epan/dissectors/file-pcapng.c

   1 /* file-pcapng.c
   2  * Routines for PCAPNG File Format
   3  * https://github.com/pcapng/pcapng
   4  *
   5  * Copyright 2015, Michal Labedzki for Tieto Corporation
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25
  26 #include "config.h"
  27
  28 #include <epan/packet.h>
  29 #include <epan/prefs.h>
  30 #include <epan/expert.h>
  31 #include <epan/exceptions.h>
  32 #include <epan/show_exception.h>
  33 #include <epan/addr_resolv.h>
  34 #include <epan/wmem/wmem.h>
  35
  36 #include <epan/dissectors/packet-pcap_pktdata.h>
  37
  38 static int proto_pcapng = -1;
  39
  40 static dissector_handle_t  pcap_pktdata_handle;
  41
  42 static int hf_pcapng_block = -1;
  43
  44 static int hf_pcapng_block_type = -1;
  45 static int hf_pcapng_block_type_vendor = -1;
  46 static int hf_pcapng_block_type_value = -1;
  47 static int hf_pcapng_block_length = -1;
  48 static int hf_pcapng_block_data = -1;
  49
  50 static int hf_pcapng_section_header_byte_order_magic = -1;
  51 static int hf_pcapng_section_header_major_version = -1;
  52 static int hf_pcapng_section_header_minor_version = -1;
  53 static int hf_pcapng_section_header_section_length = -1;
  54 static int hf_pcapng_options = -1;
  55 static int hf_pcapng_option = -1;
  56 static int hf_pcapng_option_code = -1;
  57 static int hf_pcapng_option_code_section_header = -1;
  58 static int hf_pcapng_option_code_interface_description = -1;
  59 static int hf_pcapng_option_code_enhanced_packet = -1;
  60 static int hf_pcapng_option_code_packet = -1;
  61 static int hf_pcapng_option_code_interface_statistics = -1;
  62 static int hf_pcapng_option_code_name_resolution = -1;
  63 static int hf_pcapng_option_length = -1;
  64 static int hf_pcapng_option_data = -1;
  65 static int hf_pcapng_option_data_comment = -1;
  66 static int hf_pcapng_option_data_section_header_hardware = -1;
  67 static int hf_pcapng_option_data_section_header_os = -1;
  68 static int hf_pcapng_option_data_section_header_user_application = -1;
  69 static int hf_pcapng_option_data_interface_description_name = -1;
  70 static int hf_pcapng_option_data_interface_description_description = -1;
  71 static int hf_pcapng_option_data_ipv4 = -1;
  72 static int hf_pcapng_option_data_ipv4_mask = -1;
  73 static int hf_pcapng_option_data_ipv6 = -1;
  74 static int hf_pcapng_option_data_ipv6_mask = -1;
  75 static int hf_pcapng_option_data_mac_address = -1;
  76 static int hf_pcapng_option_data_eui_address = -1;
  77 static int hf_pcapng_option_data_interface_speed = -1;
  78 static int hf_pcapng_option_data_interface_timestamp_resolution = -1;
  79 static int hf_pcapng_option_data_interface_timestamp_resolution_base = -1;
  80 static int hf_pcapng_option_data_interface_timestamp_resolution_value = -1;
  81 static int hf_pcapng_option_data_interface_timezone = -1;
  82 static int hf_pcapng_option_data_interface_filter = -1;
  83 static int hf_pcapng_option_data_interface_os = -1;
  84 static int hf_pcapng_option_data_interface_fcs_length = -1;
  85 static int hf_pcapng_option_data_interface_timestamp_offset = -1;
  86 static int hf_pcapng_option_data_packet_drop_count = -1;
  87 static int hf_pcapng_option_data_packet_hash_algorithm = -1;
  88 static int hf_pcapng_option_data_packet_hash_data = -1;
  89 static int hf_pcapng_option_data_packet_flags = -1;
  90 static int hf_pcapng_option_data_packet_flags_link_layer_errors = -1;
  91 static int hf_pcapng_option_data_packet_flags_link_layer_errors_symbol = -1;
  92 static int hf_pcapng_option_data_packet_flags_link_layer_errors_preamble = -1;
  93 static int hf_pcapng_option_data_packet_flags_link_layer_errors_start_frame_delimiter = -1;
  94 static int hf_pcapng_option_data_packet_flags_link_layer_errors_unaligned_frame = -1;
  95 static int hf_pcapng_option_data_packet_flags_link_layer_errors_wrong_inter_frame_gap = -1;
  96 static int hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_short = -1;
  97 static int hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_long = -1;
  98 static int hf_pcapng_option_data_packet_flags_link_layer_errors_crc_error = -1;
  99 static int hf_pcapng_option_data_packet_flags_link_layer_errors_reserved = -1;
 100 static int hf_pcapng_option_data_packet_flags_reserved = -1;
 101 static int hf_pcapng_option_data_packet_flags_fcs_length = -1;
 102 static int hf_pcapng_option_data_packet_flags_reception_type = -1;
 103 static int hf_pcapng_option_data_packet_flags_direction = -1;
 104 static int hf_pcapng_option_data_dns_name = -1;
 105 static int hf_pcapng_option_data_start_time = -1;
 106 static int hf_pcapng_option_data_end_time = -1;
 107 static int hf_pcapng_option_data_interface_received = -1;
 108 static int hf_pcapng_option_data_interface_dropped = -1;
 109 static int hf_pcapng_option_data_interface_accepted_by_filter = -1;
 110 static int hf_pcapng_option_data_interface_dropped_by_os = -1;
 111 static int hf_pcapng_option_data_interface_delivered_to_user = -1;
 112 static int hf_pcapng_option_padding = -1;
 113 static int hf_pcapng_interface_description_link_type = -1;
 114 static int hf_pcapng_interface_description_reserved = -1;
 115 static int hf_pcapng_interface_description_snap_length = -1;
 116 static int hf_pcapng_packet_block_interface_id = -1;
 117 static int hf_pcapng_packet_block_drops_count = -1;
 118 static int hf_pcapng_captured_length = -1;
 119 static int hf_pcapng_packet_length = -1;
 120 static int hf_pcapng_packet_data = -1;
 121 static int hf_pcapng_packet_padding = -1;
 122 static int hf_pcapng_interface_id = -1;
 123 static int hf_pcapng_timestamp_high = -1;
 124 static int hf_pcapng_timestamp_low = -1;
 125 static int hf_pcapng_timestamp = -1;
 126 static int hf_pcapng_records = -1;
 127 static int hf_pcapng_record = -1;
 128 static int hf_pcapng_record_code = -1;
 129 static int hf_pcapng_record_length = -1;
 130 static int hf_pcapng_record_data = -1;
 131 static int hf_pcapng_record_ipv4 = -1;
 132 static int hf_pcapng_record_ipv6 = -1;
 133 static int hf_pcapng_record_name = -1;
 134 static int hf_pcapng_record_padding = -1;
 135
 136 static expert_field ei_invalid_option_length = EI_INIT;
 137 static expert_field ei_invalid_record_length = EI_INIT;
 138
 139 static gint ett_pcapng = -1;
 140 static gint ett_pcapng_section_header_block = -1;
 141 static gint ett_pcapng_block_data = -1;
 142 static gint ett_pcapng_options = -1;
 143 static gint ett_pcapng_option = -1;
 144 static gint ett_pcapng_records = -1;
 145 static gint ett_pcapng_record = -1;
 146 static gint ett_pcapng_packet_data = -1;
 147
 148 static const int *hfx_pcapng_option_data_interface_timestamp_resolution[] = {
 149     &hf_pcapng_option_data_interface_timestamp_resolution_base,
 150     &hf_pcapng_option_data_interface_timestamp_resolution_value,
 151     NULL
 152 };
 153
 154 static const int *hfx_pcapng_option_data_packet_flags_link_layer_errors[] = {
 155     &hf_pcapng_option_data_packet_flags_link_layer_errors_symbol,
 156     &hf_pcapng_option_data_packet_flags_link_layer_errors_preamble,
 157     &hf_pcapng_option_data_packet_flags_link_layer_errors_start_frame_delimiter,
 158     &hf_pcapng_option_data_packet_flags_link_layer_errors_unaligned_frame,
 159     &hf_pcapng_option_data_packet_flags_link_layer_errors_wrong_inter_frame_gap,
 160     &hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_short,
 161     &hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_long,
 162     &hf_pcapng_option_data_packet_flags_link_layer_errors_crc_error,
 163     &hf_pcapng_option_data_packet_flags_link_layer_errors_reserved,
 164     NULL
 165 };
 166
 167 static const int *hfx_pcapng_option_data_packet_flags[] = {
 168     &hf_pcapng_option_data_packet_flags_reserved,
 169     &hf_pcapng_option_data_packet_flags_fcs_length,
 170     &hf_pcapng_option_data_packet_flags_reception_type,
 171     &hf_pcapng_option_data_packet_flags_direction,
 172     NULL
 173 };
 174
 175 static const int *hfx_pcapng_block_type[] = {
 176     &hf_pcapng_block_type_vendor,
 177     &hf_pcapng_block_type_value,
 178     NULL
 179 };
 180
 181 struct info {
 182     guint32        file_number;
 183     guint32        interface_number;
 184     guint32        frame_number;
 185     wmem_array_t  *interfaces;
 186 };
 187
 188 struct interface_description {
 189     guint32  link_type;
 190     guint8   timestamp_resolution;
 191     guint64  timestamp_offset;
 192 };
 193
 194
 195 static gboolean pref_dissect_next_layer = FALSE;
 196
 197 #define BLOCK_INTERFACE_DESCRIPTION  0x00000001
 198 #define BLOCK_PACKET                 0x00000002
 199 #define BLOCK_SIMPLE_PACKET          0x00000003
 200 #define BLOCK_NAME_RESOLUTION        0x00000004
 201 #define BLOCK_INTERFACE_STATISTICS   0x00000005
 202 #define BLOCK_ENHANCED_PACKET        0x00000006
 203 #define BLOCK_IRIG_TIMESTAMP         0x00000007
 204 #define BLOCK_ARINC_429              0x00000008
 205 #define BLOCK_SECTION_HEADER         0x0A0D0D0A
 206
 207 static const value_string block_type_vals[] = {
 208     { 0x00000001,  "Interface Description Block" },
 209     { 0x00000002,  "Packet Block" },
 210     { 0x00000003,  "Simple Packet Block" },
 211     { 0x00000004,  "Name Resolution Block" },
 212     { 0x00000005,  "Interface Statistics Block" },
 213     { 0x00000006,  "Enhanced Packet Block" },
 214     { 0x00000007,  "IRIG Timestamp Block" },
 215     { 0x00000008,  "Arinc 429 in AFDX Encapsulation Information Block " },
 216     { 0x0A0D0D0A,  "Section Header Block" },
 217     { 0, NULL }
 218 };
 219
 220 static const value_string option_code_section_header_vals[] = {
 221     { 0x0000,  "End of Options" },
 222     { 0x0001,  "Comment" },
 223
 224     { 0x0002,  "Hardware Description" },
 225     { 0x0003,  "OS Description" },
 226     { 0x0004,  "User Application" },
 227     { 0, NULL }
 228 };
 229
 230 static const value_string option_code_interface_description_vals[] = {
 231     { 0x0000,  "End of Options" },
 232     { 0x0001,  "Comment" },
 233
 234     { 0x0002,  "Interface Name" },
 235     { 0x0003,  "Interface Description" },
 236     { 0x0004,  "IPv4 Address" },
 237     { 0x0005,  "IPv6 Address" },
 238     { 0x0006,  "MAC Address" },
 239     { 0x0007,  "EUI Address" },
 240     { 0x0008,  "Speed" },
 241     { 0x0009,  "Timestamp Resolution" },
 242     { 0x000A,  "Timezone" },
 243     { 0x000B,  "Filter" },
 244     { 0x000C,  "OS" },
 245     { 0x000D,  "FCS Length" },
 246     { 0x000E,  "Timestamo Offset" },
 247     { 0, NULL }
 248 };
 249
 250 static const value_string option_code_enhanced_packet_vals[] = {
 251     { 0x0000,  "End of Options" },
 252     { 0x0001,  "Comment" },
 253
