TODO decrypt_krb5_data => proto_tree_add_expert_format cryptotvb TODO: decrypted_tvb
[metze/wireshark/wip.git] / editcap.c
index b9b980c03412db602fea96c7e31ad56f7ad59264..6353b4247ae845559565bdfe4b8d8305be3fea64 100644 (file)
--- a/editcap.c
+++ b/editcap.c
 #include <getopt.h>
 #endif
 
+#include <wiretap/secrets-types.h>
 #include <wiretap/wtap.h>
 
 #include "epan/etypes.h"
+#include "epan/dissectors/packet-ieee80211-radiotap-defs.h"
 
 #ifndef HAVE_GETOPT_LONG
 #include "wsutil/wsgetopt.h"
 #endif
 
 #ifdef _WIN32
-#include <wsutil/unicode-utils.h>
 #include <process.h>    /* getpid */
 #include <winsock2.h>
 #endif
@@ -61,9 +62,8 @@
 # include "wsutil/strptime.h"
 #endif
 
-#include <wsutil/crash_info.h>
-#include <wsutil/clopts_common.h>
-#include <wsutil/cmdarg_err.h>
+#include <ui/clopts_common.h>
+#include <ui/cmdarg_err.h>
 #include <wsutil/filesystem.h>
 #include <wsutil/file_util.h>
 #include <wsutil/wsgcrypt.h>
@@ -72,6 +72,7 @@
 #include <wsutil/report_message.h>
 #include <wsutil/strnatcmp.h>
 #include <wsutil/str_util.h>
+#include <cli_main.h>
 #include <version_info.h>
 #include <wsutil/pint.h>
 #include <wsutil/strtoi.h>
@@ -159,19 +160,27 @@ static int                    out_file_type_subtype     = WTAP_FILE_TYPE_SUBTYPE
 #endif
 static int                    out_frame_type            = -2; /* Leave frame type alone */
 static int                    verbose                   = 0;  /* Not so verbose         */
-static struct time_adjustment time_adj                  = {{0, 0}, 0}; /* no adjustment */
-static nstime_t               relative_time_window      = {0, 0}; /* de-dup time window */
-static double                 err_prob                  = 0.0;
+static struct time_adjustment time_adj                  = {NSTIME_INIT_ZERO, 0}; /* no adjustment */
+static nstime_t               relative_time_window      = NSTIME_INIT_ZERO; /* de-dup time window */
+static double                 err_prob                  = -1.0;
 static time_t                 starttime                 = 0;
 static time_t                 stoptime                  = 0;
 static gboolean               check_startstop           = FALSE;
 static gboolean               rem_vlan                  = FALSE;
 static gboolean               dup_detect                = FALSE;
 static gboolean               dup_detect_by_time        = FALSE;
+static gboolean               skip_radiotap             = FALSE;
 
 static int                    do_strict_time_adjustment = FALSE;
-static struct time_adjustment strict_time_adj           = {{0, 0}, 0}; /* strict time adjustment */
-static nstime_t               previous_time             = {0, 0}; /* previous time */
+static struct time_adjustment strict_time_adj           = {NSTIME_INIT_ZERO, 0}; /* strict time adjustment */
+static nstime_t               previous_time             = NSTIME_INIT_ZERO; /* previous time */
+
+static const struct {
+    const char *str;
+    guint32     id;
+} secrets_types[] = {
+    { "tls", SECRETS_TYPE_TLS },
+};
 
 static int find_dct2000_real_data(guint8 *buf);
 static void handle_chopping(chop_t chop, wtap_packet_header *out_phdr,
@@ -382,7 +391,7 @@ set_time_adjustment(char *optarg_str_p)
             val = strtol(&(frac[1]), &end, 10);
         }
         if (*frac != '.' || end == NULL || end == frac || val < 0
-            || val > ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
+            || val >= ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
             fprintf(stderr, "editcap: \"%s\" isn't a valid time adjustment\n",
                     optarg_str_p);
             return FALSE;
@@ -456,7 +465,7 @@ set_strict_time_adj(char *optarg_str_p)
             val = strtol(&(frac[1]), &end, 10);
         }
         if (*frac != '.' || end == NULL || end == frac || val < 0
-            || val > ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
+            || val >= ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
             fprintf(stderr, "editcap: \"%s\" isn't a valid time adjustment\n",
                     optarg_str_p);
             return FALSE;
@@ -524,7 +533,7 @@ set_rel_time(char *optarg_str_p)
             val = strtol(&(frac[1]), &end, 10);
         }
         if (*frac != '.' || end == NULL || end == frac || val < 0
-            || val > ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
+            || val >= ONE_BILLION || val == LONG_MIN || val == LONG_MAX) {
             fprintf(stderr, "3: editcap: \"%s\" isn't a valid rel time value\n",
                     optarg_str_p);
             return FALSE;
@@ -576,6 +585,7 @@ remove_vlan_info(const wtap_packet_header *phdr, guint8* fd, guint32* len) {
 static gboolean
 is_duplicate(guint8* fd, guint32 len) {
     int i;
+    const struct ieee80211_radiotap_header* tap_header;
 
     /*Hint to ignore some bytes at the start of the frame for the digest calculation(-I option) */
     guint32 offset = ignored_bytes;
@@ -586,6 +596,14 @@ is_duplicate(guint8* fd, guint32 len) {
         offset = 0;
     }
 
+    /* Get the size of radiotap header and use that as offset (-p option) */
+    if (skip_radiotap == TRUE) {
+        tap_header = (const struct ieee80211_radiotap_header*)fd;
+        offset = pletoh16(&tap_header->it_len);
+        if (offset >= len)
+            offset = 0;
+    }
+
     new_fd  = &fd[offset];
     new_len = len - (offset);
 
