Wireshark-bugs: [Wireshark-bugs] [Bug 10754] cannot open rf5 file

Date: Mon, 08 Dec 2014 08:53:24 +0000

Comment # 4 on bug 10754 from
(In reply to Guy Harris from comment #2)
> So is the the file exactly as saved on the K1205?  Or did some other
> programs process it?
> 
> It begins with:
> 
>     0x95 0x22
> 
>     0x00 0x00 0x02 0x00
> 
>     the null-terminated string "2r3.4f5"
> 
>     the null-terminated string
> "C:\Users\ro1h0035\AppData\Local\Microsoft\Windows\Temporary Internet
> Files\Content.Word\2re.rf5"
> 
>     0x00 0x00 0x03 0x00
> 
>     a 4-byte little-endian value of 45, followed by the 45-byte
> null-terminated string "C:\Users\ro1h0035\AppData\Local\Temp\2re.rf5" (45
> bytes including the terminating \0)
> 
>     a 4-byte little-endian value of 8386, which is the size of the file
> 
> followed by what looks like a valid RF5 file header, in which the file size
> fields have a value of 8386, suggesting that the stuff before the RF5 file
> header is part of the file.
> 
> However, the count of records in the file is larger than the actual number
> of records in the file.  The records themselves look OK (although some
> changes needed to be made to the RF5-reading code, but the previous code was
> making some incorrect assumptions).

I was sent the file by the people that actually took the traces so that I could
analyses their problem. So, I don't know whether they did something to the file
before sending it to me. I'll have to get back to them and find out.


You are receiving this mail because:
  • You are watching all bug changes.