+ int record_offset;
+ int ret;
+ guint32 packet_size;
+ guint8 header[30];
+ guint8 *data_ptr;
+ iptrace_1_0_phdr pkt_hdr;
+
+ /* Read the descriptor data */
+ record_offset = wth->data_offset;
+ ret = iptrace_read_rec_header(wth->fh, header, 30, err);
+ if (ret <= 0) {
+ /* Read error or EOF */
+ return ret;
+ }
+ wth->data_offset += 30;
+
+ /* Read the packet data */
+ packet_size = pntohl(&header[0]) - 0x16;
+ buffer_assure_space( wth->frame_buffer, packet_size );
+ data_ptr = buffer_start_ptr( wth->frame_buffer );
+ if (iptrace_read_rec_data(wth->fh, data_ptr, packet_size, err) < 0)
+ return -1; /* Read error */
+ wth->data_offset += packet_size;
+
+ wth->phdr.len = packet_size;
+ wth->phdr.caplen = packet_size;
+ wth->phdr.ts.tv_sec = pntohl(&header[4]);
+ wth->phdr.ts.tv_usec = 0;
+
+ /*
+ * Byte 28 of the frame header appears to be a BSD-style IFT_xxx
+ * value giving the type of the interface. Check out the
+ * <net/if_types.h> header file.
+ */
+ pkt_hdr.if_type = header[28];
+ wth->phdr.pkt_encap = wtap_encap_ift(pkt_hdr.if_type);
+
+ if (wth->phdr.pkt_encap == WTAP_ENCAP_UNKNOWN) {
+ g_message("iptrace: interface type IFT=0x%02x unknown or unsupported",
+ pkt_hdr.if_type);
+ *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+ return -1;
+ }
+
+ if ( wth->phdr.pkt_encap == WTAP_ENCAP_ATM_SNIFFER ) {
+ get_atm_pseudo_header(&wth->pseudo_header, header);
+ }
+
+ /* If the per-file encapsulation isn't known, set it to this
+ packet's encapsulation.
+
+ If it *is* known, and it isn't this packet's encapsulation,
+ set it to WTAP_ENCAP_PER_PACKET, as this file doesn't
+ have a single encapsulation for all packets in the file. */
+ if (wth->file_encap == WTAP_ENCAP_UNKNOWN)
+ wth->file_encap = wth->phdr.pkt_encap;
+ else {
+ if (wth->file_encap != wth->phdr.pkt_encap)
+ wth->file_encap = WTAP_ENCAP_PER_PACKET;
+ }
+
+ return record_offset;
+}
+
+static int iptrace_seek_read_1_0(wtap *wth, int seek_off,
+ union wtap_pseudo_header *pseudo_header, u_char *pd, int packet_size)
+{
+ int ret;
+ int err; /* XXX - return this */
+ guint8 header[30];
+
+ file_seek(wth->random_fh, seek_off, SEEK_SET);
+
+ /* Read the descriptor data */
+ ret = iptrace_read_rec_header(wth->random_fh, header, 30, &err);
+ if (ret <= 0) {
+ /* Read error or EOF */
+ return ret;
+ }
+
+ if ( wtap_encap_ift(header[28]) == WTAP_ENCAP_ATM_SNIFFER ) {
+ get_atm_pseudo_header(pseudo_header, header);
+ }
+
+ /* Read the packet data */
+ return iptrace_read_rec_data(wth->random_fh, pd, packet_size, &err);
+}
+
+/***********************************************************
+ * iptrace 2.0 *
+ ***********************************************************/
+
+/* iptrace 2.0, discovered through inspection */
+typedef struct {
+/* 0-3 */ guint32 pkt_length; /* packet length + 32 */
+/* 4-7 */ guint32 tv_sec0; /* time stamp, seconds since the Epoch */
+/* 8-11 */ guint32 junk1; /* ?? */
+/* 12-15 */ char if_name[4]; /* null-terminated */
+/* 16-27 */ char if_desc[12]; /* interface description. */
+/* 28 */ guint8 if_type; /* BSD net/if_types.h */
+/* 29 */ guint8 tx_flag; /* 0=receive, 1=transmit */
+/* 30-31 */ guint16 junk3;
+/* 32-35 */ guint32 tv_sec; /* time stamp, seconds since the Epoch */
+/* 36-39 */ guint32 tv_nsec; /* nanoseconds since that second */
+} iptrace_2_0_phdr;
+
+/* Read the next packet */
+static int iptrace_read_2_0(wtap *wth, int *err)
+{
+ int record_offset;
+ int ret;
+ guint32 packet_size;
+ guint8 header[40];
+ guint8 *data_ptr;
+ iptrace_2_0_phdr pkt_hdr;