 254     { 0x0002,  "Flags" },
 255     { 0x0003,  "Hash" },
 256     { 0x0004,  "Drop Count" },
 257     { 0, NULL }
 258 };
 259
 260 static const value_string option_code_packet_vals[] = {
 261     { 0x0000,  "End of Options" },
 262     { 0x0001,  "Comment" },
 263
 264     { 0x0002,  "Flags" },
 265     { 0x0003,  "Hash" },
 266     { 0, NULL }
 267 };
 268
 269
 270 static const value_string option_code_name_resolution_vals[] = {
 271     { 0x0000,  "End of Options" },
 272     { 0x0001,  "Comment" },
 273
 274     { 0x0002,  "DNS Name" },
 275     { 0x0003,  "DNS IPv4 Address" },
 276     { 0x0004,  "DNS IPv6 Address" },
 277     { 0, NULL }
 278 };
 279
 280
 281 static const value_string option_code_interface_statistics_vals[] = {
 282     { 0x0000,  "End of Options" },
 283     { 0x0001,  "Comment" },
 284
 285     { 0x0002,  "Start Time" },
 286     { 0x0003,  "End Time" },
 287     { 0x0004,  "Number of Rx Packets" },
 288     { 0x0005,  "Number of Dropped Packets" },
 289     { 0x0006,  "Number of Accepted Packets" },
 290     { 0x0007,  "Number of Packets Dropped by OS" },
 291     { 0x0008,  "Number of Packets Delivered to the User" },
 292     { 0, NULL }
 293 };
 294
 295 static const value_string record_code_vals[] = {
 296     { 0x0000,  "End of Records" },
 297     { 0x0001,  "IPv4 Record" },
 298     { 0x0002,  "IPv6 Record" },
 299     { 0, NULL }
 300 };
 301
 302
 303 static const value_string timestamp_resolution_base_vals[] = {
 304     { 0x0000,  "Power of 10" },
 305     { 0x0001,  "Power of 2" },
 306     { 0, NULL }
 307 };
 308
 309 static const value_string packet_hash_algorithm_vals[] = {
 310     { 0x00,  "2's complement" },
 311     { 0x01,  "XOR" },
 312     { 0x02,  "CRC32" },
 313     { 0x03,  "MD5" },
 314     { 0x04,  "SHA1" },
 315     { 0, NULL }
 316 };
 317
 318 static const value_string packet_flags_direction_vals[] = {
 319     { 0x00,  "Information Not Available" },
 320     { 0x01,  "Inbound" },
 321     { 0x02,  "Outbound" },
 322     { 0, NULL }
 323 };
 324
 325 static const value_string flags_reception_type_vals[] = {
 326     { 0x00,  "Not Specified" },
 327     { 0x01,  "Unicast" },
 328     { 0x02,  "Multicast" },
 329     { 0x03,  "Broadcast" },
 330     { 0x04,  "Promiscuous" },
 331     { 0, NULL }
 332 };
 333
 334 void proto_register_pcapng(void);
 335 void proto_reg_handoff_pcapng(void);
 336
 337 static gint dissect_options(proto_tree *tree, packet_info *pinfo,
 338         guint32 block_type, tvbuff_t *tvb, guint encoding, void *user_data)
 339 {
 340     proto_tree  *options_tree;
 341     proto_item  *options_item;
 342     proto_tree  *option_tree;
 343     proto_item  *option_item;
 344     proto_item  *p_item;
 345     gint         offset = 0;
 346     guint16      option_code;
 347     gint         option_length;
 348     gint         hfj_pcapng_option_code;
 349     const gchar *str = NULL;
 350     address      addr;
 351     address      addr_mask;
 352     const value_string  *vals = NULL;
 353     union       value {
 354             guint32 u32;
 355             guint64 u64;
 356             guint8  u8;
 357     } value;
 358
 359     if (tvb_reported_length(tvb) <= 0)
 360         return 0;
 361
 362     options_item = proto_tree_add_item(tree, hf_pcapng_options, tvb, offset, -1, ENC_NA);
 363     options_tree = proto_item_add_subtree(options_item, ett_pcapng_options);
 364
 365     while (tvb_captured_length_remaining(tvb, offset)) {
 366         str = NULL;
 367         option_code   = tvb_get_guint16(tvb, offset, encoding);
 368         option_length = tvb_get_guint16(tvb, offset + 2, encoding);
 369
 370         option_item = proto_tree_add_item(options_tree, hf_pcapng_option, tvb, offset, option_length + 2 * 2, ENC_NA);
 371         option_tree = proto_item_add_subtree(option_item, ett_pcapng_option);
 372
 373         switch (block_type) {
 374         case BLOCK_SECTION_HEADER:
 375             hfj_pcapng_option_code = hf_pcapng_option_code_section_header;
 376             vals = option_code_section_header_vals;
 377             break;
 378         case BLOCK_INTERFACE_DESCRIPTION:
 379             hfj_pcapng_option_code = hf_pcapng_option_code_interface_description;
 380             vals = option_code_interface_description_vals;
 381             break;
 382         case BLOCK_ENHANCED_PACKET:
 383             hfj_pcapng_option_code = hf_pcapng_option_code_enhanced_packet;
 384             vals = option_code_enhanced_packet_vals;
 385             break;
 386         case BLOCK_PACKET:
 387             hfj_pcapng_option_code = hf_pcapng_option_code_packet;
 388             vals = option_code_packet_vals;
 389             break;
 390         case BLOCK_NAME_RESOLUTION:
 391             hfj_pcapng_option_code = hf_pcapng_option_code_name_resolution;
 392             vals = option_code_name_resolution_vals;
 393             break;
 394         case BLOCK_INTERFACE_STATISTICS:
 395             hfj_pcapng_option_code = hf_pcapng_option_code_interface_statistics;
 396             vals = option_code_interface_statistics_vals;
 397             break;
 398         default:
 399             hfj_pcapng_option_code = hf_pcapng_option_code;
 400         }
 401
 402         if (vals)
 403             proto_item_append_text(option_item, ": %s", val_to_str_const(option_code, vals, "Unknown"));
 404
 405         proto_tree_add_item(option_tree, hfj_pcapng_option_code, tvb, offset, 2, encoding);
 406         offset += 2;
 407
 408         proto_tree_add_item(option_tree, hf_pcapng_option_length, tvb, offset, 2, encoding);
 409         offset += 2;
 410
 411         if (option_code == 0 && option_length == 0) {
 412             break;
 413         } else if (option_code == 1) {
 414             proto_tree_add_item(option_tree, hf_pcapng_option_data_comment, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 415             str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 416             offset += option_length;
 417         } else switch (block_type) {
 418         case BLOCK_SECTION_HEADER:
 419             switch (option_code) {
 420             case 0x0002:
 421                 proto_tree_add_item(option_tree, hf_pcapng_option_data_section_header_hardware, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 422                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 423                 offset += option_length;
 424                 break;
 425             case 0x0003:
 426                 proto_tree_add_item(option_tree, hf_pcapng_option_data_section_header_os, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 427                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 428                 offset += option_length;
 429                 break;
 430             case 0x0004:
 431                 proto_tree_add_item(option_tree, hf_pcapng_option_data_section_header_user_application, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 432                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 433                 offset += option_length;
 434                 break;
 435             default:
 436                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 437                 offset += option_length;
 438             }
 439             break;
 440         case BLOCK_INTERFACE_DESCRIPTION: {
 441             struct interface_description  *interface_description = (struct interface_description *) user_data;
 442
 443             switch (option_code) {
 444             case 0x0002:
 445                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_description_name, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 446                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 447                 offset += option_length;
 448
 449                 break;
 450             case 0x0003:
 451                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_description_description, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 452                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 453                 offset += option_length;
 454
 455                 break;
 456             case 0x0004:
 457                 if (option_length != 8) {
 458                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 459                     offset += option_length;
 460                     break;
 461                 }
 462                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
 463                 set_address_tvb(&addr, AT_IPv4, 4, tvb, offset);
 464                 offset += 4;
 465
 466                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv4_mask, tvb, offset, 4, ENC_BIG_ENDIAN);
 467                 set_address_tvb(&addr_mask, AT_IPv4, 4, tvb, offset);
 468                 offset += 4;
 469
 470                 str = wmem_strdup_printf(wmem_packet_scope(), "%s/%s",
 471                         address_to_display(wmem_packet_scope(),  &addr),
 472                         address_to_display(wmem_packet_scope(),  &addr_mask));
 473                 break;
 474             case 0x0005:
 475                 if (option_length != 17) {
 476                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 477                     offset += option_length;
 478                     break;
 479                 }
 480
 481                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv6, tvb, offset, 16, ENC_NA);
 482                 set_address_tvb(&addr, AT_IPv6, 16, tvb, offset);
 483                 offset += 16;
 484
 485                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv6_mask, tvb, offset, 1, ENC_NA);
 486                 offset += 1;
 487
 488                 str = wmem_strdup_printf(wmem_packet_scope(), "%s/%u",
 489                     address_to_display(wmem_packet_scope(),  &addr), (unsigned int) tvb_get_guint8(tvb, offset - 1));
 490
 491                 break;;
 492             case 0x0006:
 493                 if (option_length != 6) {
 494                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 495                     offset += option_length;
 496                     break;
 497                 }
 498
 499                 proto_tree_add_item(option_tree, hf_pcapng_option_data_mac_address, tvb, offset, 6, encoding);
 500                 str = tvb_get_ether_name(tvb, offset);
 501                 offset += 6;
 502
 503                 break;
 504             case 0x0007:
 505                 if (option_length != 8) {
 506                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 507                     offset += option_length;
 508                     break;
 509                 }
 510
