Re: [Ethereal-users] Can not see any FC frames

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 6, 2006, at 11:23 AM, Logen Song wrote:

> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx 
> .
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> Quick Question,
>
> Connected a DS-PAA-2 to the IP and FC network. SPAN is configured.
> After lunching ethereal, we see the TCP/IP packets only, no FC  
> packets.

So is the Ethernet port of the MDS 9000 Port Analyzer Adapter:

	directly plugged into an Ethernet port on the machine running Ethereal?

	plugged into a hub into which an Ethernet port on the machine running  
Ethereal is also plugged?

	plugged into a switch into which an Ethernet port on the machine  
running Ethereal is also plugged?

NOTE: not everything called a "hub" is a hub; some are switches.  See

	http://wiki.wireshark.org/HubReference


> Click the Filter, not even find FC as an option.

That's for display filters, which don't affect what traffic you capture.

A *display* filter for Fibre Channel traffic would be "fc", not "FC".

A *capture* filter for it would either be

	ether proto 0xfcfc

or

	ether proto 0

assuming that the encapsulation dissected by the "MDS Header"  
dissector is the one used by the Port Analyzer Adapter.