Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Patch submitted for IPFIX file format support

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 21 Sep 2010 13:42:56 -0400
Hadriel Kaplan wrote:
Howdy,
I've submitted bug 5242 with an attached patch diff for supporting the IPFIX file format, per RFC 5655.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5242

The one open issue/question I have regards a heuristic for determining if it's the right file type.  Unfortunately, the IPFIX file format has no magic sequence, and is literally just the IPFIX/Netflow_v10 messages in a file.  Right now, the open routine just checks if the first byte is the right version number, i.e. that the first two bytes of the file are 0x000A.  That's good enough to separate it from ascii files, obviously, but will probably collide with other binary file formats.  So... should I have the open routine also try to parse the messages further, or parse multiple messages? or should I just leave it as is?

That sounds like the heuristic is too weak. We've had big problems before with file type heuristics being too weak and thus Wireshark thinking it can open any type of file--only to abort out later on when something goes wrong.

I believe the ERF wiretap module checks to ensure that some number of packets are 'sane'--that might be a good approach. (The ERF module also allows the user to tune the behavior via the ERF_RECORDS_TO_CHECK environment variable.)