 511                 proto_tree_add_item(option_tree, hf_pcapng_option_data_eui_address, tvb, offset, 8, encoding);
 512                 set_address_tvb(&addr, AT_EUI64, 8, tvb, offset);
 513                 offset += 8;
 514
 515                 str = address_to_display(wmem_packet_scope(),  &addr);
 516
 517                 break;
 518             case 0x0008:
 519                 if (option_length != 8) {
 520                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 521                     offset += option_length;
 522                     break;
 523                 }
 524
 525                 p_item = proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_speed, tvb, offset, 8, encoding);
 526                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 527                 if (value.u64 == 10000000) {
 528                     str = "10 Mbps";
 529                     proto_item_append_text(p_item, "%s", str);
 530                 } else if (value.u64 == 100000000) {
 531                     str = "100 Mbps";
 532                     proto_item_append_text(p_item, "%s", str);
 533                 } else if (value.u64 == 1000000000) {
 534                     str = "1 Gbps";
 535                     proto_item_append_text(p_item, "%s", str);
 536                 } else {
 537                     str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 538                 }
 539                 offset += 8;
 540
 541                 break;
 542             case 0x0009:
 543                 if (option_length != 1) {
 544                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 545                     offset += option_length;
 546                     break;
 547                 }
 548
 549                 proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_interface_timestamp_resolution, ett_pcapng_option, hfx_pcapng_option_data_interface_timestamp_resolution, ENC_NA);
 550                 value.u8 = tvb_get_guint8(tvb, offset);
 551                 offset += 1;
 552
 553                 if (interface_description) {
 554                     interface_description->timestamp_resolution = value.u8;
 555                 }
 556
 557                 str = wmem_strdup_printf(wmem_packet_scope(), "%s^-%u%s",
 558                         (value.u8 & 0x80) ? "2" : "10",
 559                         (guint32) (value.u8 & 0x7F),
 560                         (!(value.u8 & 0x80) && value.u8 == 6) ? " (microseconds)" : ((!(value.u8 & 0x80) && value.u8 == 9) ? " (nanoseconds)" : ""));
 561
 562                 break;
 563             case 0x000A:
 564                 if (option_length != 4) {
 565                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 566                     offset += option_length;
 567                     break;
 568                 }
 569
 570 /* TODO: Better timezone decoding */
 571                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_timezone, tvb, offset, 4, encoding);
 572                 value.u32 = tvb_get_guint32(tvb, offset, encoding);
 573                 offset += 4;
 574
 575                 str = wmem_strdup_printf(wmem_packet_scope(), "%u", value.u32);
 576
 577                 break;
 578             case 0x000B:
 579                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_filter, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 580                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 581                 offset += option_length;
 582
 583                 break;
 584             case 0x000C:
 585                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_os, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 586                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 587                 offset += option_length;
 588
 589                 break;
 590             case 0x000D:
 591                 if (option_length != 1) {
 592                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 593                     offset += option_length;
 594                     break;
 595                 }
 596
 597                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_fcs_length, tvb, offset, 1, ENC_NA);
 598                 value.u8 = tvb_get_guint8(tvb, offset);
 599                 str = wmem_strdup_printf(wmem_packet_scope(), "%u", (guint32) value.u8);
 600                 offset += 1;
 601
 602                 break;
 603             case 0x000E:
 604                 if (option_length != 8) {
 605                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 606                     offset += option_length;
 607                     break;
 608                 }
 609
 610                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_timestamp_offset, tvb, offset, 8, encoding);
 611                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 612                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 613                 offset += 8;
 614
 615                 if (interface_description) {
 616                     interface_description->timestamp_offset = value.u64;
 617                 }
 618
 619                 break;
 620             default:
 621                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 622                 offset += option_length;
 623             }
 624             }
 625             break;
 626         case BLOCK_PACKET:
 627             switch (option_code) {
 628             case 0x0002:
 629                 if (option_length != 4) {
 630                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 631                     offset += option_length;
 632                     break;
 633                 }
 634
 635                 if (encoding == ENC_LITTLE_ENDIAN) {
 636                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags, ett_pcapng_option, hfx_pcapng_option_data_packet_flags, encoding);
 637                     offset += 2;
 638
 639                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags_link_layer_errors, ett_pcapng_option, hfx_pcapng_option_data_packet_flags_link_layer_errors, encoding);
 640                     offset += 2;
 641                 } else {
 642                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags_link_layer_errors, ett_pcapng_option, hfx_pcapng_option_data_packet_flags_link_layer_errors, encoding);
 643                     offset += 2;
 644
 645                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags, ett_pcapng_option, hfx_pcapng_option_data_packet_flags, encoding);
 646                     offset += 2;
 647                 }
 648
 649                 break;
 650             case 0x0003:
 651                 proto_tree_add_item(option_tree, hf_pcapng_option_data_packet_hash_algorithm, tvb, offset, 1, ENC_NA);
 652                 offset += 1;
 653
 654                 proto_tree_add_item(option_tree, hf_pcapng_option_data_packet_hash_data, tvb, offset, option_length - 1, ENC_NA);
 655                 offset += option_length - 1;
 656
 657                 break;
 658             default:
 659                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 660                 offset += option_length;
 661             }
 662
 663             break;
 664         case BLOCK_NAME_RESOLUTION:
 665             switch (option_code) {
 666             case 0x0002:
 667                 proto_tree_add_item(option_tree, hf_pcapng_option_data_dns_name, tvb, offset, option_length, ENC_NA | ENC_UTF_8);
 668                 str = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, option_length, ENC_UTF_8);
 669                 offset += option_length;
 670
 671                 break;
 672             case 0x0003:
 673                 if (option_length != 4) {
 674                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 675                     offset += option_length;
 676                     break;
 677                 }
 678
 679                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
 680                 set_address_tvb(&addr, AT_IPv4, 4, tvb, offset);
 681                 offset += 4;
 682
 683                 str = address_to_display(wmem_packet_scope(), &addr);
 684
 685                 break;
 686             case 0x0004:
 687                 if (option_length != 16) {
 688                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 689                     offset += option_length;
 690                     break;
 691                 }
 692
 693                 proto_tree_add_item(option_tree, hf_pcapng_option_data_ipv6, tvb, offset, 16, ENC_NA);
 694                 set_address_tvb(&addr, AT_IPv6, 16, tvb, offset);
 695                 offset += 16;
 696
 697                 str = address_to_display(wmem_packet_scope(),  &addr);
 698
 699                 break;
 700             default:
 701                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 702                 offset += option_length;
 703             }
 704
 705             break;
 706         case BLOCK_INTERFACE_STATISTICS:
 707             switch (option_code) {
 708             case 0x0002:
 709                 if (option_length != 8) {
 710                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 711                     offset += option_length;
 712                     break;
 713                 }
 714
 715                 proto_tree_add_item(option_tree, hf_pcapng_option_data_start_time, tvb, offset, 8, encoding);
 716                 offset += 8;
 717
 718                 break;
 719             case 0x0003:
 720                 if (option_length != 8) {
 721                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 722                     offset += option_length;
 723                     break;
 724                 }
 725
 726                 proto_tree_add_item(option_tree, hf_pcapng_option_data_end_time, tvb, offset, 8, encoding);
 727                 offset += 8;
 728
 729                 break;
 730             case 0x0004:
 731                 if (option_length != 8) {
 732                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 733                     offset += option_length;
 734                     break;
 735                 }
 736
 737                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_received, tvb, offset, 8, encoding);
 738                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 739                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 740                 offset += 8;
 741
 742                 break;
 743             case 0x0005:
 744                 if (option_length != 8) {
