This wiki has been migrated to and is now deprecated. Please use that site instead.
Differences between revisions 5 and 6
Revision 5 as of 2005-04-02 02:22:30
Size: 2470
Editor: UlfLamping
Comment: some fixes
Revision 6 as of 2005-04-02 03:08:13
Size: 2540
Editor: GuyHarris
Comment: Edits, add a capture filter.
Deletions are marked like this. Additions are marked like this.
Line 35: Line 35:
 Show only the iSCSI based traffic: {{{  Show only iSCSI traffic: {{{
Line 41: Line 41:

 Capture iSCSI traffic over the default port (3260): {{{
 tcp port 3260 }}}

Internet Small Computer Systems Interface (iSCSI)

From RFC 3720: "The Small Computer Systems Interface (["SCSI"]) is a popular family of protocols for communicating with I/O devices, especially storage devices.... The iSCSI protocol describes a means of transporting of the SCSI packets over TCP/IP, providing for an interoperable solution which can take advantage of existing Internet infrastructure, Internet management facilities and address distance limitations."


XXX - add a brief description of iSCSI history

Protocol dependencies

  • ["TCP"]: iSCSI uses ["TCP"] as its transport protocol. The well known TCP port for iSCSI traffic is 3260. Pre-RFC implementations of iSCSI often used other ports.

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).


The iSCSI dissector is fully functional. It supports drafts 8, 9, 11, 12 and 13. As far as the packet format is concerned draft 13 is identical to the official standard in RFC3720.

Preference Settings

For general use, it is best to have iSCSI desegmentation on and TCP desegmentation on. The dissector will automatically detect whether HeaderDigest is used or not for all supported versions of the protocol but not Datadigest. You need to make sure the correct setting is used in preferences for whether DataDigest is used or not or Ethereal will fail to decode the packets properly.

Example capture file

XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of iSCSI display filter fields can be found in the [ display filter reference]

  • Show only iSCSI traffic:


Capture Filter

You cannot directly filter iSCSI protocols while capturing. However, if you know the ["TCP"] port used (see above), you can filter on that one.

  • Capture iSCSI traffic over the default port (3260):

     tcp port 3260 


I think RFC3720 PDU format is identical to draft13 anyone know for sure? ronnie s

iSCSI (last edited 2008-04-12 17:51:40 by localhost)