RE: tcpdump endianness
"Viral Mehta" <[email protected]> Fri, 18 Aug 2006 19:16:22 +0530
| Newsgroups | gmane.network.ethereal.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0847999379== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-dev ------------------- --===============0847999379== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0009_01C6C2FA.CAAC2650" This is a multi-part message in MIME format. ------=_NextPart_000_0009_01C6C2FA.CAAC2650 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Thanks for your valuable input.. Now I m stuck up with "what is Link Layer Type". I googled it and find some number assigned to particular type and etc etc.. But what is it? Is it the protocol I am using at DataLinkLayer? Secondly, Why do we have TimezoneOffset and TimeStampAccuracy fields if they are not used at all? What is a per-packet header? Will we have it when we don't write information to a file? As far as I know they give information about time after 1 Jan 1970 and such things.. But if I don't do tcpdump -w sample.cap and instead give a simple command tcpdump sample.cap... Will I have all these information? That is will I have per-packet header? (That is info about time, packet length, and packet's actual length) Thanks, Viral Mehta Embedded Engineer, eInfochips Ltd. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Guy Harris Sent: Thursday, August 17, 2006 11:13 PM To: Ethereal development Subject: Re: [Ethereal-dev] tcpdump endianness ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org <http://www.wireshark.org/> and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-dev ------------------- [email protected] wrote: > I am analyzing tcpdump file. > I want to know how endianness can affect when file is being written. > Or rather, who affects? Application which is writing? or Network byte > order? or what? The endianness of a libpcap-format file (the format used by tcpdump, Wireshark, etc.) is affected by the byte order of the machine writing it. > I read somewhere that magic number of a tcpdump file can be either > 0xa1b2c3d4 or 0xd4c3b2a1. How can it be? It can be if the code that writes the magic number writes it out from a 4-byte integral value of 0xa1b2c3d4 *without* putting it into network byte order first. A machine with the same byte order as the machine that wrote the file will see a magic number of 0xa1b2c3d4; a machine with the opposite byte order will see a magic number of 0xd4c3b2a1. > If endianness is architecture > dependant then how would I know that I have to swap 2 bytes or 4 bytes? You have to swap if the magic number is 0xa1b2c3d4. You have to swap 2 bytes if you have to swap and you're processing a 2-byte quantity. You have to swap 4 bytes if you have to swap and you're processing a 4-byte quantity. Note, by the way, that this applies *ONLY* to the per-file and per-packet headers. It does not apply to the packet data, which is in whatever byte order it was put into on the wire. > really, A bit confusing... Perhaps - the intent was, as I remember reading, to do as little work as possible when capturing packets (the less work done, the less likely you are to drop packets), and do all the byte-order work when reading the capture file. That's why applications typically use libpcap to read the file, rather than reading it directly - it also means that the application won't have to change if the file format changes. > One more thing, does this file have any extension? .tcpdump or .cap No, there is no standard extension for those files. (It originated on UN*X, and UN*X systems are, by and large, not as insistent on standard extensions as, say, Windows.) > I mean there are so many possible or there is not anything like that.. > one can recognise file from its magic number only... That's how it'd be done on the free-software UN*X desktops (on KDE, for example, a PDF file doesn't have to have a name ending in ".pdf" in order to be recognized as a PDF file). _______________________________________________ Ethereal-dev mailing list [email protected] http://www.ethereal.com/mailman/listinfo/ethereal-dev eInfochips Business Disclaimer: This message may contain confidential, proprietary or legally Privileged information. In case you are not the original intended Recipient of the message, you must not, directly or indirectly, use, Disclose, distribute, print, or copy any part of this message and you are requested to delete it and inform the sender. Any views expressed in this message are those of the individual sender unless otherwise stated. Nothing contained in this message shall be construed as an offer or acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and with due authority of eInfochips. eInfochips has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ------=_NextPart_000_0009_01C6C2FA.CAAC2650 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:st2=3D"urn:schemas:contacts" = xmlns:st1=3D"urn:schemas-microsoft-com:office:smarttags" = xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)"> <title>RE: [Ethereal-dev] tcpdump endianness</title> <o:SmartTagType namespaceuri=3D"urn:schemas:contacts" name=3D"Sn"/> <o:SmartTagType namespaceuri=3D"urn:schemas:contacts" = name=3D"middlename"/> <o:SmartTagType namespaceuri=3D"urn:schemas:contacts" = name=3D"GivenName"/> <o:SmartTagType = namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags" name=3D"time"/> <o:SmartTagType = namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags" name=3D"date"/> <o:SmartTagType = namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags" name=3D"PersonName"/> <!