SCSI packet capture/analyzer

NTDEV
1

Hi

I am looking for something like ethereal (Wire shark) that can analyze
SCSI Packets.
I know that Wire shark support SCSI protocol but I could not found
something similar to Wincap that will capture SCSI packets.
Can any one point me to some SCSI packet analyzer/capture application?

Thanks
Yossi

2

Yossi,

we’ve been using BusHound from Perisoft (www.perisoft.com) for years and
have only positive feedback. It’s hook
based SCSI filter with all pros and cons this stuff have in general. Good
thing about it - no single CDB would
run away unlogged and bad thing - you’ll have to be very selective upon OS
to run BusHound on.

Good luck!

Regards,
Anton A. Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Yossi Leybovich
Sent: Sunday, December 10, 2006 1:26 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] SCSI packet capture/analyzer

Hi

I am looking for something like ethereal (Wire shark) that can analyze
SCSI Packets.
I know that Wire shark support SCSI protocol but I could not found
something similar to Wincap that will capture SCSI packets.
Can any one point me to some SCSI packet analyzer/capture application?

Thanks
Yossi

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

> we’ve been using BusHound from Perisoft (www.perisoft.com) for years and

have only positive feedback.

I too have used BusHound for a number of years, and give it very positive
feedback. It’s a commercial product, and is I believe $800, and worth every
penny. I’ve pretty much only used it for storage driver analysis, but also
believe it can trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into a low-level
hardware bus analyzer, but does do a good job of seeing the requests that
come from the OS. For many problems, a low-level hardware trace produces
overwhelming detail, and a software side view is much better.

  • Jan
4

Thanks

I tested the free version , it looks nice and we might buy this tool.
Do you know if you can capture with BusHound and import the data to
WireShark?

Thanks
Yossi

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jan Bottorff
Sent: Monday, December 11, 2006 4:26 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] SCSI packet capture/analyzer

> we’ve been using BusHound from Perisoft (www.perisoft.com)
for years
> and have only positive feedback.

I too have used BusHound for a number of years, and give it
very positive feedback. It’s a commercial product, and is I
believe $800, and worth every penny. I’ve pretty much only
used it for storage driver analysis, but also believe it can
trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into
a low-level hardware bus analyzer, but does do a good job of
seeing the requests that come from the OS. For many problems,
a low-level hardware trace produces overwhelming detail, and
a software side view is much better.

  • Jan

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online
at http://www.osronline.com/page.cfm?name=ListServer

5

try
http://www.geocities.com/the_real_sz/misc/rt.htm
it’s free. If you need more specific output, I can add it…

Steffen

“Yossi Leybovich” wrote in message
news:xxxxx@ntdev…
Hi

I am looking for something like ethereal (Wire shark) that can analyze
SCSI Packets.
I know that Wire shark support SCSI protocol but I could not found
something similar to Wincap that will capture SCSI packets.
Can any one point me to some SCSI packet analyzer/capture application?

Thanks
Yossi

6

Another possibility is BusTrace (www.bustrace.com). It’s slightly
pricier, yet displays the captured commands in a format that’s modeled
after the specifications. I’d attach a sample image, but I know the
list daemon would reject it. This is my own personal favorite software
bus analyzer, bar none. BusHound’s UI is more familiar to those who use
hardware analyzers, and so I encourage you to look at both before making
your decision.

.

P.S. - should be obvious from above, but this is my own personal
opinion, and is neither a recommendation nor endorsement of any product.
YMMV.

-----Original Message-----
From: Jan Bottorff [mailto:xxxxx@pmatrix.com]
Sent: Sunday, December 10, 2006 6:26 PM
Subject: RE: SCSI packet capture/analyzer

we’ve been using BusHound from Perisoft (www.perisoft.com) for years
and
have only positive feedback.

I too have used BusHound for a number of years, and give it very
positive
feedback. It’s a commercial product, and is I believe $800, and worth
every
penny. I’ve pretty much only used it for storage driver analysis, but
also
believe it can trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into a low-level
hardware bus analyzer, but does do a good job of seeing the requests
that
come from the OS. For many problems, a low-level hardware trace produces
overwhelming detail, and a software side view is much better.

  • Jan
7

Keep in mind there is no substitute for actual hardware traces as Jan states. All of these tools are not displaying what goes out on the wire, and depending on the protocol a lot of information in the packets gets inserted by the HBA (driver/firmware). Drivers have also been known to filter/modify/complete SCSI commands before they hit the wire or even after they complete.

(For iSCSI, Ethereal and netmon are commonly used - both are free.)

-----Original Message-----
From: Henry Gabryjelski [mailto:xxxxx@microsoft.com]
Sent: Monday, December 11, 2006 11:40 AM
Subject: RE: SCSI packet capture/analyzer

Another possibility is BusTrace (www.bustrace.com). It’s slightly
pricier, yet displays the captured commands in a format that’s modeled
after the specifications. I’d attach a sample image, but I know the
list daemon would reject it. This is my own personal favorite software
bus analyzer, bar none. BusHound’s UI is more familiar to those who use
hardware analyzers, and so I encourage you to look at both before making
your decision.

.

P.S. - should be obvious from above, but this is my own personal
opinion, and is neither a recommendation nor endorsement of any product.
YMMV.

-----Original Message-----
From: Jan Bottorff [mailto:xxxxx@pmatrix.com]
Sent: Sunday, December 10, 2006 6:26 PM
Subject: RE: SCSI packet capture/analyzer

we’ve been using BusHound from Perisoft (www.perisoft.com) for years
and
have only positive feedback.