 745                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 746                     offset += option_length;
 747                     break;
 748                 }
 749
 750                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_dropped, tvb, offset, 8, encoding);
 751                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 752                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 753                 offset += 8;
 754
 755                 break;
 756             case 0x0006:
 757                 if (option_length != 8) {
 758                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 759                     offset += option_length;
 760                     break;
 761                 }
 762
 763                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_accepted_by_filter, tvb, offset, 8, encoding);
 764                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 765                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 766                 offset += 8;
 767
 768                 break;
 769             case 0x0007:
 770                 if (option_length != 8) {
 771                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 772                     offset += option_length;
 773                     break;
 774                 }
 775
 776                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_dropped_by_os, tvb, offset, 8, encoding);
 777                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 778                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 779                 offset += 8;
 780
 781                 break;
 782             case 0x0008:
 783                 if (option_length != 8) {
 784                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 785                     offset += option_length;
 786                     break;
 787                 }
 788
 789                 proto_tree_add_item(option_tree, hf_pcapng_option_data_interface_delivered_to_user, tvb, offset, 8, encoding);
 790                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 791                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 792                 offset += 8;
 793
 794                 break;
 795             default:
 796                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 797                 offset += option_length;
 798             }
 799
 800             break;
 801         case BLOCK_ENHANCED_PACKET:
 802             switch (option_code) {
 803             case 0x0002:
 804                 if (option_length != 4) {
 805                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 806                     offset += option_length;
 807                     break;
 808                 }
 809
 810                 if (encoding == ENC_LITTLE_ENDIAN) {
 811                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags, ett_pcapng_option, hfx_pcapng_option_data_packet_flags, encoding);
 812                     offset += 2;
 813
 814                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags_link_layer_errors, ett_pcapng_option, hfx_pcapng_option_data_packet_flags_link_layer_errors, encoding);
 815                     offset += 2;
 816                 } else {
 817                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags_link_layer_errors, ett_pcapng_option, hfx_pcapng_option_data_packet_flags_link_layer_errors, encoding);
 818                     offset += 2;
 819
 820                     proto_tree_add_bitmask(option_tree, tvb, offset, hf_pcapng_option_data_packet_flags, ett_pcapng_option, hfx_pcapng_option_data_packet_flags, encoding);
 821                     offset += 2;
 822                 }
 823
 824                 break;
 825             case 0x0003:
 826                 proto_tree_add_item(option_tree, hf_pcapng_option_data_packet_hash_algorithm, tvb, offset, 1, ENC_NA);
 827                 offset += 1;
 828
 829                 proto_tree_add_item(option_tree, hf_pcapng_option_data_packet_hash_data, tvb, offset, option_length - 1, ENC_NA);
 830                 offset += option_length - 1;
 831
 832                 break;
 833             case 0x0004:
 834                 if (option_length != 8) {
 835                     proto_tree_add_expert(option_tree, pinfo, &ei_invalid_option_length, tvb, offset, option_length);
 836                     offset += option_length;
 837                     break;
 838                 }
 839
 840                 proto_tree_add_item(option_tree, hf_pcapng_option_data_packet_drop_count, tvb, offset, 8, encoding);
 841                 value.u64 = tvb_get_guint64(tvb, offset, encoding);
 842                 str = wmem_strdup_printf(wmem_packet_scope(), "%"G_GUINT64_FORMAT, value.u64);
 843                 offset += 8;
 844
 845                 break;
 846             default:
 847                 proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 848                 offset += option_length;
 849             }
 850
 851             break;
 852         default:
 853             proto_tree_add_item(option_tree, hf_pcapng_option_data, tvb, offset, option_length, ENC_NA);
 854             offset += option_length;
 855         }
 856
 857         if (option_length % 4) {
 858             proto_item_set_len(option_item, option_length + 2 * 2 + (4 - option_length % 4));
 859             option_length = 4 - option_length % 4;
 860             proto_tree_add_item(option_tree, hf_pcapng_option_padding, tvb, offset, option_length, ENC_NA);
 861             offset += option_length;
 862         }
 863
 864         if (str)
 865             proto_item_append_text(option_item, " = %s", str);
 866
 867     }
 868
 869     return offset;
 870 }
 871
 872 static void
 873 pcapng_add_timestamp(proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb,
 874         int offset, guint encoding, guint32 interface_id, struct info *info)
 875 {
 876     proto_tree_add_item(tree, hf_pcapng_timestamp_high, tvb, offset, 4, encoding);
 877     proto_tree_add_item(tree, hf_pcapng_timestamp_low, tvb, offset + 4, 4, encoding);
 878
 879     if (interface_id < wmem_array_get_count(info->interfaces)) {
 880         struct interface_description  *interface_description;
 881         nstime_t    timestamp;
 882         guint64     ts;
 883         guint32     base;
 884         guint32     i_resolution;
 885         guint64     resolution = 1;
 886         proto_item *ti;
 887
 888         interface_description = (struct interface_description *) wmem_array_index(info->interfaces, interface_id);
 889         ts = ((guint64)(tvb_get_guint32(tvb, offset, encoding))) << 32 |
 890                         tvb_get_guint32(tvb, offset + 4, encoding);
 891
 892         ts += interface_description->timestamp_offset;
 893         if (interface_description->timestamp_resolution == 0)
 894             interface_description->timestamp_resolution = 6;
 895
 896         if (interface_description->timestamp_resolution & 0x80) {
 897             base = 2;
 898         } else {
 899             base = 10;
 900         }
 901
 902         for (i_resolution = 0; i_resolution < (guint32)(interface_description->timestamp_resolution & 0x7F); i_resolution += 1)
 903             resolution *= base;
 904         timestamp.secs  = (time_t)(ts / resolution);
 905         timestamp.nsecs = (int)(ts - (ts / resolution) * resolution);
 906
 907         ti = proto_tree_add_time(tree, hf_pcapng_timestamp, tvb, offset, 8, &timestamp);
 908         PROTO_ITEM_SET_GENERATED(ti);
 909
 910         pinfo->abs_ts = timestamp;
 911     }
 912 }
 913
 914 static gint dissect_block(proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb,
 915         guint encoding, struct info *info)
 916 {
 917     proto_tree      *block_tree;
 918     proto_item      *block_item;
 919     proto_tree      *block_data_tree;
 920     proto_item      *block_data_item;
 921     proto_item      *byte_order_magic_item;
 922     proto_item      *packet_data_item;
 923     gint             offset = 0;
 924     guint32          length;
 925     guint32          captured_length;
 926     guint32          reported_length;
 927     guint32          block_type;
 928     guint32          block_data_length;
 929     guint32          interface_id;
 930     tvbuff_t        *next_tvb;
 931
 932     block_type = tvb_get_guint32(tvb, offset + 0, encoding);
 933     length     = tvb_get_guint32(tvb, offset + 4, encoding);
 934
 935     block_item = proto_tree_add_item(tree, hf_pcapng_block, tvb, offset, length, ENC_NA);
 936     block_tree = proto_item_add_subtree(block_item, ett_pcapng_section_header_block);
 937     proto_item_append_text(block_item, ": %s", val_to_str_const(block_type, block_type_vals, "Unknown"));
 938
 939     proto_tree_add_bitmask_with_flags(block_tree, tvb, offset, hf_pcapng_block_type, ett_pcapng_option, hfx_pcapng_block_type, encoding, BMT_NO_APPEND);
 940     offset += 4;
 941
 942     proto_tree_add_item(block_tree, hf_pcapng_block_length, tvb, offset, 4, encoding);
 943     block_data_length = tvb_get_guint32(tvb, offset, encoding) - 3 * 4;
 944     offset += 4;
 945
 946     block_data_item = proto_tree_add_item(block_tree, hf_pcapng_block_data, tvb, offset, block_data_length, ENC_NA);
 947     block_data_tree = proto_item_add_subtree(block_data_item, ett_pcapng_block_data);
 948
 949     switch (block_type) {
 950     case BLOCK_SECTION_HEADER: /* Section Header Block */
 951         proto_item_append_text(block_item, " %u", info->file_number);
 952         info->file_number += 1;
 953         info->interface_number = 0;
 954         info->frame_number = 1;
 955
 956         byte_order_magic_item = proto_tree_add_item(block_data_tree, hf_pcapng_section_header_byte_order_magic, tvb, offset, 4, ENC_NA);
 957         if (encoding == ENC_BIG_ENDIAN)
 958             proto_item_append_text(byte_order_magic_item, " (Big-endian)");
 959         else
 960             proto_item_append_text(byte_order_magic_item, " (Little-endian)");
 961         offset += 4;
 962
 963         proto_tree_add_item(block_data_tree, hf_pcapng_section_header_major_version, tvb, offset, 2, encoding);
 964         offset += 2;
 965
 966         proto_tree_add_item(block_data_tree, hf_pcapng_section_header_minor_version, tvb, offset, 2, encoding);
 967         offset += 2;
 968
 969         proto_tree_add_item(block_data_tree, hf_pcapng_section_header_section_length, tvb, offset, 8, encoding);
 970         offset += 8;
 971
 972         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - 4 - 2 - 2 - 8);
 973         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, NULL);
 974
 975         break;