@@ -752,21 +770,13 @@ print_usage(FILE *output)
     fprintf(output, "                         LESS THAN <dup time window> prior to current packet.\n");
     fprintf(output, "                         A <dup time window> is specified in relative seconds\n");
     fprintf(output, "                         (e.g. 0.000001).\n");
-    fprintf(output, "  -a <framenum>:<comment> Add or replace comment for given frame number\n");
-    fprintf(output, "\n");
-    fprintf(output, "  -I <bytes to ignore>   ignore the specified number of bytes at the beginning\n");
-    fprintf(output, "                         of the frame during MD5 hash calculation, unless the\n");
-    fprintf(output, "                         frame is too short, then the full frame is used.\n");
-    fprintf(output, "                         Useful to remove duplicated packets taken on\n");
-    fprintf(output, "                         several routers (different mac addresses for\n");
-    fprintf(output, "                         example).\n");
-    fprintf(output, "                         e.g. -I 26 in case of Ether/IP will ignore\n");
-    fprintf(output, "                         ether(14) and IP header(20 - 4(src ip) - 4(dst ip)).\n");
-    fprintf(output, "\n");
     fprintf(output, "           NOTE: The use of the 'Duplicate packet removal' options with\n");
     fprintf(output, "           other editcap options except -v may not always work as expected.\n");
     fprintf(output, "           Specifically the -r, -t or -S options will very likely NOT have the\n");
     fprintf(output, "           desired effect if combined with the -d, -D or -w.\n");
+    fprintf(output, "  --skip-radiotap-header skip radiotap header when checking for packet duplicates.\n");
+    fprintf(output, "                         Useful when processing packets captured by multiple radios\n");
+    fprintf(output, "                         on the same channel in the vicinity of each other.\n");
     fprintf(output, "\n");
     fprintf(output, "Packet manipulation:\n");
     fprintf(output, "  -s <snaplen>           truncate each packet to max. <snaplen> bytes of data.\n");
@@ -796,6 +806,18 @@ print_usage(FILE *output)
     fprintf(output, "  -o <change offset>     When used in conjunction with -E, skip some bytes from the\n");
     fprintf(output, "                         beginning of the packet. This allows one to preserve some\n");
     fprintf(output, "                         bytes, in order to have some headers untouched.\n");
+    fprintf(output, "  --seed <seed>          When used in conjunction with -E, set the seed to use for\n");
+    fprintf(output, "                         the pseudo-random number generator. This allows one to\n");
+    fprintf(output, "                         repeat a particular sequence of errors.\n");
+    fprintf(output, "  -I <bytes to ignore>   ignore the specified number of bytes at the beginning\n");
+    fprintf(output, "                         of the frame during MD5 hash calculation, unless the\n");
+    fprintf(output, "                         frame is too short, then the full frame is used.\n");
+    fprintf(output, "                         Useful to remove duplicated packets taken on\n");
+    fprintf(output, "                         several routers (different mac addresses for\n");
+    fprintf(output, "                         example).\n");
+    fprintf(output, "                         e.g. -I 26 in case of Ether/IP will ignore\n");
+    fprintf(output, "                         ether(14) and IP header(20 - 4(src ip) - 4(dst ip)).\n");
+    fprintf(output, "  -a <framenum>:<comment> Add or replace comment for given frame number\n");
     fprintf(output, "\n");
     fprintf(output, "Output File(s):\n");
     fprintf(output, "  -c <packets per file>  split the packet output to different files based on\n");
@@ -804,8 +826,12 @@ print_usage(FILE *output)
     fprintf(output, "  -i <seconds per file>  split the packet output to different files based on\n");
     fprintf(output, "                         uniform time intervals with a maximum of\n");
     fprintf(output, "                         <seconds per file> each.\n");
-    fprintf(output, "  -F <capture type>      set the output file type; default is pcapng. An empty\n");
-    fprintf(output, "                         \"-F\" option will list the file types.\n");
+#ifdef PCAP_NG_DEFAULT
+    fprintf(output, "  -F <capture type>      set the output file type; default is pcapng.\n");
+#else
+    fprintf(output, "  -F <capture type>      set the output file type; default is pcap.\n");
+#endif
+    fprintf(output, "                         An empty \"-F\" option will list the file types.\n");
     fprintf(output, "  -T <encap type>        set the output file encapsulation type; default is the\n");
     fprintf(output, "                         same as the input file. An empty \"-T\" option will\n");
     fprintf(output, "                         list the encapsulation types.\n");
@@ -874,9 +900,9 @@ list_encap_types(FILE *stream) {
     encaps = (struct string_elem *)g_malloc(sizeof(struct string_elem) * WTAP_NUM_ENCAP_TYPES);
     fprintf(stream, "editcap: The available encapsulation types for the \"-T\" flag are:\n");
     for (i = 0; i < WTAP_NUM_ENCAP_TYPES; i++) {
-        encaps[i].sstr = wtap_encap_short_string(i);
+        encaps[i].sstr = wtap_encap_name(i);
         if (encaps[i].sstr != NULL) {
-            encaps[i].lstr = wtap_encap_string(i);
+            encaps[i].lstr = wtap_encap_description(i);
             list = g_slist_insert_sorted(list, &encaps[i], string_nat_compare);
         }
     }
@@ -885,6 +911,25 @@ list_encap_types(FILE *stream) {
     g_free(encaps);
 }
 
