oracle:iscsi_in_deep_with_wireshark_and_tshark
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
oracle:iscsi_in_deep_with_wireshark_and_tshark [2020/11/30 22:59] – hvillanueva | oracle:iscsi_in_deep_with_wireshark_and_tshark [2020/11/30 23:17] (current) – hvillanueva | ||
---|---|---|---|
Line 63: | Line 63: | ||
{{: | {{: | ||
+ | |||
+ | ===== You can check the DataSN in PDU to check the secuence of Data In (Read) or Data Out(Write) ===== | ||
+ | |||
+ | * **Data Sequence Number (DataSN): | ||
+ | |||
+ | * In below example I filtered by iscsi.initiatortasktag == 0xa15c2c72 and you can see the secuense of DataSN field. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ===== Using tshark command line of Wireshark. ===== | ||
+ | |||
+ | ==== 1. Check all the package that are wrong/bad using tcp.analysis.flags parameter and create a new pcap output file. ==== | ||
+ | |||
+ | $ tshark -r snoop-6.net0 -w sol6tcp.analysis.flags_iscsi.initiatortasktag.out | ||
+ | |||
+ | $ tshark -r tcp_analysis_flags.cap |wc -l | ||
+ | 43606 | ||
+ | |||
+ | ==== 2. Create a new filter with package that only have the iscsi.initiatortasktag ==== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ==== 3. Or just show the iscsi ITT (iscsi.initiatortasktag) value. ==== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ==== Then now we can check more in detail each flow with the iscsi.initiatortasktag value ==== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ===== Error Handling oreilly book link ===== | ||
+ | |||
+ | * **Protocol error:** As its name implies, this is generally a program error and requires restarting the session and error recovery by the SCSI layer. | ||
+ | * **CRC detected error:.** This error could have been detected on the PDU header or data segment. It can be recovered by resending the data or response PDU or by reissuing the command PDU, depending on what was missing. Some implementations will not be able to recover from this error and will respond as for a protocol error. | ||
+ | * **TCP/IP or link failure:** This error can often be recovered by restarting another connection and shifting command and data allegiance to it from the failed connection. Some implementations will not be able to recover from such a failure and will respond as for a protocol error. | ||
+ | |||
+ | The session restart, which must be used on protocol errors, can be used on any of the other failures also. Because only session restart is mandatory, some implementations are likely to have only that technique. That is, all error recovery can use what is called technique 0. | ||
+ | |||
+ | ===== Opcode (RFC7143) ===== | ||
+ | |||
+ | The Opcode indicates the type of iSCSI PDU the header encapsulates. | ||
+ | |||
+ | The Opcodes are divided into two categories: initiator Opcodes and target Opcodes. Initiator Opcodes are in PDUs sent by the initiator (Request PDUs). Target Opcodes are in PDUs sent by the target (Response PDUs). | ||
+ | |||
+ | * To filter all the opcode in wireshark | ||
+ | |||
+ | WireShark filter to check if iscsi.opcode is present | ||
+ | |||
+ | iscsi.opcode && iscsi | ||
+ | |||
+ | (iscsi.opcode==0x20 or iscsi.opcode==0x21 or iscsi.opcode==0x22 or iscsi.opcode==0x23 or iscsi.opcode==0x24 or iscsi.opcode==0x25 or iscsi.opcode==0x26 or iscsi.opcode==0x31 or iscsi.opcode==0x32 or iscsi.opcode==0x3c or iscsi.opcode==0x3e or iscsi.opcode==0x3f or iscsi.opcode==0x00 or iscsi.opcode==0x01 or iscsi.opcode==0x02 or iscsi.opcode==0x03 or iscsi.opcode==0x04 or iscsi.opcode==0x05 or iscsi.opcode==0x06 or iscsi.opcode==0x10 or iscsi.opcode==0x1c or iscsi.opcode==0x1e) && iscsi | ||
+ | |||
+ | * Target OpCodes | ||
+ | |||
+ | {{: | ||
+ | |||
+ | * wireshark to filter all the Target opcode | ||
+ | |||
+ | (iscsi.opcode==0x20 or iscsi.opcode==0x21 or iscsi.opcode==0x22 or iscsi.opcode==0x23 or iscsi.opcode==0x24 or iscsi.opcode==0x25 or iscsi.opcode==0x26 or iscsi.opcode==0x31 or iscsi.opcode==0x32 or iscsi.opcode==0x3c or iscsi.opcode==0x3e or iscsi.opcode==0x3f) && iscsi | ||
+ | |||
+ | * Initiator OpCodes | ||
+ | |||
+ | {{: | ||
+ | |||
+ | * WireShark To filter all the Initiator opcode | ||
+ | |||
+ | (iscsi.opcode==0x00 or iscsi.opcode==0x01 or iscsi.opcode==0x02 or iscsi.opcode==0x03 or iscsi.opcode==0x04 or iscsi.opcode==0x05 or iscsi.opcode==0x06 or iscsi.opcode==0x10 or iscsi.opcode==0x1c or iscsi.opcode==0x1e) && iscsi | ||
+ | |||
+ | ===== Status (RFC7143) ===== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | * WireShark filter for SCSI status of the command | ||
+ | |||
+ | {{: | ||
+ | |||
+ | * WireShark filter for status response | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ===== Reject - Reason - RFC7143 ===== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | Note 1: For iSCSI, Data-Out PDU retransmission is only done if the target requests retransmission with a recovery R2T. However, if this is the data digest error on immediate data, the initiator may choose to retransmit the whole PDU, including the immediate data. | ||
+ | |||
+ | Note 2: A target should use this reason code for all invalid values of PDU fields that are meant to describe a task, a response, or a data transfer. Some examples are invalid TTT/ITT, buffer offset, LUN qualifying a TTT, and an invalid sequence number in a SNACK. | ||
+ | |||
+ | WireShark filter to check if iscsi.opcode is present | ||
+ | |||
+ | iscsi.reject.reason && iscsi | ||
+ | |||
+ | (iscsi.reject.reason==0x00 or iscsi.reject.reason==0x02 or iscsi.reject.reason==0x08 or iscsi.reject.reason==0x18 or iscsi.reject.reason==0x28 or iscsi.reject.reason==0x30 or iscsi.reject.reason==0x40 or iscsi.reject.reason==0x00 or iscsi.reject.reason==0x01 or iscsi.reject.reason==0x80 or iscsi.reject.reason==0xff) && iscsi | ||
oracle/iscsi_in_deep_with_wireshark_and_tshark.1606795194.txt.gz · Last modified: 2020/11/30 22:59 by hvillanueva