 976     case BLOCK_INTERFACE_DESCRIPTION: {
 977         struct interface_description  interface_description;
 978
 979         memset(&interface_description, 0, sizeof(struct interface_description));
 980
 981         proto_item_append_text(block_item, " %u", info->interface_number);
 982         info->interface_number += 1;
 983
 984         proto_tree_add_item(block_data_tree, hf_pcapng_interface_description_link_type, tvb, offset, 2, encoding);
 985         interface_description.link_type = tvb_get_guint16(tvb, offset, encoding);
 986         offset += 2;
 987
 988         proto_tree_add_item(block_data_tree, hf_pcapng_interface_description_reserved, tvb, offset, 2, encoding);
 989         offset += 2;
 990
 991         proto_tree_add_item(block_data_tree, hf_pcapng_interface_description_snap_length, tvb, offset, 4, encoding);
 992         offset += 4;
 993
 994         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - 2 - 2 - 4);
 995         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, &interface_description);
 996
 997         wmem_array_append_one(info->interfaces, interface_description);
 998         }
 999         break;
1000     case BLOCK_PACKET:
1001         proto_item_append_text(block_item, " %u", info->frame_number);
1002
1003         proto_tree_add_item(block_data_tree, hf_pcapng_packet_block_interface_id, tvb, offset, 2, encoding);
1004         interface_id = tvb_get_guint16(tvb, offset, encoding);
1005         offset += 2;
1006
1007         proto_tree_add_item(block_data_tree, hf_pcapng_packet_block_drops_count, tvb, offset, 2, encoding);
1008         offset += 2;
1009
1010         pcapng_add_timestamp(block_data_tree, pinfo, tvb, offset, encoding, interface_id, info);
1011         offset += 8;
1012
1013         proto_tree_add_item_ret_uint(block_data_tree, hf_pcapng_captured_length, tvb, offset, 4, encoding, &captured_length);
1014         offset += 4;
1015
1016         proto_tree_add_item_ret_uint(block_data_tree, hf_pcapng_packet_length, tvb, offset, 4, encoding, &reported_length);
1017         offset += 4;
1018
1019         packet_data_item = proto_tree_add_item(block_data_tree, hf_pcapng_packet_data, tvb, offset, captured_length, encoding);
1020
1021         if (pref_dissect_next_layer && interface_id < wmem_array_get_count(info->interfaces)) {
1022             struct interface_description  *interface_description;
1023             proto_tree *packet_data_tree = proto_item_add_subtree(packet_data_item, ett_pcapng_packet_data);
1024
1025             pinfo->num = info->frame_number;
1026
1027             interface_description = (struct interface_description *) wmem_array_index(info->interfaces, interface_id);
1028             TRY {
1029                 call_dissector_with_data(pcap_pktdata_handle, tvb_new_subset(tvb, offset, captured_length, reported_length),
1030                                          pinfo, packet_data_tree, &interface_description->link_type);
1031             }
1032             CATCH_BOUNDS_ERRORS {
1033                 show_exception(tvb, pinfo, packet_data_tree, EXCEPT_CODE, GET_MESSAGE);
1034             }
1035             ENDTRY;
1036         }
1037         info->frame_number += 1;
1038         offset += captured_length;
1039
1040         if (captured_length % 4) {
1041             proto_tree_add_item(block_data_tree, hf_pcapng_packet_padding, tvb, offset, captured_length % 4?(4 - captured_length % 4):0, ENC_NA);
1042             offset += captured_length % 4?(4 - captured_length % 4):0;
1043         }
1044
1045         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - 2 - 2 - 8 - 4 - 4 - captured_length - (captured_length % 4?(4 - captured_length % 4):0));
1046         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, NULL);
1047
1048         break;
1049     case BLOCK_SIMPLE_PACKET:
1050         proto_item_append_text(block_item, " %u", info->frame_number);
1051
1052         proto_tree_add_item_ret_uint(block_data_tree, hf_pcapng_packet_length, tvb, offset, 4, encoding, &captured_length);
1053         offset += 4;
1054
1055         interface_id = 0;
1056
1057         packet_data_item = proto_tree_add_item(block_data_tree, hf_pcapng_packet_data, tvb, offset, captured_length, encoding);
1058
1059         if (pref_dissect_next_layer && interface_id < wmem_array_get_count(info->interfaces)) {
1060             struct interface_description  *interface_description;
1061             proto_tree *packet_data_tree = proto_item_add_subtree(packet_data_item, ett_pcapng_packet_data);
1062
1063             pinfo->num = info->frame_number;
1064
1065             interface_description = (struct interface_description *) wmem_array_index(info->interfaces, interface_id);
1066             TRY {
1067                 call_dissector_with_data(pcap_pktdata_handle, tvb_new_subset_length(tvb, offset, captured_length),
1068                                          pinfo, packet_data_tree, &interface_description->link_type);
1069             }
1070             CATCH_BOUNDS_ERRORS {
1071                 show_exception(tvb, pinfo, packet_data_tree, EXCEPT_CODE, GET_MESSAGE);
1072             }
1073             ENDTRY;
1074         }
1075         info->frame_number += 1;
1076         offset += captured_length;
1077
1078         if (captured_length % 4) {
1079             proto_tree_add_item(block_data_tree, hf_pcapng_packet_padding, tvb, offset, captured_length % 4?(4 - captured_length % 4):0, ENC_NA);
1080             offset += captured_length % 4?(4 - captured_length % 4):0;
1081         }
1082
1083         break;
1084     case BLOCK_NAME_RESOLUTION:
1085         {
1086         proto_tree  *records_tree;
1087         proto_item  *records_item;
1088         proto_tree  *record_tree;
1089         proto_item  *record_item;
1090         gint         offset_record_start;
1091         gint         offset_string_start;
1092         guint16      record_code;
1093         gint         record_length;
1094         gint         string_length;
1095         gchar       *str = NULL;
1096         address      addr;
1097
1098         records_item = proto_tree_add_item(block_data_tree, hf_pcapng_records, tvb, offset, block_data_length, ENC_NA);
1099         records_tree = proto_item_add_subtree(records_item, ett_pcapng_records);
1100
1101         offset_record_start = offset;
1102         while (block_data_length - (offset_record_start - offset) > 0) {
1103             record_code   = tvb_get_guint16(tvb, offset, encoding);
1104             record_length = tvb_get_guint16(tvb, offset + 2, encoding);
1105
1106             record_item = proto_tree_add_item(records_tree, hf_pcapng_record, tvb, offset, record_length + 2 * 2, ENC_NA);
1107             record_tree = proto_item_add_subtree(record_item, ett_pcapng_record);
1108
1109             proto_item_append_text(record_item, ": %s", val_to_str_const(record_code, record_code_vals, "Unknown"));
1110
1111             proto_tree_add_item(record_tree, hf_pcapng_record_code, tvb, offset, 2, encoding);
1112             offset += 2;
1113
1114             proto_tree_add_item(record_tree, hf_pcapng_record_length, tvb, offset, 2, encoding);
1115             offset += 2;
1116
1117             if (record_code == 0 && record_length == 0) {
1118                 break;
1119             } else switch (record_code) {
1120             case 0x0001: /* IPv4 Record */
1121                 if (record_length < 5) {
1122                     proto_tree_add_expert(record_tree, pinfo, &ei_invalid_record_length, tvb, offset, record_length);
1123                     offset += record_length;
1124                     break;
1125                 }
1126
1127                 proto_tree_add_item(record_tree, hf_pcapng_record_ipv4, tvb, offset, 4, ENC_BIG_ENDIAN);
1128                 set_address_tvb(&addr, AT_IPv4, 4, tvb, offset);
1129                 offset += 4;
1130
1131                 offset_string_start = offset;
1132                 while (offset - offset_string_start < record_length - 4) {
1133                     string_length = tvb_strnlen(tvb, offset, (offset - offset_string_start) + record_length - 4);
1134                     if (string_length >= 0) {
1135                         proto_tree_add_item(record_tree, hf_pcapng_record_name, tvb, offset, string_length + 1, encoding);
1136                         offset += string_length + 1;
1137                     } else {
1138                         proto_tree_add_item(record_tree, hf_pcapng_record_data, tvb, offset, (record_length - 4) - (offset - offset_string_start), encoding);
1139                         offset += (record_length - 4) - (offset - offset_string_start);
1140                     }
1141                 }
1142
1143                 str = address_to_display(wmem_packet_scope(), &addr);
1144                 break;
1145             case 0x0002: /* IPv6 Record */
1146                 if (record_length < 17) {
1147                     proto_tree_add_expert(record_tree, pinfo, &ei_invalid_option_length, tvb, offset, record_length);
1148                     offset += record_length;
1149                     break;
1150                 }
1151
1152                 proto_tree_add_item(record_tree, hf_pcapng_record_ipv6, tvb, offset, 16, ENC_NA);
1153                 set_address_tvb(&addr, AT_IPv6, 16, tvb, offset);
1154                 offset += 16;
1155
1156                 offset_string_start = offset;
1157                 while (offset - offset_string_start < record_length - 16) {
1158                     string_length = tvb_strnlen(tvb, offset, (offset - offset_string_start) + record_length - 16);
1159                     if (string_length >= 0) {
1160                         proto_tree_add_item(record_tree, hf_pcapng_record_name, tvb, offset, string_length + 1, encoding);
1161                         offset += string_length + 1;
1162                     } else {
1163                         proto_tree_add_item(record_tree, hf_pcapng_record_data, tvb, offset, (record_length - 16) - (offset - offset_string_start), encoding);
1164                         offset += (record_length - 16) - (offset - offset_string_start);
1165                     }
1166                 }
1167
1168                 str = address_to_display(wmem_packet_scope(), &addr);
1169
1170                 break;
1171             default:
1172                 proto_tree_add_item(record_tree, hf_pcapng_record_data, tvb, offset, record_length, ENC_NA);
1173                 offset += record_length;
1174             }
1175
1176             if (record_code != 0 && record_length % 4) {
1177                 proto_item_set_len(record_item, record_length + 2 * 2 + (4 - record_length % 4));
1178                 record_length = 4 - record_length % 4;
