From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joe Eykholt Subject: Re: tcpdump <-> FCoE support Date: Mon, 26 Jul 2010 10:57:58 -0700 Message-ID: <4C4DCCA6.5060206@cisco.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, devel-s9riP+hp16TNLxjTenLetw@public.gmane.org To: "Loke, Chetan" Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: devel-bounces-s9riP+hp16TNLxjTenLetw@public.gmane.org Errors-To: devel-bounces-s9riP+hp16TNLxjTenLetw@public.gmane.org List-Id: netdev.vger.kernel.org On 7/26/10 10:30 AM, Loke, Chetan wrote: > 13:08:21.907971 00:yy:yy:yy:yy:yy (oui Unknown)> 00:xx:xx:xx:xx:xx (oui > Unknown), ethertype Unknown (0x8906) > > On: tcpdump-4.0.0-3, tcpdump doesn't seem to have FCoE support(unless I > capture it and pipe it to wireshark). Is there any effort currently in > progress on adding FCoE parsers? > > > Chetan Loke Good question. There's no effort in progress that I know of. I find wireshark very handy and do tend to capture with tcpdump -w and then read the file with wireshark. tshark is handy if you want a CLI mode. If tcpdump interpreted FCoE frames, then we would want FC, FC-ELS, and FCP. Does it already dissect any SCSI frames (e.g., iSCSI)? I'm not sure how much work it would be, but given tshark is around, I don't think it's that important. It could at least be changed to print out FCoE instead of 0x8906, and FIP instead of 0x8914. Joe