ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 7132] MPEG2 Transport Stream wiretap module wrongly opens

Date: Wed, 18 Apr 2012 05:12:13 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7132

--- Comment #6 from Martin Kaiser <wireshark@xxxxxxxxx> 2012-04-18 05:12:13 PDT ---
Hi Rolf,

> thanks for your comment. Just relying on a starting byte will be good enough
> for many other trace formats. Our trace format starts with 0x45, so that is not
> a 0x47. But in general I believe there may be other formats that start with
> 0x47.

thinking about this again, I suspect this won't work. At least for M-Card in
the US, there's a 12 byte header in front of every packet before the starting
0x47

> So how about requiring a minimum size for the mp2 ts and then checking all of
> this for proper packet framing? Does it make sense to open mp2 ts files with
> less than say 1KB?

I'd like to load very short files with only a few packets, I don't think we can
require >= 1kb.

We might mandate the 0x47 within the first 20 or so bytes. I'll play around
with this and re-open the bug (as suggested by Anders) when I have something
that really improves the detection.

I'm happy to hear that the current state is ok for you.

Best regards,

  Martin

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.