Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 1711] Some Toshiba format files with LAPD cannot be open

Date: Fri, 9 Nov 2007 16:02:47 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1711





------- Comment #10 from sindelka@xxxxxxxxxxxxxx  2007-11-09 16:02 GMT -------
Florent,

thanks, however I think you are wasting your time trying to make the ERF
heuristics more precise and risking that, as you say, you will not recognize a
real ERF.

It is true that this issue has occured after the recent improvements of ERF
handling, but Guy's explanation is clear enough to understand that such things
may still happen in future, and why it is done the way it is done. And "options
to bypass some tests" is a way to hell for an ordinary (I mean,
non-wireshark-programmer) user. Since I assume that all the text format parsers
are equally tolerant to some garbage in the beginning of the file as in the
Toshiba case, a comprehensible warning regarding possible "false hit" in the
error message about parsing error in case of formats detected through
heuristics might be a better option.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.