Wireshark-dev: Re: [Wireshark-dev] Wiretap's mpeg decoder has weak magic for MPEG-PES
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 16 Nov 2008 18:50:18 -0800

On Nov 16, 2008, at 6:38 PM, Stephen Fisher wrote:


One of the magic sequences in the wiretap mpeg decoder is pretty weak
and is grabbing files that belong to a new wiretap decoder I'm writing. 

By "wiretap decoder" do you mean "wiretap file reader"?

If so...
It is the sequence for MPEG-PES: 0x000001. The problem is that I can't 
find any way to strengthen it without the possibility of breaking
something.


	...


P.S. The new wiretap decoder I've written reads in files from Apple's
PacketLogger bluetooth data capture program.
...and if PacketLogger files don't have a magic number, and if the heuristics for it are stronger than those for PES sequences, you could put the entry for it before the entry for the MPEG file reader.