+static void
+list_secrets_types(FILE *stream)
+{
+    for (guint i = 0; i < G_N_ELEMENTS(secrets_types); i++) {
+        fprintf(stream, "    %s\n", secrets_types[i].str);
+    }
+}
+
+static guint32
+lookup_secrets_type(const char *type)
+{
+    for (guint i = 0; i < G_N_ELEMENTS(secrets_types); i++) {
+        if (!strcmp(secrets_types[i].str, type)) {
+            return secrets_types[i].id;
+        }
+    }
+    return 0;
+}
+
 static int
 framenum_compare(gconstpointer a, gconstpointer b, gpointer user_data _U_)
 {
@@ -920,22 +965,18 @@ failure_message_cont(const char *msg_format, va_list ap)
 }
 
 static wtap_dumper *
-editcap_dump_open(const char *filename, guint32 snaplen,
-                  GArray* shb_hdrs,
-                  wtapng_iface_descriptions_t *idb_inf,
-                  GArray* nrb_hdrs, int *write_err)
+editcap_dump_open(const char *filename, const wtap_dump_params *params,
+                  int *write_err)
 {
   wtap_dumper *pdh;
 
   if (strcmp(filename, "-") == 0) {
     /* Write to the standard output. */
-    pdh = wtap_dump_open_stdout_ng(out_file_type_subtype, out_frame_type,
-                                   snaplen, FALSE /* compressed */,
-                                   shb_hdrs, idb_inf, nrb_hdrs, write_err);
+    pdh = wtap_dump_open_stdout(out_file_type_subtype, WTAP_UNCOMPRESSED,
+                                params, write_err);
   } else {
-    pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
-                            snaplen, FALSE /* compressed */,
-                            shb_hdrs, idb_inf, nrb_hdrs, write_err);
+    pdh = wtap_dump_open(filename, out_file_type_subtype, WTAP_UNCOMPRESSED,
+                         params, write_err);
   }
   return pdh;
 }
@@ -943,8 +984,6 @@ editcap_dump_open(const char *filename, guint32 snaplen,
 int
 main(int argc, char *argv[])
 {
-    GString      *comp_info_str;
-    GString      *runtime_info_str;
     char         *init_progfile_dir_error;
     wtap         *wth = NULL;
     int           i, j, read_err, write_err;
@@ -952,6 +991,9 @@ main(int argc, char *argv[])
     int           opt;
     static const struct option long_options[] = {
         {"novlan", no_argument, NULL, 0x8100},
+        {"skip-radiotap-header", no_argument, NULL, 0x8101},
+        {"seed", required_argument, NULL, 0x8102},
+        {"inject-secrets", required_argument, NULL, 0x8103},
         {"help", no_argument, NULL, 'h'},
         {"version", no_argument, NULL, 'V'},
         {0, 0, 0, 0 }
@@ -979,38 +1021,26 @@ main(int argc, char *argv[])
     gchar        *fsuffix            = NULL;
     guint32       change_offset      = 0;
     guint         max_packet_number  = 0;
+    GArray       *dsb_types          = NULL;
+    GPtrArray    *dsb_filenames      = NULL;
     const wtap_rec              *rec;
     wtap_rec                     temp_rec;
-    wtapng_iface_descriptions_t *idb_inf = NULL;
-    GArray                      *shb_hdrs = NULL;
-    GArray                      *nrb_hdrs = NULL;
+    wtap_dump_params             params = WTAP_DUMP_PARAMS_INIT;
     char                        *shb_user_appl;
     gboolean                     do_mutation;
     guint32                      caplen;
     int                          ret = EXIT_SUCCESS;
+    gboolean                     valid_seed = FALSE;
+    unsigned int                 seed = 0;
 
     cmdarg_err_init(failure_warning_message, failure_message_cont);
 
 #ifdef _WIN32
-    arg_list_utf_16to8(argc, argv);
     create_app_running_mutex();
 #endif /* _WIN32 */
 
-    /* Get the compile-time version information string */
-    comp_info_str = get_compiled_version_info(NULL, NULL);
-
-    /* Get the run-time version information string */
-    runtime_info_str = get_runtime_version_info(NULL);
-
-    /* Add it to the information to be reported on a crash. */
-    ws_add_crash_info("Editcap (Wireshark) %s\n"
-         "\n"
-         "%s"
-         "\n"
-         "%s",
-      get_ws_vcs_version_info(), comp_info_str->str, runtime_info_str->str);
-    g_string_free(comp_info_str, TRUE);
-    g_string_free(runtime_info_str, TRUE);
+    /* Initialize the version information. */
+    ws_init_version_info("Editcap (Wireshark)", NULL, NULL, NULL);
 
     /*
      * Get credential information for later use.
@@ -1043,6 +1073,54 @@ main(int argc, char *argv[])
             break;
         }
 
