Internet Small Computer System Interface (iSCSI) Protocol (Consolidated)

FastAbort multi-task abort semantics were introduced so that after issuing a multi-task abort TMF, an initiator can immediately issue new commands without waiting for per-task cleanup confirmations from third-party sessions. The standard abort model required the initiator to wait for explicit per-task completion acknowledgments, creating a significant latency penalty during error recovery.

tcp

The iSCSI session is defined to map directly to the SCSI I_T nexus, with the session identifier being a tuple of ISID (initiator-assigned) and Target Portal Group Tag (target-assigned). This design preserves the SCSI single-initiator/single-target relationship across multiple TCP connections, allowing connection-level failover and load balancing while maintaining correct SCSI task ordering and reservation semantics.

tcp

RFC 7143 removes SPKM authentication (present in RFC 3720) entirely and deprecates SLP-based discovery (implementations SHOULD NOT rely on it). The X# prefix for new public extension keys, Y# for new digest extensions, and Z# for new authentication method extensions are all prohibited for new registrations to avoid fragmentation of the key namespace.

tcp, security

The iSCSIProtocolLevel key is set to '1' in RFC 7143 to distinguish implementations from RFC 3720 (level 0). When the TaskReporting negotiation results in 'RFC3720' or 'NotUnderstood', the peer is an RFC 3720-only implementation. Initiators SHOULD NOT use ACA on multi-connection sessions with such targets due to absence of ACA-related response fencing in RFC 3720.

tcp

Commands marked for immediate delivery MUST carry the current CmdSN, and the CmdSN MUST NOT advance after such a command is sent. The target MUST NOT transmit a MaxCmdSN less than ExpCmdSN − 1, and MUST silently ignore non-immediate commands outside the ExpCmdSN-to-MaxCmdSN window.

tcp

For any read or bidirectional command, a target MUST issue fewer than 2**32 combined R2T and Data-In PDUs. Any output data sequence MUST contain fewer than 2**32 Data-Out PDUs. DataSN starts at 0 for the first PDU of a sequence and advances by 1 for each subsequent PDU.

tcp

iSCSI implementations MUST implement IPsec using the 2400-series RFCs (IPsec v2 / IKEv1) and SHOULD implement IPsec using the 4300-series RFCs (IPsec v3 / IKEv2) as specified in RFC 7146. Extended sequence numbers (ESNs) are required when using ESPv2.

security, ipsec

iSCSI targets and initiators MUST support at least one TCP connection per session and MAY support several. For error recovery purposes, implementations supporting a single active connection SHOULD support two connections during recovery.

tcp

The ErrorRecoveryLevel key negotiates error recovery scope: 0 = session-level recovery only, 1 = digest and within-connection recovery, 2 = connection recovery and task reassignment. The effective level is the minimum of the values proposed by initiator and target. Initiators MUST NOT use capabilities exceeding the negotiated level.

tcp

The iSCSI target layer MUST deliver non-immediate commands for execution in the order specified by CmdSN. An initiator MUST send commands in increasing CmdSN order on any connection, except for retransmissions. Comparisons and arithmetic on CmdSN, ExpCmdSN, and MaxCmdSN MUST use Serial Number Arithmetic per RFC 1982 with SERIAL_BITS=32.

tcp

The Logout Response MUST carry Time2Wait (minimum seconds before attempting a new connection) and Time2Retain (maximum seconds during which connection or task resources are retained for recovery). Initiators MUST NOT attempt to reuse resources or reconnect until Time2Wait seconds have elapsed after receiving a Logout Response.

tcp

When the TaskReporting key is negotiated to ResponseFence or FastAbort on a multi-connection session, the target iSCSI layer MUST NOT send a fenced SCSI Response PDU until acknowledgments are received for all unacknowledged StatSNs on every session connection. All subsequent responses for the affected I_T_L nexus MUST be queued until the fence is cleared.

tcp

iSCSI defines initiator opcodes 0x00–0x1F and target opcodes 0x20–0x3F. Initiator opcodes include: NOP-Out (0x00), SCSI Command (0x01), Task Management Request (0x02), Login Request (0x03), Text Request (0x04), SCSI Data-Out (0x05), Logout Request (0x06), SNACK (0x10). Target opcodes include: NOP-In (0x20), SCSI Response (0x21), Task Management Response (0x22), Login Response (0x23), Text Response (0x24), SCSI Data-In (0x25), Logout Response (0x26), R2T (0x31), Async Message (0x32), Reject (0x3F).

tcp, registry

iSCSI supports three name formats: IQN (iqn.YYYY-MM.reversed-domain:optional-string), EUI-64 (eui. followed by 16 hexadecimal digits), and NAA (naa. followed by NAA identifier hex digits). Names are globally unique node identifiers, case-insensitive, encoded in UTF-8, and up to 223 bytes in length; they are independent of network address.

tcp

The Asynchronous Message PDU is sent by the target to notify the initiator of events without a corresponding request. The AsyncEvent field specifies event type: SCSI Async Event (0), Request Logout (1), Drop Connection (2), Drop All Connections (3), Negotiate Parameters (4), and vendor-specific (240–255). AsyncVCode provides a vendor-specific code for vendor events.

