Wireshark · Wireshark-dev: Re: [Wireshark-dev] Wiretap's mpeg decoder has weak magic for MPEG-PES

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Sun, Nov 16, 2008 at 06:50:18PM -0800, Guy Harris wrote:

> ...and if PacketLogger files don't have a magic number, and if the 
> heuristics for it are stronger than those for PES sequences, you could 
> put the entry for it before the entry for the MPEG file reader.

Correct, PacketLogger files do not have a magic number.  Its current 
hueristic is:

	if(!((pl_hdr.len & 0xFFFF0000) == 0 && (pl_hdr.type < 0x04 ||
						pl_hdr.type == 0xFE ||
						pl_hdr.type == 0xFF)))

... which is partially borrowed from the Linux BlueZ bluetooth file 
Anazlyer for Gnome.


Steve