Wireshark today supports SCSI dissectors for iSCSI. In the QEMU system emulator we have an emulated SCSI target which handles devices for SCSI Parallel Interface (SPI), USB Mass Storage Device, and now supports the new virtio-scsi transport (for efficient virtual machine SCSI I/O).
Cong and I would like to add pcap support to the emulated SCSI target in QEMU, making it easy to use Wireshark for SCSI debugging and analysis. I'm looking for advice on getting started because we are not familiar with Wireshark/dissector internals. I believe the SCSI dissector does not support raw CDB dissection - it requires a SCSI transport dissector (currently iSCSI). A few options come to mind: 1. Change the SCSI dissector to support top-level dissecting of raw SCSI CDBs without transport information (initiator, target, and other metadata). 2. Add virtio-scsi and perhaps SPI SCSI transport dissectors. 3. A simpler approach I'm missing? :) Suggestions appreciated. Stefan