From 64b63e493ce1b9e1f5665bc69b7ffe59fe1764eb Mon Sep 17 00:00:00 2001
From: Jeff Morriss <jeff.morriss.ws@gmail.com>
Date: Thu, 7 Feb 2013 03:24:12 +0000
Subject: Add magic matching to PCAP, PCAPNG, and snoop files (based on
 Fedora's magic file).  That way your files don't need to be named (e.g.)
 *.pcap for your file manager to know that they should be opened with
 Wireshark.

Add *.ntar to the list of patterns for PCAPNG files.

svn path=/trunk/; revision=47529
---
 wireshark-mime-package.xml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'wireshark-mime-package.xml')

diff --git a/wireshark-mime-package.xml b/wireshark-mime-package.xml
index 441f5b5503..c53e673c2b 100644
--- a/wireshark-mime-package.xml
+++ b/wireshark-mime-package.xml
@@ -7,18 +7,38 @@
     <generic-icon name="application-wireshark-doc"/>
     <alias type="application/x-pcap"/>
     <alias type="application/pcap"/>
+    <magic>
+      <!-- standard PCAP file -->
+      <match type="big32"    offset="0" value="0xa1b2c3d4"/>
+      <match type="little32" offset="0" value="0xa1b2c3d4"/>
+      <!-- extended (Alexey-Kuznetsov's-patches) PCAP file -->
+      <match type="big32"    offset="0" value="0xa1b2cd34"/>
+      <match type="little32" offset="0" value="0xa1b2cd34"/>
+    </magic>
     <glob pattern="*.pcap"/>
   </mime-type>
 
   <mime-type type="application/x-pcapng">
     <comment>Packet Capture (PCAPNG)</comment>
     <generic-icon name="application-wireshark-doc"/>
+    <magic>
+      <match type="big32"      offset="0" value="0x0a0d0d0a">
+	<match type="big32"    offset="8" value="0x1a2b3c4d"/>
+      </match>
+      <match type="little32"   offset="0" value="0x0a0d0d0a">
+	<match type="little32" offset="8" value="0x1a2b3c4d"/>
+      </match>
+    </magic>
     <glob pattern="*.pcapng"/>
+    <glob pattern="*.ntar"/>
   </mime-type>
 
   <mime-type type="application/x-snoop">
     <comment>Packet Capture (Snoop)</comment>
     <generic-icon name="application-wireshark-doc"/>
+    <magic>
+      <match type="string"      offset="0" value="snoop"/>
+    </magic>
     <glob pattern="*.snoop"/>
   </mime-type>
 </mime-info>
-- 
cgit v1.2.1