Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9054] vwr heuristic dissector mis-identifies ERF file

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 2 on bug 9054 from Stephen Donnelly

(In reply to comment #1)
> (In reply to comment #0)
> 
> I'd prefer not to require the user to have to tell Wiretap what type of file
> to assume a given file is - that would require UI changes to a bunch of
> programs.

I was thinking more of an optional override to deal with cases such as this,
rather than requiring the user to choose every time, but I agree UI changes to
all the programs would be required to leverage it.

> > Could wtap_open_offline() use the file extension as a file type preference?
> > E.g. try the registered file extension dissector first, if unclaimed then
> > run the magic/heuristic dissectors in order?
> 
> That would probably be a good idea.  (It gets tricky for ".cap", as there is
> no single file reader associated with ".cap", as a lot of network analyzer
> writers didn't have much imagination when picking extensions.)

It may be that only a few extensions might be registered, e.g. .pcap, .pcapng,
.erf, .vwr, with more generic extensions like .cap not registered and left at
the mercy of the existing magic/heuristic system.

There is also a small risk of mis-named files, e.g. a file X.erf which is
actually pcap format, however this could be corrected by simply renaming the
file so shouldn't be a concern.

---

      You are receiving this mail because:

• You are watching all bug changes.