- From: Gregory Maxwell <gmaxwell@gmail.com>
- Date: Mon, 6 Sep 2010 20:46:29 -0400
On Mon, Sep 6, 2010 at 3:19 PM, Aryeh Gregor <Simetrical+w3c at gmail.com> wrote: > On Mon, Sep 6, 2010 at 4:14 AM, Philip J?genstedt <philipj at opera.com> wrote: >> The Ogg page begins with the 4 bytes "OggS", which is what Opera (GStreamer) >> checks for. For additional safety, one could also check for the trailing >> version indicator, which ought to be a NULL byte for current Ogg. [1] [2] > > "OggS\0" as the first five bytes seems safe to check for. ?It's rather > short, I guess because it's repeated on every page, but five bytes is > long enough that it should occur by random only negligibly often, in > either text or binary files. Um... If you do that you will fail to capture on files that most other ogg reading tools will happily capture on. Common software will read forward until it hits OggS then it will check the page CRC (in total, 9 bytes of capture). For example, here is a file which begins with a kilobyte of \0: http://myrandomnode.dyndns.org:8080/~gmaxwell/test.ogg Everything I had handy played it. This could fail to capture on a live stream that didn't ensure new listeners began at a page boundary. I don't know if any of these exist. I don't know if breaking these cases would matter much but herein lies the danger of sniffing? everyone thinks they're an expert but no one really has a handle on the implications.
Received on Monday, 6 September 2010 17:46:29 UTC