tcpdump <-> FCoE support

tcpdump <-> FCoE support

[Loke, Chetan]

Folks,

13:08:21.907971 00:yy:yy:yy:yy:yy (oui Unknown) > 00:xx:xx:xx:xx:xx (oui
Unknown), ethertype Unknown (0x8906)

On: tcpdump-4.0.0-3, tcpdump doesn't seem to have FCoE support(unless I
capture it and pipe it to wireshark). Is there any effort currently in
progress on adding FCoE parsers?


Chetan Loke

Re: tcpdump <-> FCoE support

[Joe Eykholt]

On 7/26/10 10:30 AM, Loke, Chetan wrote:
> 13:08:21.907971 00:yy:yy:yy:yy:yy (oui Unknown)>  00:xx:xx:xx:xx:xx (oui
> Unknown), ethertype Unknown (0x8906)
>
> On: tcpdump-4.0.0-3, tcpdump doesn't seem to have FCoE support(unless I
> capture it and pipe it to wireshark). Is there any effort currently in
> progress on adding FCoE parsers?
>
>
> Chetan Loke

Good question.  There's no effort in progress that I know of.
I find wireshark very handy and do tend to capture with tcpdump -w
and then read the file with wireshark.  tshark is handy if you
want a CLI mode.

If tcpdump interpreted FCoE frames, then we would want FC, FC-ELS,
and FCP.  Does it already dissect any SCSI frames (e.g., iSCSI)?
I'm not sure how much work it would be, but given tshark
is around, I don't think it's that important.

It could at least be changed to print out FCoE instead of 0x8906,
and FIP instead of 0x8914.

	Joe

Re: tcpdump <-> FCoE support

[Loke, Chetan]

> From: Joe Eykholt [mailto:jeykholt-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org]
> 
> Good question.  There's no effort in progress that I know of.
> I find wireshark very handy and do tend to capture with tcpdump -w
> and then read the file with wireshark.  tshark is handy if you
> want a CLI mode.
> 
> If tcpdump interpreted FCoE frames, then we would want FC, FC-ELS,
> and FCP.  Does it already dissect any SCSI frames (e.g., iSCSI)?
> I'm not sure how much work it would be, but given tshark
> is around, I don't think it's that important.
> 
Oki thanks. I'll play with tshark. If tshark handles the FIP/FC
discovery business then that's perfect. I don't have a FCoE target
configured yet. I just sent a raw fcoe-frame to check how tcpdump
responds.

> It could at least be changed to print out FCoE instead of 0x8906,
> and FIP instead of 0x8914.
> 
Agreed.


> 	Joe
Chetan Loke

Re: tcpdump <-> FCoE support

[Hagen Paul Pfeifer]

* Loke, Chetan | 2010-07-26 13:30:13 [-0400]:

>13:08:21.907971 00:yy:yy:yy:yy:yy (oui Unknown) > 00:xx:xx:xx:xx:xx (oui
>Unknown), ethertype Unknown (0x8906)
>
>On: tcpdump-4.0.0-3, tcpdump doesn't seem to have FCoE support(unless I
>capture it and pipe it to wireshark). Is there any effort currently in
>progress on adding FCoE parsers?

That's no kernel issue, it is purely related to userland tools such as
tcpdump/wireshark/whatever.

Hagen