tcp

The Login Request PDU carries: ISID (6-byte initiator-assigned session identifier), TSIH (2-byte target session handle, 0 for new sessions), CID (2-byte connection ID), CmdSN, Version-max, Version-min, T-bit (transit to NSG), C-bit (continue), CSG (current stage, 2 bits), NSG (next stage, 2 bits), and login parameters as key=value pairs in the data segment.

tcp, security

The Login Response carries Version-max and Version-active (negotiated version), TSIH (assigned by target on new session establishment), Status-Class (1 byte) and Status-Detail (1 byte) encoding success (0x00/0x00) or error class/detail, T-bit (transit), C-bit (continue), and negotiated parameters in the data segment.

tcp, security

The Ready To Transfer (R2T) PDU is issued by the target to solicit Data-Out PDUs. It carries StatSN, R2TSN (32-bit sequence number per command), Target Transfer Tag (TTT, opaque reference to be echoed in Data-Out PDUs), Buffer Offset (byte position in data stream), and Desired Data Transfer Length.

tcp

The SNACK Request PDU requests retransmission of missed data, R2T, or status PDUs. The Type field (4 bits) specifies: Data/R2T SNACK (0), Status SNACK (1), Data ACK (2), R-Data SNACK (3). BegRun (4 bytes) and RunLength (4 bytes) identify the starting DataSN/R2TSN and count of missing PDUs.

tcp

The Task Management Function Request PDU specifies the function via the Function field: ABORT TASK (1), ABORT TASK SET (2), CLEAR ACA (3), CLEAR TASK SET (4), LOGICAL UNIT RESET (5), TARGET WARM RESET (6), TARGET COLD RESET (7), TASK REASSIGN (8). Referenced Task Tag (4 bytes) and RefCmdSN (4 bytes) identify the task to act upon.

tcp

IANA maintains registries updated by this document: (1) iSCSI Initiator Opcodes (values 0x00–0x1F), (2) iSCSI Target Opcodes (0x20–0x3F), (3) iSCSI Login/Text Operational Text Keys (including HeaderDigest, DataDigest, MaxConnections, InitialR2T, ImmediateData, MaxBurstLength, FirstBurstLength, DefaultTime2Wait, DefaultTime2Retain, MaxOutstandingR2T, DataPDUInOrder, DataSequenceInOrder, ErrorRecoveryLevel, SessionType, TaskReporting, iSCSIProtocolLevel), (4) iSCSI Authentication Method values, and (5) Task Management Function codes.

registry, tcp

CHAP is the baseline in-band authentication mechanism. CHAP secrets MUST be at least 96 bits (12 bytes) to resist dictionary attacks, CHAP challenge values MUST be at least 64 bits, and mutual (bidirectional) CHAP is RECOMMENDED to prevent man-in-the-middle attacks. CHAP secrets MUST NOT be shared across different iSCSI targets.

security, crypto

IPsec ESP with AES-CBC or 3DES-CBC MUST be used to provide data confidentiality when iSCSI traffic transits open networks. IKE is REQUIRED for automated key management and security association negotiation; manual keying is permitted only in constrained closed-network deployments.

security, ipsec, crypto

The X#NodeArchitecture key provides informational architecture metadata and MUST NOT be used to make security-relevant decisions because its content is neither authenticated nor integrity-protected. It MUST NOT influence access control, trust level, or any security-critical processing.

security

Session states for both initiators and targets are FREE (no session), LOGGED_IN (at least one connection in LOGGED_IN state), and FAILED (all connections failed, session not yet timed out or reinstated). The session enters LOGGED_IN on the first connection reaching LOGGED_IN, and returns to FREE via explicit logout or session timeout/reinstatement.

tcp

Standard connection states are FREE (initial/terminal), XPT_WAIT (TCP SYN sent), XPT_UP (TCP established), IN_LOGIN (login negotiation), LOGGED_IN (full feature phase), IN_LOGOUT (logout in progress), LOGOUT_REQUESTED (async logout requested by target), and CLEANUP_WAIT (awaiting connection cleanup). Transitions are triggered by TCP events, Login PDU exchanges, Logout PDUs, and timeout/error events.

tcp

Additional Header Segments (AHS) follow the BHS and are 4-byte aligned. Each AHS has a 2-byte AHSLength (excluding the 4-byte AHS header), 1-byte AHSType, and 1-byte AHSSpecific field followed by variable-length data. Two types are defined: Extended CDB AHS (0x01) for CDBs exceeding 16 bytes, and Bidirectional Read Expected Data Transfer Length AHS (0x02).

tcp

Every iSCSI PDU begins with a fixed 48-byte Basic Header Segment (BHS): byte 0 carries the I (immediate) bit and 6-bit Opcode; byte 1 carries the F (Final) bit and opcode-specific flags; bytes 4–7 carry TotalAHSLength (1 byte) and DataSegmentLength (3 bytes); bytes 8–15 carry the LUN; bytes 16–19 carry the Initiator Task Tag; remaining bytes are opcode-specific. All PDUs MUST be padded to 4-byte boundaries.

tcp