Wireshark-bugs: [Wireshark-bugs] [Bug 9054] vwr libwiretap heuristic file type recognizer mis-id
Comment # 5
on bug 9054
from Guy Harris
(In reply to comment #2)
> It may be that only a few extensions might be registered, e.g. .pcap,
> .pcapng, .erf, .vwr, with more generic extensions like .cap not registered
> and left at the mercy of the existing magic/heuristic system.
>
> There is also a small risk of mis-named files, e.g. a file X.erf which is
> actually pcap format, however this could be corrected by simply renaming the
> file so shouldn't be a concern.
The fix in r54495 checks the file types with magic numbers first, regardless of
the extension, so it should correctly identify pcap and pcap-ng files. After
that, if the file being opened has an extension, the heuristics with that as
one of the extensions associated with the file type are run (in order) first,
followed by the heuristics that don't have that as one of the associations
associated with the file type; if the file has no extension, the heuristics are
run in order regardless of what extensions the file type has.
You are receiving this mail because:
- You are watching all bug changes.
