This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

capturing Fibre Channel frames

0

Any rumors around supporting capture on Fibre Channel HBAs?

--sk

asked 15 Nov '13, 08:33

skendric's gravatar image

skendric
11111113
accept rate: 0%


One Answer:

2

No rumors I've heard of lately.

So, the answer of @Guy Harris in the following question is still valid.

http://ask.wireshark.org/questions/9687/about-capturing-of-fibre-channel-packets

A possible way was discussed here

http://www.wireshark.org/lists/wireshark-users/201109/msg00099.html

By using a Cisco MDS Port Analyzer Adapter (not sure if that thing is still available - maybe eBay), you can encapsulate Fibre Channel traffic into an ethernet frame which can then be analyzed with Wireshark.

I have no idea if that really works, but the screenshot in the following paper shows the GUI of Ethereal (former name of Wireshark) with such a frame.

https://learningnetwork.cisco.com/servlet/JiveServlet/download/3740-2-3383/FCAnalyzer%2022Dec09%209%20d-3740.pdf

http://www.cisco.com/en/US/docs/storage/san_switches/mds9000/hw/paa/installation/note/FPAA2.html

Regards
Kurt

answered 15 Nov '13, 13:12

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 15 Nov '13, 13:18

Assuming I had money (which I don't at the moment, but let's ignore this for the moment) -- where might I advertise to find someone with the skills it would take to extend libpcap/Winpcap support to a Fibre Channel HBA?

--sk

(20 Nov '13, 05:54) skendric

In think it's cheaper to buy a fibre channel analyzer than to 'sponsor' that kind of libpcap extension ;-))

However, I might be wrong: Please post your message to the libpcap developer list.

http://www.tcpdump.org/#mailing-lists

(20 Nov '13, 06:49) Kurt Knochner ♦