On Mar 3, 2012, at 3:38 AM, Stefan Hajnoczi wrote: > There are SCSI commands and responses. Commands and responses are > separate pcap packets because there can be multiple outstanding > commands to multiple targets/LUNs. > > From the spec, commands have the following layout: > > u8 lun[8]; > u64 id; > u8 task_attr; > u8 prio; > u8 crn; > char cdb[cdb_size];
(Presumably the CDB size depends on the command.) > char dataout[]; > > Responses have the following layout: > > u32 sense_len; > u32 residual; > u16 status_qualifier; > u8 status; > u8 response; > u8 sense[sense_size]; > char datain[]; > > The pcap mapping of this layout should be straightforward. So does a command packet begin with 8 bytes of LUN, and a response packet begin with 4 bytes of sense length? If so, how do you distinguish between a command packet and a response packet? Or is there additional metadata at the beginning of the packet to indicate whether a packet is a command or a response?- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