+        case 0x8101:
+        {
+            skip_radiotap = TRUE;
+            break;
+        }
+
+        case 0x8102:
+        {
+            if (sscanf(optarg, "%u", &seed) != 1) {
+                fprintf(stderr, "editcap: \"%s\" isn't a valid seed\n\n",
+                        optarg);
+                ret = INVALID_OPTION;
+                goto clean_exit;
+            }
+            valid_seed = TRUE;
+            break;
+        }
+
+        case 0x8103: /* --inject-secrets */
+        {
+            guint32 secrets_type_id = 0;
+            const char *secrets_filename = NULL;
+            if (strcmp("help", optarg) == 0) {
+                list_secrets_types(stdout);
+                goto clean_exit;
+            }
+            gchar **splitted = g_strsplit(optarg, ",", 2);
+            if (splitted[0]) {
+                secrets_type_id = lookup_secrets_type(splitted[0]);
+                secrets_filename = splitted[1];
+            }
+
+            if (secrets_type_id == 0) {
+                fprintf(stderr, "editcap: \"%s\" isn't a valid secrets type\n", secrets_filename);
+                g_strfreev(splitted);
+                ret = INVALID_OPTION;
+                goto clean_exit;
+            }
+            if (!dsb_filenames) {
+                dsb_types = g_array_new(FALSE, FALSE, sizeof(guint32));
+                dsb_filenames = g_ptr_array_new_with_free_func(g_free);
+            }
+            g_array_append_val(dsb_types, secrets_type_id);
+            g_ptr_array_add(dsb_filenames, g_strdup(secrets_filename));
+            g_strfreev(splitted);
+            break;
+        }
+
         case 'a':
         {
             guint frame_number;
@@ -1170,7 +1248,6 @@ main(int argc, char *argv[])
                 ret = INVALID_OPTION;
                 goto clean_exit;
             }
-            srand( (unsigned int) (time(NULL) + ws_getpid()) );
             break;
 
         case 'F':
@@ -1185,10 +1262,7 @@ main(int argc, char *argv[])
             break;
 
         case 'h':
-            printf("Editcap (Wireshark) %s\n"
-                   "Edit and/or translate the format of capture files.\n"
-                   "See https://www.wireshark.org for more information.\n",
-               get_ws_vcs_version_info());
+            show_help_header("Edit and/or translate the format of capture files.");
             print_usage(stdout);
             goto clean_exit;
             break;
@@ -1233,7 +1307,7 @@ main(int argc, char *argv[])
             break;
 
         case 'T':
-            out_frame_type = wtap_short_string_to_encap(optarg);
+            out_frame_type = wtap_name_to_encap(optarg);
             if (out_frame_type < 0) {
                 fprintf(stderr, "editcap: \"%s\" isn't a valid encapsulation type\n\n",
                         optarg);
@@ -1248,11 +1322,7 @@ main(int argc, char *argv[])
             break;
 
         case 'V':
-            comp_info_str = get_compiled_version_info(NULL, NULL);
-            runtime_info_str = get_runtime_version_info(NULL);
-            show_version("Editcap (Wireshark)", comp_info_str, runtime_info_str);
-            g_string_free(comp_info_str, TRUE);
-            g_string_free(runtime_info_str, TRUE);
+            show_version();
             goto clean_exit;
             break;
 
@@ -1294,10 +1364,21 @@ main(int argc, char *argv[])
     fprintf(stderr, "Optind = %i, argc = %i\n", optind, argc);
 #endif
 
-    if ((argc - optind) < 1) {
+    if ((argc - optind) < 2) {
         print_usage(stderr);
         ret = INVALID_OPTION;
         goto clean_exit;
+
+    }
+
+    if (err_prob >= 0.0) {
+        if (!valid_seed) {
+            seed = (unsigned int) (time(NULL) + ws_getpid());
+        }
+        if (verbose) {
+            fprintf(stderr, "Using seed %u\n", seed);
+        }
+        srand(seed);
     }
 
     if (check_startstop && !stoptime) {
@@ -1308,6 +1389,7 @@ main(int argc, char *argv[])
         stoptm.tm_year = 135;
         stoptm.tm_mday = 31;
         stoptm.tm_mon = 11;
+        stoptm.tm_isdst = -1;
 
         stoptime = mktime(&stoptm);
     }
@@ -1341,128 +1423,158 @@ main(int argc, char *argv[])
                 wtap_file_type_subtype_string(wtap_file_type_subtype(wth)));
     }
 
-    shb_hdrs = wtap_file_get_shb_for_new_file(wth);
-    idb_inf = wtap_file_get_idb_info(wth);
-    nrb_hdrs = wtap_file_get_nrb_for_new_file(wth);
+    if (ignored_bytes != 0 && skip_radiotap == TRUE) {
+        fprintf(stderr, "editcap: can't skip radiotap headers and %d byte(s)\n", ignored_bytes);
+        fprintf(stderr, "editcap: at the start of packet at the same time\n");
+        ret = INVALID_OPTION;
+        goto clean_exit;
+    }
+
+    if (skip_radiotap == TRUE && wtap_file_encap(wth) != WTAP_ENCAP_IEEE_802_11_RADIOTAP) {
+        fprintf(stderr, "editcap: can't skip radiotap header because input file is incorrect\n");
+        fprintf(stderr, "editcap: expected '%s', input is '%s'\n",
+                wtap_encap_description(WTAP_ENCAP_IEEE_802_11_RADIOTAP),
+                wtap_encap_description(wtap_file_type_subtype(wth)));
+        ret = INVALID_OPTION;
+        goto clean_exit;
+    }
+
+    wtap_dump_params_init(&params, wth);
+
+    if (dsb_filenames) {
+        for (guint k = 0; k < dsb_filenames->len; k++) {
+            guint32 secrets_type_id = g_array_index(dsb_types, guint32, k);
+            const char *secrets_filename = (const char *)g_ptr_array_index(dsb_filenames, k);
+            char *data;
+            gsize data_len;
+            wtap_block_t block;
+            wtapng_dsb_mandatory_t *dsb;
+            GError *err = NULL;
+
+            if (!g_file_get_contents(secrets_filename, &data, &data_len, &err)) {
+                fprintf(stderr, "editcap: \"%s\" could not be read: %s\n", secrets_filename, err->message);
+                g_clear_error(&err);
+                ret = INVALID_OPTION;
+                goto clean_exit;
+            }
+            if (data_len == 0) {
+                fprintf(stderr, "editcap: \"%s\" is an empty file, ignoring\n", secrets_filename);
+                g_free(data);
+                continue;
+            }
+            if (data_len >= G_MAXINT) {
+                fprintf(stderr, "editcap: \"%s\" is too large, ignoring\n", secrets_filename);
+                g_free(data);
+                continue;
+            }
+
+            block = wtap_block_create(WTAP_BLOCK_DSB);
+            dsb = (wtapng_dsb_mandatory_t *)wtap_block_get_mandatory_data(block);
+            dsb->secrets_type = secrets_type_id;
+            dsb->secrets_len = (guint)data_len;
+            dsb->secrets_data = data;
+            if (params.dsbs_initial == NULL) {
+                params.dsbs_initial = g_array_new(FALSE, FALSE, sizeof(wtap_block_t));
+            }
+            g_array_append_val(params.dsbs_initial, block);
+        }
+    }
 
