5-0-g5819e5b from master-1.12)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with
GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares
1.9.1, with Lua 5.2, without Python, with GnuTLS 3.2.15, with Gcrypt 1.6.2,
without Kerberos, with GeoIP, with PortAudio V19-devel (built May 12 2015),
with
AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 3.2.15, Gcrypt 1.6.2, without AirPcap.
       Intel(R) Xeon(R) CPU E5-1620 0 @ 3.60GHz, with 8117MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
For certain iSCSI traffic, the request packet (Read(10) request) shows 
incorrect frame number (xxx) for 
* "Data In in: xxx" and 
* "Response in: xxx".
(This does not happen for all the iSCSI traffic I examined.
 The bug seems to be triggered by certain patterns of iscsi.initialtasktag
(ITT).)

How to reproduce:
* Open attached pcap file
  hwiscsi.ipv4.rw=read.bs=4k.oio=1.57711.1500.c=10K.pcap.gz

* Display filter: iscsi.initiatortasktag == 0x54
* Click on these frames, in this order:
  Frame 4604
  Frame 4610
  Frame 5229
* Look at Frame 5229
  Expand iSCSI (SCSI Command)
  Look at "Data In in: ..." and "Response in: ..." value.

  For Frame 5229
  Data In in: 4610 *** (=> Response comes earlier than the Request!!)
  Response in: 4610 ***

Another issue (may be related):
* Click on these frames, in this order:
  Frame 5861
  Frame 5229
* Look at Frame 5229
* Data In/Response frame number has changed! (will now show 5861)

* Click on these frames, in this order:
  Frame 7111
  Frame 5229
* Look at Frame 5229
* Data In/Response frame number has changed! (will now show 7111)


Data In/Response frame number computation is incorrect.
It should not depend on the sequence of the frames that were clicked on.
------

Details:
* 10.133.249.13 : iSCSI initiator
* 10.133.249.216: iSCSI target

------

For my own notes:
hwiscsi IPv4 Read(4K) OIO=1 MTU=1500

You are receiving this mail because:
  • You are watching all bug changes.