Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing SCSI packets

[Guy Harris <guy@xxxxxxxxxxxx>]

Ulf Lamping wrote:

> You seem to mix SCSI and iSCSI.
>
> SCSI uses special (parallel) cabling - I don't know any way to capture 
> native SCSI "traffic".
>
> iSCSI uses Ethernet (or probably other alike) cabling to transfer 
> traffic, which WS can capture and decode AFAIK.

In the current SCSI architectural model, there's a transport layer, 
which could be parallel SCSI, FCP over Fibre Channel, 
SCSI-over-FireWire, SCSI-over-USB, iSCSI, Serial Attached SCSI, etc..

Above that, there's the level with SCSI commands and responses, 
transported over those layers.

Wireshark has a dissector for the SCSI command/response level; it also 
has dissectors for iSCSI and FCP, both of which call the SCSI dissector. 
 iSCSI runs over TCP, so Wireshark can read captures with iSCSI; it can 
also read captures with Fibre Channel transported over various network 
layers, e.g. with FCIP.

We have, as you note, no support for parallel SCSI.  There do, I think, 
exist parallel SCSI analyzers that use special hardware, but we don't 
support reading any capture files that they might write out.