On Tue, Mar 6, 2012 at 6:54 PM, Guy Harris <g...@alum.mit.edu> wrote: > > On Mar 3, 2012, at 3:38 AM, Stefan Hajnoczi wrote: > >> There are SCSI commands and responses. Commands and responses are >> separate pcap packets because there can be multiple outstanding >> commands to multiple targets/LUNs. >> >> From the spec, commands have the following layout: >> >> u8 lun[8]; >> u64 id; >> u8 task_attr; >> u8 prio; >> u8 crn; >> char cdb[cdb_size]; > > (Presumably the CDB size depends on the command.) > >> char dataout[]; >> >> Responses have the following layout: >> >> u32 sense_len; >> u32 residual; >> u16 status_qualifier; >> u8 status; >> u8 response; >> u8 sense[sense_size]; >> char datain[]; >> >> The pcap mapping of this layout should be straightforward. > > So does a command packet begin with 8 bytes of LUN, and a response packet > begin with 4 bytes of sense length? > > If so, how do you distinguish between a command packet and a response packet? > > Or is there additional metadata at the beginning of the packet to indicate > whether a packet is a command or a response?
You are right, additional metadata is needed. We need a pcap encapsulation because the virtio-scsi device itself can separate differences between command/response and other transport events due to the nature of virtio. The device itself has separate queues and a notification mechanism, so that all commands are placed on one specific queue, all responses are received on another queue, etc. This implicit information needs to be encoded for pcap - we need a wrapper structure which properly identifies command/response/events. Sorry if I've been vague about the pcap layout of commands and responses, there is no defined mapping yet. Ronnie has drafted up some recommendations and Cong is writing a specification based on this to describe the pcap layout in detail. This is work in progress but we'll get back to you with the pcap specification. Stefan - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
