Wireshark · Wireshark-dev: Re: [Wireshark-dev] Patch submitted for IPFIX file format support

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Hadriel Kaplan wrote:
> Howdy,
> I've submitted bug 5242 with an attached patch diff for supporting the IPFIX file format, per RFC 5655.
> https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5242
>
> The one open issue/question I have regards a heuristic for determining if it's the right file type.  Unfortunately, the IPFIX file format has no magic sequence, and is literally just the IPFIX/Netflow_v10 messages in a file.  Right now, the open routine just checks if the first byte is the right version number, i.e. that the first two bytes of the file are 0x000A.  That's good enough to separate it from ascii files, obviously, but will probably collide with other binary file formats.  So... should I have the open routine also try to parse the messages further, or parse multiple messages? or should I just leave it as is?

That sounds like the heuristic is too weak.  We've had big problems 
before with file type heuristics being too weak and thus Wireshark 
thinking it can open any type of file--only to abort out later on when 
something goes wrong.

I believe the ERF wiretap module checks to ensure that some number of 
packets are 'sane'--that might be a good approach.  (The ERF module also 
allows the user to tune the behavior via the ERF_RECORDS_TO_CHECK 
environment variable.)