Mailing List Archive

Can not see any FC frames
-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------
Re: Can not see any FC frames [ In reply to ]
-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------


On Oct 6, 2006, at 11:23 AM, Logen Song wrote:

> -------------------
> The Ethereal project is being continued at a new site. Please go to
> http://www.wireshark.org and subscribe to wireshark-users@wireshark.org
> .
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> Quick Question,
>
> Connected a DS-PAA-2 to the IP and FC network. SPAN is configured.
> After lunching ethereal, we see the TCP/IP packets only, no FC
> packets.

So is the Ethernet port of the MDS 9000 Port Analyzer Adapter:

directly plugged into an Ethernet port on the machine running Ethereal?

plugged into a hub into which an Ethernet port on the machine running
Ethereal is also plugged?

plugged into a switch into which an Ethernet port on the machine
running Ethereal is also plugged?

NOTE: not everything called a "hub" is a hub; some are switches. See

http://wiki.wireshark.org/HubReference


> Click the Filter, not even find FC as an option.

That's for display filters, which don't affect what traffic you capture.

A *display* filter for Fibre Channel traffic would be "fc", not "FC".

A *capture* filter for it would either be

ether proto 0xfcfc

or

ether proto 0

assuming that the encapsulation dissected by the "MDS Header"
dissector is the one used by the Port Analyzer Adapter.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users
Re: Can not see any FC frames [ In reply to ]
-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------
Re: Can not see any FC frames [ In reply to ]
-------------------
The Ethereal project is being continued at a new site. Please go to
http://www.wireshark.org and subscribe to wireshark-users@wireshark.org.
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Logen Song wrote:

> The ethernet ports on the PAA and the machine running the ethereal
> are connected to the same hub.
>
> It sees all the IP packets,

Are those IP packets from machines *other* than the machine running
Ethereal and *to* machines other than the machine running Ethereal
(i.e., traffic that's not being sent by or sent to the machine running
Ethereal), and not broadcast or multicast packets?

What type of hub is it?

> but not the FC packets...any clues?

Does it see any packets with an Ethernet type field value of 0?

If so, try turning the "Decode as MDS Header if Ethertype == 0"
preference on for the "MDS Header" protocol.

If not, ask Cisco what Ethernet type the PAA uses for the FC packets.
If it's not 0xFCFC and not 0, Wireshark needs to be changed to support
that additional Ethernet type. If it's 0, it might be that the Ethernet
adapter on the machine running Ethereal, or the driver for that Ethernet
adapter, or the rest of the networking stack, might discard frames with
an Ethernet type of 0. What OS are you running on the machine running
Ethereal?
_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users