Internet Small Computer Systems Interface (iSCSI)
obsoleted by
- rfc-7143 — Internet Small Computer System Interface (iSCSI) Protocol (Consolidated)
updated by
- rfc-3980 — T11 Network Address Authority (NAA) Naming Format for iSCSI Node Names
- rfc-4850 — Declarative Public Extension Key for Internet Small Computer Systems Interface (iSCSI) Node Architecture
- rfc-5048 — Internet Small Computer System Interface (iSCSI) Corrections and Clarifications
- rfc-7146 — Securing Block Storage Protocols over IP: RFC 3723 Requirements Update for IPsec v3
Extracted elements (32)
iSCSI allows 'phase-collapse': a command and its write data may be shipped together (immediate data), and read data and the final status response may be combined in a single PDU from the target. This reduces round-trip latency and protocol overhead compared to a strict phase-separated model.
iSCSI names are associated with iSCSI nodes rather than network adapter cards so that NIC or HBA replacement does not require reconfiguration of SCSI resource allocations. Names are globally unique, permanent, and location-independent, delegating naming authority to existing DNS domain name holders or IEEE EUI-64 registrants.
Unsolicited write data (immediate data in the command PDU and separate Data-Out PDUs up to FirstBurstLength bytes) is designed to reduce write latency by eliminating the first R2T round-trip. The ImmediateData and InitialR2T negotiation keys allow fine-grained control over which unsolicited forms are enabled.
Connection allegiance is strictly per-command, not per-task: consecutive commands in a SCSI linked command-chain task MAY use different TCP connections. Allegiance reassignment across connections is only permitted via explicit reassignment when the original connection fails, using the Task Management TASK REASSIGN function.
A target receiving any PDU except a Login request before the Login phase MUST immediately terminate the connection. Once Login has started, receipt of any non-Login PDU requires the target to send a Login reject and then disconnect; an initiator receiving a non-Login response MUST immediately terminate the connection.
All comparisons and arithmetic on CmdSN, ExpCmdSN, and MaxCmdSN MUST use Serial Number Arithmetic as defined in RFC 1982 with SERIAL_BITS=32 to handle 32-bit wraparound. A target MUST NOT issue a command response or Data-In PDU with status before acknowledging the command.
An iSCSI name MUST be a UTF-8 encoding of a Unicode string in Normalization Form C, using only characters allowed by the iSCSI stringprep template (RFC 3722), and MUST NOT exceed 223 bytes. The stringprep process converts strings to equivalent lower-case representations.
As part of the login process, the initiator and target SHOULD authenticate each other and MAY set a security association protocol for the session. An IPsec security association MAY be established before the Login request to protect the TCP connection.
Data and R2T PDUs transferred as part of command execution MUST be sequenced via the DataSN field. For any read or bidirectional command, a target MUST issue fewer than 2**32 combined R2T and Data-In PDUs; any output data sequence MUST contain fewer than 2**32 Data-Out PDUs.
Each iSCSI node MUST have an iSCSI name. Initiators and targets MUST support receipt of iSCSI names up to 223 bytes. The initiator MUST present both its InitiatorName and the TargetName in the first Login request of a new session or connection (TargetName MAY be omitted only for discovery sessions).
For any iSCSI request issued over a TCP connection, the corresponding response and all related PDUs MUST be sent over the same connection (connection allegiance). This allegiance may be explicitly reassigned only after the original connection fails.
Initiators and targets MUST support the response-numbering scheme (StatSN/ExpStatSN). Initiators MUST undertake recovery actions if the difference between StatSN and ExpStatSN exceeds an implementation-defined constant that MUST NOT exceed 2**31-1.
iSCSI targets and initiators MUST support at least one TCP connection and MAY support several connections in a session. For error recovery purposes, targets and initiators that support a single active connection SHOULD support two connections during recovery.
Login requests and responses MUST be used exclusively during the Login phase. The login phase MUST immediately follow TCP connection establishment, and a subsequent Login phase MUST NOT occur before tearing down a connection.
On any connection, the iSCSI initiator MUST send commands in increasing order of CmdSN, except for commands retransmitted due to digest error recovery and connection recovery. iSCSI initiators and targets MUST support the command numbering scheme.
With the exception of commands marked for immediate delivery, the iSCSI target layer MUST deliver commands for execution in the order specified by CmdSN. The target MUST NOT transmit a MaxCmdSN less than ExpCmdSN-1, and MUST silently ignore non-immediate commands outside the ExpCmdSN-to-MaxCmdSN window.