--[if !mso]> <style> st2\:*{behavior:url(#default#ieooui) = }st1\:*{behavior:url(#default#ieooui) } </style> <![endif]--> <style> <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} p {mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:12.0pt; font-family:"Times New Roman";} span.EmailStyle18 {mso-style-type:personal-reply; font-family:Arial; color:navy;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </style> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>Hi<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Thanks for your = valuable input..<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Now I m stuck up = with "what is Link Layer Type". I googled it and find some number = assigned to particular type and etc etc.. But what is it? Is it the protocol I am = using at DataLinkLayer?<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Secondly, Why do we = have TimezoneOffset and TimeStampAccuracy fields if they are not used at = all?<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>What is a = per-packet header? Will we have it when we don’t write information to a file? As far = as I know they give information about time after 1 Jan 1970 and such things.. = But if I don’t do tcpdump -w sample.cap and instead give a simple command tcpdump sample.cap... Will I have all these information? That is will I = have per-packet header? (That is info about time, packet length, and packet's = actual length)<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>Thanks,<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><st1:PersonName = w:st=3D"on"><font size=3D2 face=3D"Courier New"><span = style=3D'font-size:10.0pt;font-family:"Courier New"'>Viral Mehta</span></font></st1:PersonName><font size=3D2 face=3D"Courier = New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Embedded = Engineer,<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>eInfochips = Ltd.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>-----Original = Message-----<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>From: [email protected] [<a href=3D"mailto:[email protected]">mailto:ethereal-dev-bou= [email protected]</a>] On <st1:PersonName w:st=3D"on"><st2:GivenName = w:st=3D"on">Behalf</st2:GivenName> <st2:middlename w:st=3D"on">Of</st2:middlename> <st2:middlename = w:st=3D"on">Guy</st2:middlename> <st2:Sn = w:st=3D"on">Harris</st2:Sn></st1:PersonName><o:p></o:p></span></font></p>= <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Sent: Thursday, = <st1:date Year=3D"2006" Day=3D"17" Month=3D"8" ls=3D"trans" w:st=3D"on">August 17, = 2006</st1:date> <st1:time Minute=3D"13" Hour=3D"23" w:st=3D"on">11:13 = PM</st1:time><o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>To: <st1:PersonName = w:st=3D"on"><st2:GivenName w:st=3D"on">Ethereal</st2:GivenName> <st2:Sn = w:st=3D"on">development</st2:Sn></st1:PersonName><o:p></o:p></span></font= ></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Subject: Re: = [Ethereal-dev] tcpdump endianness<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>-------------------<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>The Ethereal = project is being continued at a new site. Please go to <a href=3D"http://www.wireshark.org/">http://www.wireshark.org</a> and = subscribe to [email protected].<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Don't forget to = unsubscribe from this list at <a href=3D"http://www.ethereal.com/mailman/listinfo/ethereal-dev">http://www= .ethereal.com/mailman/listinfo/ethereal-dev</a><o:p></o:p></span></font><= /p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>-------------------<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>[email protected] wrote:<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> I am analyzing = tcpdump file.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> I want to know = how endianness can affect when file is being = written.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> Or rather, who = affects? Application which is writing? or Network byte = <o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> order? or = what?<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>The endianness of a libpcap-format file (the format used by tcpdump, Wireshark, etc.) is = affected by the byte order of the machine writing = it.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> I read = somewhere that magic number of a tcpdump file can be = either<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> 0xa1b2c3d4 or 0xd4c3b2a1. How can it be?<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>It can be if the = code that writes the magic number writes it out from a 4-byte integral value of 0xa1b2c3d4 *without* putting it into network byte order first. A = machine with the same byte order as the machine that wrote the file will see a = magic number of 0xa1b2c3d4; a machine with the opposite byte order will see a = magic number of 0xd4c3b2a1.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> If endianness = is architecture<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> dependant then = how would I know that I have to swap 2 bytes or 4 = bytes?