1179                 proto_tree_add_item(record_tree, hf_pcapng_record_padding, tvb, offset, record_length, ENC_NA);
1180                 offset += record_length;
1181             }
1182
1183             if (str)
1184                 proto_item_append_text(record_item, " = %s", str);
1185         }
1186
1187         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - (offset - offset_record_start));
1188         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, NULL);
1189         }
1190
1191         break;
1192     case BLOCK_INTERFACE_STATISTICS:
1193         proto_tree_add_item(block_data_tree, hf_pcapng_interface_id, tvb, offset, 4, encoding);
1194         interface_id = tvb_get_guint32(tvb, offset, encoding);
1195         offset += 4;
1196
1197         pcapng_add_timestamp(block_data_tree, pinfo, tvb, offset, encoding, interface_id, info);
1198         offset += 8;
1199
1200         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - 4 - 8);
1201         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, NULL);
1202
1203         break;
1204     case BLOCK_ENHANCED_PACKET:
1205         proto_item_append_text(block_item, " %u", info->frame_number);
1206
1207         proto_tree_add_item(block_data_tree, hf_pcapng_interface_id, tvb, offset, 4, encoding);
1208         interface_id = tvb_get_guint32(tvb, offset, encoding);
1209         offset += 4;
1210
1211         pcapng_add_timestamp(block_data_tree, pinfo, tvb, offset, encoding, interface_id, info);
1212         offset += 8;
1213
1214         proto_tree_add_item_ret_uint(block_data_tree, hf_pcapng_captured_length, tvb, offset, 4, encoding, &captured_length);
1215         offset += 4;
1216
1217         proto_tree_add_item_ret_uint(block_data_tree, hf_pcapng_packet_length, tvb, offset, 4, encoding, &reported_length);
1218         offset += 4;
1219
1220         packet_data_item = proto_tree_add_item(block_data_tree, hf_pcapng_packet_data, tvb, offset, captured_length, encoding);
1221
1222         if (pref_dissect_next_layer && interface_id < wmem_array_get_count(info->interfaces)) {
1223             struct interface_description  *interface_description;
1224             proto_tree *packet_data_tree = proto_item_add_subtree(packet_data_item, ett_pcapng_packet_data);
1225
1226             pinfo->num = info->frame_number;
1227
1228             interface_description = (struct interface_description *) wmem_array_index(info->interfaces, interface_id);
1229             TRY {
1230                 call_dissector_with_data(pcap_pktdata_handle, tvb_new_subset(tvb, offset, captured_length, reported_length),
1231                                          pinfo, packet_data_tree, &interface_description->link_type);
1232             }
1233             CATCH_BOUNDS_ERRORS {
1234                 show_exception(tvb, pinfo, packet_data_tree, EXCEPT_CODE, GET_MESSAGE);
1235             }
1236             ENDTRY;
1237         }
1238         info->frame_number += 1;
1239         offset += captured_length;
1240
1241         if (captured_length % 4) {
1242             proto_tree_add_item(block_data_tree, hf_pcapng_packet_padding, tvb, offset, captured_length % 4?(4 - captured_length % 4):0, ENC_NA);
1243             offset += captured_length % 4?(4 - captured_length % 4):0;
1244         }
1245
1246         next_tvb = tvb_new_subset_length(tvb, offset, block_data_length - 4 - 8 - 4 - 4 - captured_length - (captured_length % 4?(4 - captured_length % 4):0));
1247         offset += dissect_options(block_data_tree, pinfo, block_type, next_tvb, encoding, NULL);
1248
1249         break;
1250     case BLOCK_IRIG_TIMESTAMP:
1251     case BLOCK_ARINC_429:
1252     default:
1253         offset += block_data_length;
1254     }
1255
1256     proto_tree_add_item(block_tree, hf_pcapng_block_length, tvb, offset, 4, encoding);
1257     offset += 4;
1258
1259     return offset;
1260 }
1261
1262 #define BLOCK_TYPE_SIZE        4
1263 #define BYTE_ORDER_MAGIC_SIZE  4
1264
1265 static int
1266 dissect_pcapng(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
1267 {
1268     static const guint8 pcapng_premagic[BLOCK_TYPE_SIZE] = {
1269         0x0A, 0x0D, 0x0D, 0x0A
1270     };
1271     static const guint8 pcapng_big_endian_magic[BYTE_ORDER_MAGIC_SIZE] = {
1272         0x1A, 0x2B, 0x3C, 0x4D
1273     };
1274     static const guint8 pcapng_little_endian_magic[BYTE_ORDER_MAGIC_SIZE] = {
1275         0x4D, 0x3C, 0x2B, 0x1A
1276     };
1277     gint             offset = 0;
1278     guint32          length;
1279     guint32          encoding;
1280     proto_tree      *main_tree;
1281     proto_item      *main_item;
1282     struct info      info;
1283
1284     if (tvb_memeql(tvb, 0, pcapng_premagic, BLOCK_TYPE_SIZE) != 0)
1285         return 0;
1286
1287     if (tvb_memeql(tvb, 8, pcapng_big_endian_magic, BYTE_ORDER_MAGIC_SIZE) == 0) {
1288         encoding = ENC_BIG_ENDIAN;
1289     } else if (tvb_memeql(tvb, 8, pcapng_little_endian_magic, BYTE_ORDER_MAGIC_SIZE) == 0) {
1290         encoding = ENC_LITTLE_ENDIAN;
1291     } else {
1292         return 0;
1293     }
1294
1295     info.file_number = 1;
1296     info.interface_number = 0;
1297     info.frame_number = 1;
1298     info.interfaces = wmem_array_new(wmem_packet_scope(), sizeof(struct interface_description));
1299
1300     main_item = proto_tree_add_item(tree, proto_pcapng, tvb, offset, -1, ENC_NA);
1301     main_tree = proto_item_add_subtree(main_item, ett_pcapng);
1302
1303     while (tvb_captured_length_remaining(tvb, offset)) {
1304         tvbuff_t  *next_tvb;
1305
1306         length = tvb_get_guint32(tvb, offset + 4, encoding);
1307         next_tvb = tvb_new_subset_length(tvb, offset, length);
1308
1309         offset += dissect_block(main_tree, pinfo, next_tvb, encoding, &info);
1310     }
1311
1312     return offset;
1313 }
1314
1315 static gboolean
1316 dissect_pcapng_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
1317 {
1318     return dissect_pcapng(tvb, pinfo, tree, NULL) > 0;
1319 }
1320
1321 void
1322 proto_register_pcapng(void)
1323 {
1324     module_t         *module;
1325     expert_module_t  *expert_module;
1326
1327     static hf_register_info hf[] = {
1328         { &hf_pcapng_block,
1329             { "Block",                                     "pcapng.block",
1330             FT_NONE, BASE_NONE, NULL, 0x00,
1331             NULL, HFILL }
1332         },
1333         { &hf_pcapng_block_type,
1334             { "Block Type",                                "pcapng.block.type",
1335             FT_UINT32, BASE_HEX, VALS(block_type_vals), 0x00,
1336             NULL, HFILL }
1337         },
1338         { &hf_pcapng_block_type_vendor,
1339             { "Block Type Vendor",                         "pcapng.block.type.vendor",
1340             FT_BOOLEAN, 32, NULL, 0x80000000,
1341             NULL, HFILL }
1342         },
1343         { &hf_pcapng_block_type_value,
1344             { "Block Type Value",                          "pcapng.block.type.value",
1345             FT_UINT32, BASE_HEX, VALS(block_type_vals), 0x7FFFFFFF,
1346             NULL, HFILL }
1347         },
1348         { &hf_pcapng_block_length,
1349             { "Block Length",                              "pcapng.block.length",
1350             FT_UINT32, BASE_DEC, NULL, 0x00,
1351             NULL, HFILL }
1352         },
1353         { &hf_pcapng_block_data,
1354             { "Block Data",                                "pcapng.block.data",
1355             FT_NONE, BASE_NONE, NULL, 0x00,
1356             NULL, HFILL }
1357         },
1358         { &hf_pcapng_options,
1359             { "Options",                                   "pcapng.options",
1360             FT_NONE, BASE_NONE, NULL, 0x00,
1361             NULL, HFILL }
1362         },
1363         { &hf_pcapng_option,
1364             { "Option",                                    "pcapng.options.option",
1365             FT_NONE, BASE_NONE, NULL, 0x00,
1366             NULL, HFILL }
1367         },
1368         { &hf_pcapng_option_code_interface_description,
1369             { "Code",                                      "pcapng.options.option.code",
1370             FT_UINT16, BASE_DEC, VALS(option_code_interface_description_vals), 0x00,
1371             NULL, HFILL }
1372         },
1373         { &hf_pcapng_option_code_enhanced_packet,
1374             { "Code",                                      "pcapng.options.option.code",
1375             FT_UINT16, BASE_DEC, VALS(option_code_enhanced_packet_vals), 0x00,
1376             NULL, HFILL }
1377         },
1378         { &hf_pcapng_option_code_packet,
1379             { "Code",                                      "pcapng.options.option.code",
1380             FT_UINT16, BASE_DEC, VALS(option_code_packet_vals), 0x00,
1381             NULL, HFILL }
1382         },
1383         { &hf_pcapng_option_code_name_resolution,
1384             { "Code",                                      "pcapng.options.option.code",
1385             FT_UINT16, BASE_DEC, VALS(option_code_name_resolution_vals), 0x00,
1386             NULL, HFILL }
1387         },
1388         { &hf_pcapng_option_code_interface_statistics,
1389             { "Code",                                      "pcapng.options.option.code",
1390             FT_UINT16, BASE_DEC, VALS(option_code_interface_statistics_vals), 0x00,
1391             NULL, HFILL }
1392         },
1393         { &hf_pcapng_option_code,
1394             { "Code",                                      "pcapng.options.option.code",
1395             FT_UINT16, BASE_DEC, NULL, 0x00,
1396             NULL, HFILL }
1397         },
1398         { &hf_pcapng_option_length,
1399             { "Length",                                    "pcapng.options.option.length",
1400             FT_INT64, BASE_DEC, NULL, 0x00,
1401             NULL, HFILL }
1402         },
1403         { &hf_pcapng_option_data,
1404             { "Option Data",                               "pcapng.options.option.data",
1405             FT_NONE, BASE_NONE, NULL, 0x00,
1406             NULL, HFILL }
1407         },
1408         { &hf_pcapng_option_padding,
1409             { "Option Padding",                            "pcapng.options.option.padding",
1410             FT_NONE, BASE_NONE, NULL, 0x00,
1411             NULL, HFILL }
1412         },
1413         { &hf_pcapng_option_data_comment,
1414             { "Comment",                                   "pcapng.options.option.data.comment",
1415             FT_STRING, STR_ASCII, NULL, 0x00,
1416             NULL, HFILL }
1417         },
1418         { &hf_pcapng_section_header_byte_order_magic,
1419             { "Byte Order Magic",                          "pcapng.section_header.byte_order_magic",