     /*
-     * Now, process the rest, if any ... we only write if there is an extra
-     * argument or so ...
+     * If an encapsulation type was specified, override the encapsulation
+     * type of the input file.
      */
+    if (out_frame_type != -2)
+        params.encap = out_frame_type;
 
-    if ((argc - optind) >= 2) {
-        if (out_frame_type == -2)
-            out_frame_type = wtap_file_encap(wth);
+    /*
+     * If a snapshot length was specified, and it's less than the snapshot
+     * length of the input file, override the snapshot length of the input
+     * file.
+     */
+    if (snaplen != 0 && snaplen < wtap_snapshot_length(wth))
+        params.snaplen = snaplen;
 
-        for (i = optind + 2; i < argc; i++)
-            if (add_selection(argv[i], &max_packet_number) == FALSE)
-                break;
+    /*
+     * Now process the arguments following the input and output file
+     * names, if any; they specify packets to include/exclude.
+     */
+    for (i = optind + 2; i < argc; i++)
+        if (add_selection(argv[i], &max_packet_number) == FALSE)
+            break;
 
-        if (keep_em == FALSE)
-            max_packet_number = G_MAXUINT;
+    if (keep_em == FALSE)
+        max_packet_number = G_MAXUINT;
 
-        if (dup_detect || dup_detect_by_time) {
-            for (i = 0; i < dup_window; i++) {
-                memset(&fd_hash[i].digest, 0, 16);
-                fd_hash[i].len = 0;
-                nstime_set_unset(&fd_hash[i].frame_time);
-            }
+    if (dup_detect || dup_detect_by_time) {
+        for (i = 0; i < dup_window; i++) {
+            memset(&fd_hash[i].digest, 0, 16);
+            fd_hash[i].len = 0;
+            nstime_set_unset(&fd_hash[i].frame_time);
         }
+    }
 
-        /* Read all of the packets in turn */
-        while (wtap_read(wth, &read_err, &read_err_info, &data_offset)) {
-            if (max_packet_number <= read_count)
-                break;
+    /* Read all of the packets in turn */
+    while (wtap_read(wth, &read_err, &read_err_info, &data_offset)) {
+        if (max_packet_number <= read_count)
+            break;
 
-            read_count++;
+        read_count++;
 
-            rec = wtap_get_rec(wth);
+        rec = wtap_get_rec(wth);
 
-            /* Extra actions for the first packet */
-            if (read_count == 1) {
-                if (split_packet_count != 0 || secs_per_block != 0) {
-                    if (!fileset_extract_prefix_suffix(argv[optind+1], &fprefix, &fsuffix)) {
-                        ret = CANT_EXTRACT_PREFIX;
-                        goto clean_exit;
-                    }
-
-                    filename = fileset_get_filename_by_pattern(block_cnt++, rec, fprefix, fsuffix);
-                } else {
-                    filename = g_strdup(argv[optind+1]);
+        /* Extra actions for the first packet */
+        if (read_count == 1) {
+            if (split_packet_count != 0 || secs_per_block != 0) {
+                if (!fileset_extract_prefix_suffix(argv[optind+1], &fprefix, &fsuffix)) {
+                    ret = CANT_EXTRACT_PREFIX;
+                    goto clean_exit;
                 }
-                g_assert(filename);
 
-                /* If we don't have an application name add Editcap */
-                if (wtap_block_get_string_option_value(g_array_index(shb_hdrs, wtap_block_t, 0), OPT_SHB_USERAPPL, &shb_user_appl) != WTAP_OPTTYPE_SUCCESS) {
-                    wtap_block_add_string_option_format(g_array_index(shb_hdrs, wtap_block_t, 0), OPT_SHB_USERAPPL, "Editcap " VERSION);
-                }
+                filename = fileset_get_filename_by_pattern(block_cnt++, rec, fprefix, fsuffix);
+            } else {
+                filename = g_strdup(argv[optind+1]);
+            }
+            g_assert(filename);
 
-                pdh = editcap_dump_open(filename,
-                                        snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                        shb_hdrs, idb_inf, nrb_hdrs, &write_err);
+            /* If we don't have an application name add one */
+            if (wtap_block_get_string_option_value(g_array_index(params.shb_hdrs, wtap_block_t, 0), OPT_SHB_USERAPPL, &shb_user_appl) != WTAP_OPTTYPE_SUCCESS) {
+                wtap_block_add_string_option_format(g_array_index(params.shb_hdrs, wtap_block_t, 0), OPT_SHB_USERAPPL, "%s", get_appname_and_version());
+            }
 
-                if (pdh == NULL) {
-                    cfile_dump_open_failure_message("editcap", filename,
-                                                    write_err,
-                                                    out_file_type_subtype);
-                    ret = INVALID_FILE;
-                    goto clean_exit;
-                }
-            } /* first packet only handling */
+            pdh = editcap_dump_open(filename, &params, &write_err);
 