DataSN sequences Data-In and Data-Out PDUs per-command starting at 0 for each new sequence; R2TSN sequences R2T PDUs per-command starting at 0. For bidirectional commands, DataSN and R2TSN share one continuous undifferentiated sequence.
iSCSI defines three PDU payload classes: SCSI payload carriers (SCSI-Command, SCSI-Response, Task Management Request/Response, Data-Out, Data-In, R2T); mixed SCSI/iSCSI (Asynchronous Message); and iSCSI-only (Text Request/Response, Login Request/Response, Logout Request/Response, SNACK, Reject, NOP-Out/In).
StatSN is a per-connection 32-bit status sequence number carried in target-to-initiator PDUs; ExpStatSN in initiator PDUs acknowledges received status, allowing the target to discard recovery state for commands whose status delivery is acknowledged.
The CmdSN/ExpCmdSN/MaxCmdSN triple implements session-wide command flow control. CmdSN is a 32-bit counter advanced by 1 per non-immediate command; MaxCmdSN minus ExpCmdSN plus 1 defines the target's command receive window; immediate commands carry the current CmdSN but do not advance it.
The Initiator Task Tag (ITT) uniquely identifies a task session-wide for its lifetime. All task-related PDUs for a command (R2T, Data-In, Status) must use consistent field values matching the ITT established at task instantiation; inconsistent values are a protocol error.
The Ready To Transfer (R2T) PDU is sent by the target to solicit outgoing write data from the initiator, specifying Buffer Offset and Desired Data Transfer Length. It implements flow control for write data, replacing traditional SCSI bus arbitration.
The Session ID (SSID) is the tuple (ISID, TSIH): ISID is a 48-bit initiator-assigned identifier specifying the initiator's end of the session; TSIH is a 16-bit target-assigned handle generated at session establishment, with value 0 reserved to signal a new session request.
RFC 3720 establishes an IANA registry for iSCSI extension items, covering new Opcodes, Login/Text operational keys, authentication methods, and digest algorithms. Registration requires community presentation, IESG approval, and satisfaction of naming, mechanism specification, publication, and security requirements.
iSCSI deployments SHOULD use IPsec ESP with AES-CBC (minimum 128-bit key) for confidentiality and HMAC-SHA1-96 for integrity as specified in RFC 3723. IKE with certificate-based mutual authentication is recommended for high-security environments; pre-shared keys are acceptable only with strong secrets.
iSCSI provides in-band authentication during Login via CHAP, SRP, Kerberos (KRB5), or SPKM, negotiated through the AuthMethod key. For network-layer security, IPsec ESP in transport or tunnel mode provides data integrity, authentication, anti-replay, and optional confidentiality for the full iSCSI data stream.
When using CHAP, the target MUST NOT reuse the same CHAP Challenge Identifier in two successive challenges on the same connection. Both parties MUST generate CHAP challenges using a cryptographically strong pseudo-random number generator, and the challenge length SHOULD be at least 16 bytes to counter dictionary attacks.
Connection states for initiators and targets are: FREE (no transport), XPT_WAIT (TCP SYN sent), XPT_UP (transport established, pre-login), IN_LOGIN (login exchange underway), LOGGED_IN (Full Feature Phase active), IN_LOGOUT (logout in progress), LOGOUT_REQUESTED (target requested logout), and CLEANUP_WAIT (awaiting connection cleanup before recovery).
Session states are: FREE (no connections or session not yet established), LOGGED_IN (at least one connection in Full Feature Phase), and FAILED (all connections failed with outstanding tasks requiring recovery via connection reinstatement or session reinstatement).
Every iSCSI PDU begins with a 48-byte Basic Header Segment (BHS), optionally followed by Additional Header Segments (AHS), an optional Header Digest (CRC32C, 4 bytes), a Data Segment, and an optional Data Digest (CRC32C, 4 bytes). PDUs are padded to a 4-byte boundary.
The 48-byte BHS contains: Opcode (6 bits in byte 0, with I and F flag bits), opcode-specific fields (bytes 1-3), TotalAHSLength (1 byte, in 4-byte units), DataSegmentLength (3 bytes, in bytes), LUN (8 bytes), Initiator Task Tag (4 bytes), and opcode-specific fields filling the remaining 20 bytes.
The ISID field in the Login Request is 6 bytes structured as a 2-bit type designator (T field) encoding OUI, EN, or random format, plus a type-specific 46-bit value. ISID is entirely initiator-assigned and is a key part of the session identifier.