1420             FT_BYTES, BASE_NONE, NULL, 0x00,
1421             NULL, HFILL }
1422         },
1423         { &hf_pcapng_section_header_major_version,
1424             { "Major Version",                             "pcapng.section_header.version.major",
1425             FT_UINT16, BASE_DEC, NULL, 0x00,
1426             NULL, HFILL }
1427         },
1428         { &hf_pcapng_section_header_minor_version,
1429             { "Minor Version",                             "pcapng.section_header.version.minor",
1430             FT_UINT16, BASE_DEC, NULL, 0x00,
1431             NULL, HFILL }
1432         },
1433         { &hf_pcapng_section_header_section_length,
1434             { "Section Length",                            "pcapng.section_header.section_length",
1435             FT_INT64, BASE_DEC, NULL, 0x00,
1436             NULL, HFILL }
1437         },
1438         { &hf_pcapng_option_code_section_header,
1439             { "Code",                                      "pcapng.options.option.code",
1440             FT_UINT16, BASE_DEC, VALS(option_code_section_header_vals), 0x00,
1441             NULL, HFILL }
1442         },
1443         { &hf_pcapng_option_data_section_header_hardware,
1444             { "Hardware",                                  "pcapng.options.option.data.hardware",
1445             FT_STRING, STR_ASCII, NULL, 0x00,
1446             NULL, HFILL }
1447         },
1448         { &hf_pcapng_option_data_section_header_os,
1449             { "OS",                                        "pcapng.options.option.data.os",
1450             FT_STRING, STR_ASCII, NULL, 0x00,
1451             NULL, HFILL }
1452         },
1453         { &hf_pcapng_option_data_section_header_user_application,
1454             { "User Application",                          "pcapng.options.option.data.user_application",
1455             FT_STRING, STR_ASCII, NULL, 0x00,
1456             NULL, HFILL }
1457         },
1458         { &hf_pcapng_option_data_interface_description_name,
1459             { "Name",                                      "pcapng.options.option.data.interface.name",
1460             FT_STRING, STR_ASCII, NULL, 0x00,
1461             NULL, HFILL }
1462         },
1463         { &hf_pcapng_option_data_interface_description_description,
1464             { "Description",                               "pcapng.options.option.data.interface.description",
1465             FT_STRING, STR_ASCII, NULL, 0x00,
1466             NULL, HFILL }
1467         },
1468         { &hf_pcapng_option_data_ipv4,
1469             { "IPv4",                                      "pcapng.options.option.data.ipv4",
1470             FT_IPv4, BASE_NONE, NULL, 0x00,
1471             NULL, HFILL }
1472         },
1473         { &hf_pcapng_option_data_ipv4_mask,
1474             { "IPv4 Mask",                                 "pcapng.options.option.data.ipv4_mask",
1475             FT_IPv4, BASE_NONE, NULL, 0x00,
1476             NULL, HFILL }
1477         },
1478         { &hf_pcapng_option_data_ipv6,
1479             { "IPv6",                                      "pcapng.options.option.data.ipv6",
1480             FT_IPv6, BASE_NONE, NULL, 0x00,
1481             NULL, HFILL }
1482         },
1483         { &hf_pcapng_option_data_ipv6_mask,
1484             { "IPv6 Mask",                                 "pcapng.options.option.data.ipv6_mask",
1485             FT_UINT8, BASE_DEC, NULL, 0x00,
1486             NULL, HFILL }
1487         },
1488         { &hf_pcapng_option_data_mac_address,
1489             { "MAC Address",                               "pcapng.options.option.data.mac",
1490             FT_ETHER, BASE_NONE, NULL, 0x00,
1491             NULL, HFILL }
1492         },
1493         { &hf_pcapng_option_data_eui_address,
1494             { "EUI Address",                               "pcapng.options.option.data.eui",
1495             FT_EUI64, BASE_NONE, NULL, 0x00,
1496             NULL, HFILL }
1497         },
1498         { &hf_pcapng_option_data_interface_speed,
1499             { "Speed",                                     "pcapng.options.option.data.interface.speed",
1500             FT_UINT64, BASE_DEC, NULL, 0x00,
1501             NULL, HFILL }
1502         },
1503         { &hf_pcapng_option_data_interface_timestamp_resolution,
1504             { "Timestamp Resolution",                      "pcapng.options.option.data.interface.timestamp_resolution",
1505             FT_UINT8, BASE_HEX, NULL, 0x00,
1506             NULL, HFILL }
1507         },
1508         { &hf_pcapng_option_data_interface_timestamp_resolution_base,
1509             { "Base",                                      "pcapng.options.option.data.interface.timestamp_resolution.base",
1510             FT_UINT8, BASE_HEX, VALS(timestamp_resolution_base_vals), 0x80,
1511             NULL, HFILL }
1512         },
1513         { &hf_pcapng_option_data_interface_timestamp_resolution_value,
1514             { "Value",                                     "pcapng.options.option.data.interface.timestamp_resolution.value",
1515             FT_UINT8, BASE_DEC, NULL, 0x7F,
1516             NULL, HFILL }
1517         },
1518         { &hf_pcapng_option_data_interface_timezone,
1519             { "Timezone",                                  "pcapng.options.option.data.interface.timezone",
1520             FT_UINT32, BASE_DEC, NULL, 0x00,
1521             NULL, HFILL }
1522         },
1523         { &hf_pcapng_option_data_interface_filter,
1524             { "Filter",                                    "pcapng.options.option.data.interface.filter",
1525             FT_STRING, STR_ASCII, NULL, 0x00,
1526             NULL, HFILL }
1527         },
1528         { &hf_pcapng_option_data_interface_os,
1529             { "OS",                                        "pcapng.options.option.data.interface.os",
1530             FT_STRING, STR_ASCII, NULL, 0x00,
1531             NULL, HFILL }
1532         },
1533         { &hf_pcapng_option_data_interface_fcs_length,
1534             { "FCS Length",                                "pcapng.options.option.data.interface.fcs_length",
1535             FT_UINT8, BASE_DEC, NULL, 0x00,
1536             NULL, HFILL }
1537         },
1538         { &hf_pcapng_option_data_interface_timestamp_offset,
1539             { "Timestamp Offset",                          "pcapng.options.option.data.interface.timestamp_offset",
1540             FT_UINT64, BASE_DEC, NULL, 0x00,
1541             NULL, HFILL }
1542         },
1543         { &hf_pcapng_option_data_packet_drop_count,
1544             { "Drop Count",                                "pcapng.options.option.data.packet.drop_count",
1545             FT_UINT64, BASE_DEC, NULL, 0x00,
1546             NULL, HFILL }
1547         },
1548         { &hf_pcapng_option_data_packet_hash_algorithm,
1549             { "Hash Algorithm",                            "pcapng.options.option.data.packet.hash.algorithm",
1550             FT_UINT8, BASE_HEX, VALS(packet_hash_algorithm_vals), 0x00,
1551             NULL, HFILL }
1552         },
1553         { &hf_pcapng_option_data_packet_hash_data,
1554             { "Hash Data",                                 "pcapng.options.option.data.packet.hash.data",
1555             FT_BYTES, BASE_NONE, NULL, 0x00,
1556             NULL, HFILL }
1557         },
1558         { &hf_pcapng_option_data_packet_flags_link_layer_errors,
1559             { "Link Layer Errors",                         "pcapng.options.option.data.packet.flags.link_layer_errors",
1560             FT_UINT16, BASE_HEX, NULL, 0x00,
1561             NULL, HFILL }
1562         },
1563
1564         { &hf_pcapng_option_data_packet_flags_link_layer_errors_symbol,
1565             { "Symbol Error",                              "pcapng.options.option.data.packet.flags.link_layer_errors.symbol",
1566             FT_BOOLEAN, 16, NULL, 0x8000,
1567             NULL, HFILL }
1568         },
1569         { &hf_pcapng_option_data_packet_flags_link_layer_errors_preamble,
1570             { "Preamble Error",                            "pcapng.options.option.data.packet.flags.link_layer_errors.preamble",
1571             FT_BOOLEAN, 16, NULL, 0x8000,
1572             NULL, HFILL }
1573         },
1574         { &hf_pcapng_option_data_packet_flags_link_layer_errors_start_frame_delimiter,
1575             { "Preamble Error",                            "pcapng.options.option.data.packet.flags.link_layer_errors.preamble",
1576             FT_BOOLEAN, 16, NULL, 0x8000,
1577             NULL, HFILL }
1578         },
1579         { &hf_pcapng_option_data_packet_flags_link_layer_errors_unaligned_frame,
1580             { "Preamble Error",                            "pcapng.options.option.data.packet.flags.link_layer_errors.preamble",
1581             FT_BOOLEAN, 16, NULL, 0x4000,
1582             NULL, HFILL }
1583         },
1584         { &hf_pcapng_option_data_packet_flags_link_layer_errors_wrong_inter_frame_gap,
1585             { "Wrong Inter Frame Gap",                     "pcapng.options.option.data.packet.flags.link_layer_errors.wrong_inter_frame_gap",
1586             FT_BOOLEAN, 16, NULL, 0x2000,
1587             NULL, HFILL }
1588         },
1589         { &hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_short,
1590             { "Packet Too Short",                          "pcapng.options.option.data.packet.flags.link_layer_errors.packet_too_short",
1591             FT_BOOLEAN, 16, NULL, 0x1000,
1592             NULL, HFILL }
1593         },
1594         { &hf_pcapng_option_data_packet_flags_link_layer_errors_packet_too_long,
1595             { "Packet Too Long",                           "pcapng.options.option.data.packet.flags.link_layer_errors.packet_too_long",
1596             FT_BOOLEAN, 16, NULL, 0x0800,
1597             NULL, HFILL }
1598         },
1599         { &hf_pcapng_option_data_packet_flags_link_layer_errors_crc_error,
1600             { "CRC Error",                                 "pcapng.options.option.data.packet.flags.link_layer_errors.crc",
1601             FT_BOOLEAN, 16, NULL, 0x0400,
1602             NULL, HFILL }
1603         },
1604         { &hf_pcapng_option_data_packet_flags_link_layer_errors_reserved,
1605             { "Reserved",                                  "pcapng.options.option.data.packet.flags.link_layer_errors.reserved",
1606             FT_UINT16, BASE_HEX, NULL, 0x03FF,
1607             NULL, HFILL }
1608         },
1609         { &hf_pcapng_option_data_packet_flags,
1610             { "Flags",                                     "pcapng.options.option.data.packet.flags",
1611             FT_UINT16, BASE_HEX, NULL, 0x00,
1612             NULL, HFILL }
1613         },