+            if (pdh == NULL) {
+                cfile_dump_open_failure_message("editcap", filename,
+                                                write_err,
+                                                out_file_type_subtype);
+                ret = INVALID_FILE;
+                goto clean_exit;
+            }
+        } /* first packet only handling */
 
-            buf = wtap_get_buf_ptr(wth);
 
-            /*
-             * Not all packets have time stamps. Only process the time
-             * stamp if we have one.
-             */
-            if (rec->presence_flags & WTAP_HAS_TS) {
-                if (nstime_is_unset(&block_start)) {
-                    block_start = rec->ts;
-                }
-                if (secs_per_block != 0) {
-                    while (((guint32)(rec->ts.secs - block_start.secs) >  secs_per_block)
-                           || ((guint32)(rec->ts.secs - block_start.secs) == secs_per_block
-                               && rec->ts.nsecs >= block_start.nsecs )) { /* time for the next file */
-
-                        if (!wtap_dump_close(pdh, &write_err)) {
-                            cfile_close_failure_message(filename, write_err);
-                            ret = WRITE_ERROR;
-                            goto clean_exit;
-                        }
-                        block_start.secs = block_start.secs +  secs_per_block; /* reset for next interval */
-                        g_free(filename);
-                        filename = fileset_get_filename_by_pattern(block_cnt++, rec, fprefix, fsuffix);
-                        g_assert(filename);
-
-                        if (verbose)
-                            fprintf(stderr, "Continuing writing in file %s\n", filename);
-
-                        pdh = editcap_dump_open(filename,
-                                                snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                                shb_hdrs, idb_inf, nrb_hdrs, &write_err);
-
-                        if (pdh == NULL) {
-                            cfile_dump_open_failure_message("editcap", filename,
-                                                            write_err,
-                                                            out_file_type_subtype);
-                            ret = INVALID_FILE;
-                            goto clean_exit;
-                        }
-                    }
-                }
-            }  /* time stamp handling */
+        buf = wtap_get_buf_ptr(wth);
+
+        /*
+         * Not all packets have time stamps. Only process the time
+         * stamp if we have one.
+         */
+        if (rec->presence_flags & WTAP_HAS_TS) {
+            if (nstime_is_unset(&block_start)) {
+                block_start = rec->ts;
+            }
+            if (secs_per_block != 0) {
+                while (((guint32)(rec->ts.secs - block_start.secs) >  secs_per_block)
+                       || ((guint32)(rec->ts.secs - block_start.secs) == secs_per_block
+                           && rec->ts.nsecs >= block_start.nsecs )) { /* time for the next file */
 
-            if (split_packet_count != 0) {
-                /* time for the next file? */
-                if (written_count > 0 && (written_count % split_packet_count) == 0) {
                     if (!wtap_dump_close(pdh, &write_err)) {
                         cfile_close_failure_message(filename, write_err);
                         ret = WRITE_ERROR;
                         goto clean_exit;
                     }
-
+                    block_start.secs = block_start.secs +  secs_per_block; /* reset for next interval */
                     g_free(filename);
                     filename = fileset_get_filename_by_pattern(block_cnt++, rec, fprefix, fsuffix);
                     g_assert(filename);
@@ -1470,9 +1582,8 @@ main(int argc, char *argv[])
                     if (verbose)
                         fprintf(stderr, "Continuing writing in file %s\n", filename);
 
-                    pdh = editcap_dump_open(filename,
-                                            snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                            shb_hdrs, idb_inf, nrb_hdrs, &write_err);
+                    pdh = editcap_dump_open(filename, &params, &write_err);
+
                     if (pdh == NULL) {
                         cfile_dump_open_failure_message("editcap", filename,
                                                         write_err,
@@ -1481,84 +1592,92 @@ main(int argc, char *argv[])
                         goto clean_exit;
                     }
                 }
-            } /* split packet handling */
+            }
+        }  /* time stamp handling */
+
+        if (split_packet_count != 0) {
+            /* time for the next file? */
+            if (written_count > 0 && (written_count % split_packet_count) == 0) {
+                if (!wtap_dump_close(pdh, &write_err)) {
+                    cfile_close_failure_message(filename, write_err);
+                    ret = WRITE_ERROR;
+                    goto clean_exit;
+                }
 
-            if (check_startstop) {
-                /*
-                 * Is the packet in the selected timeframe?
-                 * If the packet has no time stamp, the answer is "no".
-                 */
-                if (rec->presence_flags & WTAP_HAS_TS)
-                    ts_okay = (rec->ts.secs >= starttime) && (rec->ts.secs < stoptime);
-                else
-                    ts_okay = FALSE;
-            } else {
-                /*
-                 * No selected timeframe, so all packets are "in the
-                 * selected timeframe".
-                 */
-                ts_okay = TRUE;
+                g_free(filename);
+                filename = fileset_get_filename_by_pattern(block_cnt++, rec, fprefix, fsuffix);
+                g_assert(filename);
+
+                if (verbose)
+                    fprintf(stderr, "Continuing writing in file %s\n", filename);
+
+                pdh = editcap_dump_open(filename, &params, &write_err);
+                if (pdh == NULL) {
+                    cfile_dump_open_failure_message("editcap", filename,
+                                                    write_err,
+                                                    out_file_type_subtype);
+                    ret = INVALID_FILE;
+                    goto clean_exit;
+                }
             }
+        } /* split packet handling */
 
