以编程方式从 iscsi 数据包中提取某些字节
我有大量的wireshark 跟踪，其中包含不同数量的ISCSI 数据包。我需要解析发起者发送的命令（以字节为单位）并将其写入每个数据包的文件中。我原本打算手动执行此操作，因为它可以在wireshark应用程序中轻松查看（请参见下面的SS），但其中一些痕迹很大（1-2 Gb），并且手动执行将需要很长时间。
我一直在研究 tshark 和 rawshark 文档，但我不确定它们是否能够满足我的需要。一位朋友建议自己使用 libpcap 来解析跟踪，但据我所知，我需要找到某种方法来识别需要从每个数据包中提取的字节。理想情况下，我想使用能够为我识别它的东西（即wireshark的ISCSI解析器）。
有人能指出我正确的方向吗？我需要某种方法来从每个 ISCSI 数据包中解析出这些命令，而无需查看原始数据包数据并尝试识别我需要哪些字节。请注意 - 它并不总是数据包中的最后 16 个字节，如上所示，因此我不能只遍历并获取最后 16 个字节。
I have a ton of wireshark traces containing varying amount of ISCSI packets. I need to parse out the command being sent by the initiator (in bytes) and write it to a file for each packet. I was originally going to do this manually, as it is easily viewable inside the wireshark application (see SS below), but some of these traces are huge (1-2 Gb), and it would take forever to do by hand.
I've been looking into tshark and rawshark documentation, but I'm not sure either is able to get me what I need. A friend suggested using libpcap to parse the traces myself, but from what I can tell I'd need to find some way to identify the bytes I need to pull out of each packet. Ideally I'd like to use something that recognizes it for me (ie wireshark's ISCSI dissector).
Can anyone point me in the right direction? I need some way to parse out these commands from each ISCSI packet without looking through the raw packet data and trying to identify which bytes I need. As a note - It's not always the last 16 bytes in the packet as shown above, so I can't just go through and take the last 16 bytes.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果将数据包导出到 PDML/XML（文件 -> 导出...-> 文件 -> 另存为 PDML 类型），您将获得一个包含所有协议字段的漂亮 XML 文件。您可以使用它来满足您的要求，或者将其用作索引来定位每个数据包中的原始字节。
If you export the packets to PDML/XML (File->Export...->File->Save As Type PDML) you will get a nice XML file with all the protocol fields. You may be able to use this for your requirements, or use it as an index to locate the raw bytes in each packet.