1614         { &hf_pcapng_option_data_packet_flags_reserved,
1615             { "Reserved",                                  "pcapng.options.option.data.packet.flags.reserved",
1616             FT_UINT16, BASE_HEX, NULL, 0xFE00,
1617             NULL, HFILL }
1618         },
1619         { &hf_pcapng_option_data_packet_flags_fcs_length,
1620             { "FCS Length",                                "pcapng.options.option.data.packet.flags.fcs_length",
1621             FT_UINT16, BASE_DEC, NULL, 0x01E0,
1622             NULL, HFILL }
1623         },
1624         { &hf_pcapng_option_data_packet_flags_reception_type,
1625             { "Reception Type",                            "pcapng.options.option.data.packet.flags.reception_type",
1626             FT_UINT16, BASE_HEX, VALS(flags_reception_type_vals), 0x001C,
1627             NULL, HFILL }
1628         },
1629         { &hf_pcapng_option_data_packet_flags_direction,
1630             { "Direction",                                 "pcapng.options.option.data.packet.flags.direction",
1631             FT_UINT16, BASE_HEX, VALS(packet_flags_direction_vals), 0x0003,
1632             NULL, HFILL }
1633         },
1634         { &hf_pcapng_option_data_dns_name,
1635             { "DNS Name",                                  "pcapng.options.option.data.dns_name",
1636             FT_STRING, STR_ASCII, NULL, 0x00,
1637             NULL, HFILL }
1638         },
1639         { &hf_pcapng_option_data_start_time,
1640             { "Start Time",                                "pcapng.options.option.data.start_time",
1641             FT_NONE, BASE_NONE, NULL, 0x00,
1642             NULL, HFILL }
1643         },
1644         { &hf_pcapng_option_data_end_time,
1645             { "End Time",                                  "pcapng.options.option.data.end_time",
1646             FT_NONE, BASE_NONE, NULL, 0x00,
1647             NULL, HFILL }
1648         },
1649         { &hf_pcapng_option_data_interface_received,
1650             { "Number of Received Packets",                "pcapng.options.option.data.interface.received",
1651             FT_UINT64, BASE_DEC, NULL, 0x00,
1652             NULL, HFILL }
1653         },
1654         { &hf_pcapng_option_data_interface_dropped,
1655             { "Number of Dropped Packets",                 "pcapng.options.option.data.interface.dropped",
1656             FT_UINT64, BASE_DEC, NULL, 0x00,
1657             NULL, HFILL }
1658         },
1659         { &hf_pcapng_option_data_interface_accepted_by_filter,
1660             { "Number of Accepted by Filter Packets",      "pcapng.options.option.data.interface.accepted_by_filter",
1661             FT_UINT64, BASE_DEC, NULL, 0x00,
1662             NULL, HFILL }
1663         },
1664         { &hf_pcapng_option_data_interface_dropped_by_os,
1665             { "Number of Dropped Packets by OS",           "pcapng.options.option.data.interface.dropped_by_os",
1666             FT_UINT64, BASE_DEC, NULL, 0x00,
1667             NULL, HFILL }
1668         },
1669         { &hf_pcapng_option_data_interface_delivered_to_user,
1670             { "Number of Delivered to the User Packets",   "pcapng.options.option.data.interface.delivered_to_user",
1671             FT_UINT64, BASE_DEC, NULL, 0x00,
1672             NULL, HFILL }
1673         },
1674         { &hf_pcapng_interface_description_link_type,
1675             { "Link Type",                                 "pcapng.interface_description.link_type",
1676             FT_UINT16, BASE_DEC_HEX, VALS(link_type_vals), 0x00,
1677             NULL, HFILL }
1678         },
1679         { &hf_pcapng_interface_description_reserved,
1680             { "Reserved",                                  "pcapng.interface_description.reserved",
1681             FT_UINT16, BASE_HEX, NULL, 0x00,
1682             NULL, HFILL }
1683         },
1684         { &hf_pcapng_interface_description_snap_length,
1685             { "Snap Length",                               "pcapng.interface_description.snap_length",
1686             FT_UINT32, BASE_DEC, NULL, 0x00,
1687             NULL, HFILL }
1688         },
1689         { &hf_pcapng_packet_block_interface_id,
1690             { "Interface",                                 "pcapng.packet.interface_id",
1691             FT_UINT16, BASE_HEX, NULL, 0x00,
1692             NULL, HFILL }
1693         },
1694         { &hf_pcapng_packet_block_drops_count,
1695             { "Drops Count",                               "pcapng.packet.drops_count",
1696             FT_UINT16, BASE_HEX, NULL, 0x00,
1697             NULL, HFILL }
1698         },
1699         { &hf_pcapng_captured_length,
1700             { "Captured Length",                           "pcapng.packet.captured_length",
1701             FT_UINT16, BASE_DEC, NULL, 0x00,
1702             NULL, HFILL }
1703         },
1704         { &hf_pcapng_packet_length,
1705             { "Packet Length",                             "pcapng.packet.packet_length",
1706             FT_UINT16, BASE_DEC, NULL, 0x00,
1707             NULL, HFILL }
1708         },
1709         { &hf_pcapng_packet_data,
1710             { "Packet Data",                               "pcapng.packet.packet_data",
1711             FT_NONE, BASE_NONE, NULL, 0x00,
1712             NULL, HFILL }
1713         },
1714         { &hf_pcapng_packet_padding,
1715             { "Packet Padding",                            "pcapng.packet.padding",
1716             FT_NONE, BASE_NONE, NULL, 0x00,
1717             NULL, HFILL }
1718         },
1719         { &hf_pcapng_interface_id,
1720             { "Interface",                                 "pcapng.interface_id",
1721             FT_UINT16, BASE_HEX, NULL, 0x00,
1722             NULL, HFILL }
1723         },
1724         { &hf_pcapng_timestamp_high,
1725             { "Timestamp (High)",                          "pcapng.timestamp_high",
1726             FT_UINT32, BASE_DEC, NULL, 0x00,
1727             NULL, HFILL }
1728         },
1729         { &hf_pcapng_timestamp_low,
1730             { "Timestamp (Low)",                           "pcapng.timestamp_low",
1731             FT_UINT32, BASE_DEC, NULL, 0x00,
1732             NULL, HFILL }
1733         },
1734         { &hf_pcapng_timestamp,
1735             { "Timestamp",                                 "pcapng.timestamp",
1736             FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x00,
1737             NULL, HFILL }
1738         },
1739         { &hf_pcapng_records,
1740             { "Records",                                   "pcapng.records",
1741             FT_NONE, BASE_NONE, NULL, 0x00,
1742             NULL, HFILL }
1743         },
1744         { &hf_pcapng_record,
1745             { "Record",                                    "pcapng.records.record",
1746             FT_NONE, BASE_NONE, NULL, 0x00,
1747             NULL, HFILL }
1748         },
1749         { &hf_pcapng_record_code,
1750             { "Code",                                      "pcapng.records.record.code",
1751             FT_UINT16, BASE_DEC, VALS(record_code_vals), 0x00,
1752             NULL, HFILL }
1753         },
1754         { &hf_pcapng_record_length,
1755             { "Length",                                    "pcapng.records.record.length",
1756             FT_INT64, BASE_DEC, NULL, 0x00,
1757             NULL, HFILL }
1758         },
1759         { &hf_pcapng_record_data,
1760             { "Record Data",                               "pcapng.records.record.data",
1761             FT_NONE, BASE_NONE, NULL, 0x00,
1762             NULL, HFILL }
1763         },
1764         { &hf_pcapng_record_padding,
1765             { "Record Padding",                            "pcapng.records.record.padding",
1766             FT_NONE, BASE_NONE, NULL, 0x00,
1767             NULL, HFILL }
1768         },
1769         { &hf_pcapng_record_ipv4,
1770             { "IPv4",                                      "pcapng.records.record.data.ipv4",
1771             FT_IPv4, BASE_NONE, NULL, 0x00,
1772             NULL, HFILL }
1773         },
1774         { &hf_pcapng_record_ipv6,
1775             { "IPv6",                                      "pcapng.records.record.data.ipv6",
1776             FT_IPv6, BASE_NONE, NULL, 0x00,
1777             NULL, HFILL }
1778         },
1779         { &hf_pcapng_record_name,
1780             { "Name",                                      "pcapng.records.record.data.name",
1781             FT_STRINGZ, STR_ASCII, NULL, 0x00,
1782             NULL, HFILL }
1783         },
1784     };
1785
1786     static ei_register_info ei[] = {
1787         { &ei_invalid_option_length, { "pcapng.invalid_option_length", PI_PROTOCOL, PI_ERROR, "Invalid Option Length", EXPFILL }},
1788         { &ei_invalid_record_length, { "pcapng.invalid_record_length", PI_PROTOCOL, PI_ERROR, "Invalid Record Length", EXPFILL }},
1789     };
1790
1791     static gint *ett[] = {
1792         &ett_pcapng,
1793         &ett_pcapng_section_header_block,
1794         &ett_pcapng_block_data,
1795         &ett_pcapng_options,
1796         &ett_pcapng_option,
1797         &ett_pcapng_records,
1798         &ett_pcapng_record,
1799         &ett_pcapng_packet_data
1800     };
1801
1802     proto_pcapng = proto_register_protocol("PCAPNG File Format", "File-PCAPNG", "file-pcapng");
1803     proto_register_field_array(proto_pcapng, hf, array_length(hf));
1804     proto_register_subtree_array(ett, array_length(ett));
1805
1806     register_dissector("file-pcapng", dissect_pcapng, proto_pcapng);
1807
1808     module = prefs_register_protocol(proto_pcapng, NULL);
1809     prefs_register_static_text_preference(module, "version",
1810             "PCAPNG version: 1.0",
1811             "Version of file-format supported by this dissector.");
1812
1813     prefs_register_bool_preference(module, "dissect_next_layer",
1814             "Dissect next layer",
1815             "Dissect next layer",
1816             &pref_dissect_next_layer);
1817
1818     expert_module = expert_register_protocol(proto_pcapng);
1819     expert_register_field_array(expert_module, ei, array_length(ei));
1820 }
1821
1822 void
1823 proto_reg_handoff_pcapng(void)
1824 {
1825     heur_dissector_add("wtap_file", dissect_pcapng_heur, "PCAPNG File", "pcapng_wtap", proto_pcapng, HEURISTIC_ENABLE);
1826     pcap_pktdata_handle = find_dissector_add_dependency("pcap_pktdata", proto_pcapng);
1827 }
1828
1829 /*
1830  * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
1831  *
1832  * Local variables:
1833  * c-basic-offset: 4
1834  * tab-width: 8
1835  * indent-tabs-mode: nil
1836  * End:
1837  *
1838  * vi: set shiftwidth=4 tabstop=8 expandtab:
1839  * :indentSize=4:tabSize=8:noTabs=true:
1840  */