Wireshark-bugs: [Wireshark-bugs] [Bug 9607] TFShark (Terminal FileShark)
Date: Tue, 07 Jan 2014 08:25:40 +0000

Comment # 25 on bug 9607 from
Let me think... For ELF dissector and example file:
Header, Program Header Table and Section Header Table is 30% of file. Some you
have 3 records and one big blackhole. In "Program Header Table" and "Section
Header Table" you have "Segments", but in real you have only "segment offset",
so segment can be anywhere in file (it is reason why I add "[Info] ->
Backholes" - there are many unused (padding? alignment?) bytes). So file format
need jumps over file context (dissection by incrementing offset is not possible
in all cases)

I hope adding records (however I do not need that feature) in file dissector
can be easier for file dissector developers and make implementation of file
format more continuous.

By the way: what about XML file? It is "record based"? GIF format seems to be
enough good to be second example file format. Do you see there records? 
http://www.w3.org/Graphics/GIF/spec-gif89a.txt I assume that records may be:
Header, Global Color Table and Image Descriptor. I do not think that few basic
record may be useful. Records may be useful when we have for example 100
records :)


You are receiving this mail because:
  • You are watching all bug changes.