I too have used BusHound for a number of years, and give it very
positive
feedback. It’s a commercial product, and is I believe $800, and worth
every
penny. I’ve pretty much only used it for storage driver analysis, but
also
believe it can trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into a low-level
hardware bus analyzer, but does do a good job of seeing the requests
that
come from the OS. For many problems, a low-level hardware trace produces
overwhelming detail, and a software side view is much better.

  • Jan
8

Thanks

I am using SRP which is SCSI over InfiniBand
So I need the software SCSI capture to watch the packet before my driver
reformat them ,I already have InfiniBand HW capture.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeff Goldner
Sent: Tuesday, December 12, 2006 9:23 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] SCSI packet capture/analyzer

Keep in mind there is no substitute for actual hardware
traces as Jan states. All of these tools are not displaying
what goes out on the wire, and depending on the protocol a
lot of information in the packets gets inserted by the HBA
(driver/firmware). Drivers have also been known to
filter/modify/complete SCSI commands before they hit the wire
or even after they complete.

(For iSCSI, Ethereal and netmon are commonly used - both are free.)

-----Original Message-----
From: Henry Gabryjelski [mailto:xxxxx@microsoft.com]
Sent: Monday, December 11, 2006 11:40 AM
Subject: RE: SCSI packet capture/analyzer

Another possibility is BusTrace (www.bustrace.com). It’s
slightly pricier, yet displays the captured commands in a
format that’s modeled after the specifications. I’d attach a
sample image, but I know the list daemon would reject it.
This is my own personal favorite software bus analyzer, bar
none. BusHound’s UI is more familiar to those who use
hardware analyzers, and so I encourage you to look at both
before making your decision.

.

P.S. - should be obvious from above, but this is my own
personal opinion, and is neither a recommendation nor
endorsement of any product.
YMMV.

-----Original Message-----
From: Jan Bottorff [mailto:xxxxx@pmatrix.com]
Sent: Sunday, December 10, 2006 6:26 PM
Subject: RE: SCSI packet capture/analyzer

> we’ve been using BusHound from Perisoft (www.perisoft.com) for years
and
> have only positive feedback.

I too have used BusHound for a number of years, and give it
very positive feedback. It’s a commercial product, and is I
believe $800, and worth every penny. I’ve pretty much only
used it for storage driver analysis, but also believe it can
trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into
a low-level hardware bus analyzer, but does do a good job of
seeing the requests that come from the OS. For many problems,
a low-level hardware trace produces overwhelming detail, and
a software side view is much better.

  • Jan

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online
at http://www.osronline.com/page.cfm?name=ListServer

9

Jeff,

the whole idea of BusHound being hooking driver is to be the last one who
sees the data before it hits storage
port driver. This feature is not very useful for particular burning
application reverse-engineering however it
really comes in use when you try to sort out f.e. ex-Roxio stuff
compatibility issues.

Regards,
Anton A. Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeff Goldner
Sent: Monday, December 11, 2006 11:23 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] SCSI packet capture/analyzer

Keep in mind there is no substitute for actual hardware traces as Jan
states. All of these tools are not displaying what goes out on the wire, and
depending on the protocol a lot of information in the packets gets inserted
by the HBA (driver/firmware). Drivers have also been known to
filter/modify/complete SCSI commands before they hit the wire or even after
they complete.

(For iSCSI, Ethereal and netmon are commonly used - both are free.)

-----Original Message-----
From: Henry Gabryjelski [mailto:xxxxx@microsoft.com]
Sent: Monday, December 11, 2006 11:40 AM
Subject: RE: SCSI packet capture/analyzer

Another possibility is BusTrace (www.bustrace.com). It’s slightly
pricier, yet displays the captured commands in a format that’s modeled
after the specifications. I’d attach a sample image, but I know the
list daemon would reject it. This is my own personal favorite software
bus analyzer, bar none. BusHound’s UI is more familiar to those who use
hardware analyzers, and so I encourage you to look at both before making
your decision.

.

P.S. - should be obvious from above, but this is my own personal
opinion, and is neither a recommendation nor endorsement of any product.
YMMV.

-----Original Message-----
From: Jan Bottorff [mailto:xxxxx@pmatrix.com]
Sent: Sunday, December 10, 2006 6:26 PM
Subject: RE: SCSI packet capture/analyzer

we’ve been using BusHound from Perisoft (www.perisoft.com) for years
and
have only positive feedback.

I too have used BusHound for a number of years, and give it very
positive
feedback. It’s a commercial product, and is I believe $800, and worth
every
penny. I’ve pretty much only used it for storage driver analysis, but
also
believe it can trace things like USB/1394 driver requests.

It doesn’t magically turn your scsi/fc/usb/1394 adapter into a low-level
hardware bus analyzer, but does do a good job of seeing the requests
that
come from the OS. For many problems, a low-level hardware trace produces
overwhelming detail, and a software side view is much better.

  • Jan

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

10

Adding a ‘vote’ for BUSTrace. I’ve beta-tested this since the early days and
it’s served me very well. Does a good job in decoding data both ways. Bit
pricey but if you need to do a lot of debugging then it’s definitely worth
it.

Rob

–
“Henry Gabryjelski” wrote in message
news:xxxxx@ntdev…
Another possibility is BusTrace (www.bustrace.com). It’s slightly
pricier, yet displays the captured commands in a format that’s modeled
after the specifications. I’d attach a sample image, but I know the
list daemon would reject it. This is my own personal favorite software
bus analyzer, bar none. BusHound’s UI is more familiar to those who use
hardware analyzers, and so I encourage you to look at both before making
your decision.

.

P.S. - should be obvious from above, but this is my own personal
opinion, and is neither a recommendation nor endorsement of any product.
YMMV.