-            if (ts_okay && ((!selected(count) && !keep_em)
-                            || (selected(count) && keep_em))) {
+        if (check_startstop) {
+            /*
+             * Is the packet in the selected timeframe?
+             * If the packet has no time stamp, the answer is "no".
+             */
+            if (rec->presence_flags & WTAP_HAS_TS)
+                ts_okay = (rec->ts.secs >= starttime) && (rec->ts.secs < stoptime);
+            else
+                ts_okay = FALSE;
+        } else {
+            /*
+             * No selected timeframe, so all packets are "in the
+             * selected timeframe".
+             */
+            ts_okay = TRUE;
+        }
 
-                if (verbose && !dup_detect && !dup_detect_by_time)
-                    fprintf(stderr, "Packet: %u\n", count);
+        if (ts_okay && ((!selected(count) && !keep_em)
+                        || (selected(count) && keep_em))) {
 
-                /* We simply write it, perhaps after truncating it; we could
-                 * do other things, like modify it. */
+            if (verbose && !dup_detect && !dup_detect_by_time)
+                fprintf(stderr, "Packet: %u\n", count);
 
-                rec = wtap_get_rec(wth);
+            /* We simply write it, perhaps after truncating it; we could
+             * do other things, like modify it. */
 
-                if (rec->presence_flags & WTAP_HAS_TS) {
-                    /* Do we adjust timestamps to ensure strict chronological
-                     * order? */
-                    if (do_strict_time_adjustment) {
-                        if (previous_time.secs || previous_time.nsecs) {
-                            if (!strict_time_adj.is_negative) {
-                                nstime_t current;
-                                nstime_t delta;
-
-                                current = rec->ts;
-
-                                nstime_delta(&delta, &current, &previous_time);
-
-                                if (delta.secs < 0 || delta.nsecs < 0) {
-                                    /*
-                                     * A negative delta indicates that the current packet
-                                     * has an absolute timestamp less than the previous packet
-                                     * that it is being compared to.  This is NOT a normal
-                                     * situation since trace files usually have packets in
-                                     * chronological order (oldest to newest).
-                                     * Copy and change rather than modify
-                                     * returned rec.
-                                     */
-                                    /* fprintf(stderr, "++out of order, need to adjust this packet!\n"); */
-                                    temp_rec = *rec;
-                                    temp_rec.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
-                                    temp_rec.ts.nsecs = previous_time.nsecs;
-                                    if (temp_rec.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
-                                        /* carry */
-                                        temp_rec.ts.secs++;
-                                        temp_rec.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
-                                    } else {
-                                        temp_rec.ts.nsecs += strict_time_adj.tv.nsecs;
-                                    }
-                                    rec = &temp_rec;
-                                }
-                            } else {
+            rec = wtap_get_rec(wth);
+
+            if (rec->presence_flags & WTAP_HAS_TS) {
+                /* Do we adjust timestamps to ensure strict chronological
+                 * order? */
+                if (do_strict_time_adjustment) {
+                    if (previous_time.secs || previous_time.nsecs) {
+                        if (!strict_time_adj.is_negative) {
+                            nstime_t current;
+                            nstime_t delta;
+
+                            current = rec->ts;
+
+                            nstime_delta(&delta, &current, &previous_time);
+
+                            if (delta.secs < 0 || delta.nsecs < 0) {
                                 /*
-                                 * A negative strict time adjustment is requested.
-                                 * Unconditionally set each timestamp to previous
-                                 * packet's timestamp plus delta.
-                                 * Copy and change rather than modify returned
-                                 * rec.
+                                 * A negative delta indicates that the current packet
+                                 * has an absolute timestamp less than the previous packet
+                                 * that it is being compared to.  This is NOT a normal
+                                 * situation since trace files usually have packets in
+                                 * chronological order (oldest to newest).
+                                 * Copy and change rather than modify
+                                 * returned rec.
                                  */
+                                /* fprintf(stderr, "++out of order, need to adjust this packet!\n"); */
                                 temp_rec = *rec;
                                 temp_rec.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
                                 temp_rec.ts.nsecs = previous_time.nsecs;
-                                if (temp_rec.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
+                                if (temp_rec.ts.nsecs + strict_time_adj.tv.nsecs >= ONE_BILLION) {
                                     /* carry */
                                     temp_rec.ts.secs++;
                                     temp_rec.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
@@ -1567,82 +1686,138 @@ main(int argc, char *argv[])
                                 }
                                 rec = &temp_rec;
                             }
-                        }
-                        previous_time = rec->ts;
-                    }
-
-                    if (time_adj.tv.secs != 0) {
-                        /* Copy and change rather than modify returned rec */
-                        temp_rec = *rec;
-                        if (time_adj.is_negative)
-                            temp_rec.ts.secs -= time_adj.tv.secs;
-                        else
-                            temp_rec.ts.secs += time_adj.tv.secs;
-                        rec = &temp_rec;
-                    }
-
-                    if (time_adj.tv.nsecs != 0) {
-                        /* Copy and change rather than modify returned rec */
-                        temp_rec = *rec;
-                        if (time_adj.is_negative) { /* subtract */
-                            if (temp_rec.ts.nsecs < time_adj.tv.nsecs) { /* borrow */
-                                temp_rec.ts.secs--;
-                                temp_rec.ts.nsecs += ONE_BILLION;
-                            }
-                            temp_rec.ts.nsecs -= time_adj.tv.nsecs;
-                        } else {                  /* add */
-                            if (temp_rec.ts.nsecs + time_adj.tv.nsecs > ONE_BILLION) {
+                        } else {
+                            /*
+                             * A negative strict time adjustment is requested.
+                             * Unconditionally set each timestamp to previous
+                             * packet's timestamp plus delta.
+                             * Copy and change rather than modify returned
+                             * rec.
+                             */
+                            temp_rec = *rec;
+                            temp_rec.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
+                            temp_rec.ts.nsecs = previous_time.nsecs;
+                            if (temp_rec.ts.nsecs + strict_time_adj.tv.nsecs >= ONE_BILLION) {
                                 /* carry */
                                 temp_rec.ts.secs++;
-                                temp_rec.ts.nsecs += time_adj.tv.nsecs - ONE_BILLION;
+                                temp_rec.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
                             } else {
-                                temp_rec.ts.nsecs += time_adj.tv.nsecs;
+                                temp_rec.ts.nsecs += strict_time_adj.tv.nsecs;
                             }
+                            rec = &temp_rec;
                         }
-                        rec = &temp_rec;
                     }
-                } /* time stamp adjustment */
+                    previous_time = rec->ts;
+                }
 