<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>You have to swap if = the magic number is 0xa1b2c3d4.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>You have to swap 2 = bytes if you have to swap and you're processing a 2-byte = quantity.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>You have to swap 4 = bytes if you have to swap and you're processing a 4-byte = quantity.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Note, by the way, = that this applies *ONLY* to the per-file and per-packet headers. It does not = apply to the packet data, which is in whatever byte order it was put into on = the wire.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> really, A bit confusing...<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Perhaps - the = intent was, as I remember reading, to do as little work as possible when capturing = packets (the less work done, the less likely you are to drop packets), and do = all the byte-order work when reading the capture = file.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>That's why = applications typically use libpcap to read the file, rather than reading it directly = - it also means that the application won't have to change if the file format changes.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> One more = thing, does this file have any extension? .tcpdump or = .cap<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>No, there is no = standard extension for those files. (It originated on UN*X, and UN*X = systems are, by and large, not as insistent on standard extensions as, say, = Windows.)<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> I mean there = are so many possible or there is not anything like that.. = <o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>> one can = recognise file from its magic number only...<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>That's how it'd be = done on the free-software UN*X desktops (on KDE, for example, a PDF file doesn't = have to have a name ending in ".pdf" in order to be recognized as a = PDF file).<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>_______________________________________________<o:p></o:p></span></= font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>Ethereal-dev = mailing list<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'>[email protected]<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'><a href=3D"http://www.ethereal.com/mailman/listinfo/ethereal-dev">http://www= .ethereal.com/mailman/listinfo/ethereal-dev</a><o:p></o:p></span></font><= /p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>eInfochips Business Disclaimer:<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier New"'>This message may = contain confidential, proprietary or legally Privileged information. In case you = are not the original intended Recipient of the message, you must not, = directly or indirectly, use, Disclose, distribute, print, or copy any part of this = message and you are requested to delete it and inform the sender. Any views = expressed in this message are those of the individual sender unless otherwise = stated. Nothing contained in this message shall be construed as an offer or = acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and = with due authority of eInfochips. eInfochips has taken enough precautions to = prevent the spread of viruses. However the company accepts no liability for any = damage caused by any virus transmitted by this = email.<o:p></o:p></span></font></p> <p class=3DMsoNormal style=3D'text-autospace:none'><font size=3D2 = face=3D"Courier New"><span style=3D'font-size:10.0pt;font-family:"Courier = New"'><o:p> </o:p></span></font></p> <p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span = style=3D'font-size: 12.0pt'><o:p> </o:p></span></font></p> </div> </body> </html> ------=_NextPart_000_0009_01C6C2FA.CAAC2650-- eInfochips Business Disclaimer: This message may contain confidential, proprietary or legally Privileged information. In case you are not the original intended Recipient of the message, you must not, directly or indirectly, use, Disclose, distribute, print, or copy any part of this message and you are requested to delete it and inform the sender. Any views expressed in this message are those of the individual sender unless otherwise stated. Nothing contained in this message shall be construed as an offer or acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and with due authority of eInfochips. eInfochips has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. --===============0847999379== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ethereal-dev mailing list [email protected] http://www.ethereal.com/mailman/listinfo/ethereal-dev --===============0847999379==-- eInfochips Business Disclaimer: This message may contain confidential, proprietary or legally Privileged information. In case you are not the original intended Recipient of the message, you must not, directly or indirectly, use, Disclose, distribute, print, or copy any part of this message and you are requested to delete it and inform the sender. Any views expressed in this message are those of the individual sender unless otherwise stated. Nothing contained in this message shall be construed as an offer or acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and with due authority of eInfochips. eInfochips has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email.