-                if (rec->rec_type == REC_TYPE_PACKET) {
-                    if (snaplen != 0) {
-                        /* Limit capture length to snaplen */
-                        if (rec->rec_header.packet_header.caplen > snaplen) {
-                            /* Copy and change rather than modify returned wtap_rec */
-                            temp_rec = *rec;
-                            temp_rec.rec_header.packet_header.caplen = snaplen;
-                            rec = &temp_rec;
+                if (time_adj.tv.secs != 0) {
+                    /* Copy and change rather than modify returned rec */
+                    temp_rec = *rec;
+                    if (time_adj.is_negative)
+                        temp_rec.ts.secs -= time_adj.tv.secs;
+                    else
+                        temp_rec.ts.secs += time_adj.tv.secs;
+                    rec = &temp_rec;
+                }
+
+                if (time_adj.tv.nsecs != 0) {
+                    /* Copy and change rather than modify returned rec */
+                    temp_rec = *rec;
+                    if (time_adj.is_negative) { /* subtract */
+                        if (temp_rec.ts.nsecs < time_adj.tv.nsecs) { /* borrow */
+                            temp_rec.ts.secs--;
+                            temp_rec.ts.nsecs += ONE_BILLION;
                         }
-                        /* If -L, also set reported length to snaplen */
-                        if (adjlen && rec->rec_header.packet_header.len > snaplen) {
-                            /* Copy and change rather than modify returned phdr */
-                            temp_rec = *rec;
-                            temp_rec.rec_header.packet_header.len = snaplen;
-                            rec = &temp_rec;
+                        temp_rec.ts.nsecs -= time_adj.tv.nsecs;
+                    } else {                  /* add */
+                        if (temp_rec.ts.nsecs + time_adj.tv.nsecs >= ONE_BILLION) {
+                            /* carry */
+                            temp_rec.ts.secs++;
+                            temp_rec.ts.nsecs += time_adj.tv.nsecs - ONE_BILLION;
+                        } else {
+                            temp_rec.ts.nsecs += time_adj.tv.nsecs;
                         }
                     }
-
-                    /*
-                     * CHOP
-                     * Copy and change rather than modify returned phdr.
-                     */
-                    temp_rec = *rec;
-                    handle_chopping(chop, &temp_rec.rec_header.packet_header,
-                                    &rec->rec_header.packet_header, &buf,
-                                    adjlen);
                     rec = &temp_rec;
+                }
+            } /* time stamp adjustment */
 
-                    /* remove vlan info */
-                    if (rem_vlan) {
-                        /* Copy and change rather than modify returned rec */
+            if (rec->rec_type == REC_TYPE_PACKET) {
+                if (snaplen != 0) {
+                    /* Limit capture length to snaplen */
+                    if (rec->rec_header.packet_header.caplen > snaplen) {
+                        /* Copy and change rather than modify returned wtap_rec */
+                        temp_rec = *rec;
+                        temp_rec.rec_header.packet_header.caplen = snaplen;
+                        rec = &temp_rec;
+                    }
+                    /* If -L, also set reported length to snaplen */
+                    if (adjlen && rec->rec_header.packet_header.len > snaplen) {
+                        /* Copy and change rather than modify returned phdr */
                         temp_rec = *rec;
-                        remove_vlan_info(&rec->rec_header.packet_header, buf,
-                                         &temp_rec.rec_header.packet_header.caplen);
+                        temp_rec.rec_header.packet_header.len = snaplen;
                         rec = &temp_rec;
                     }
+                }
+
+                /*
+                 * CHOP
+                 * Copy and change rather than modify returned phdr.
+                 */
+                temp_rec = *rec;
+                handle_chopping(chop, &temp_rec.rec_header.packet_header,
+                                &rec->rec_header.packet_header, &buf,
+                                adjlen);
+                rec = &temp_rec;
+
+                /* remove vlan info */
+                if (rem_vlan) {
+                    /* Copy and change rather than modify returned rec */
+                    temp_rec = *rec;
+                    remove_vlan_info(&rec->rec_header.packet_header, buf,
+                                     &temp_rec.rec_header.packet_header.caplen);
+                    rec = &temp_rec;
+                }
+
+                /* suppress duplicates by packet window */
+                if (dup_detect) {
+                    if (is_duplicate(buf, rec->rec_header.packet_header.caplen)) {
+                        if (verbose) {
+                            fprintf(stderr, "Skipped: %u, Len: %u, MD5 Hash: ",
+                                    count,
+                                    rec->rec_header.packet_header.caplen);
+                            for (i = 0; i < 16; i++)
+                                fprintf(stderr, "%02x",
+                                        (unsigned char)fd_hash[cur_dup_entry].digest[i]);
+                            fprintf(stderr, "\n");
+                        }
+                        duplicate_count++;
+                        count++;
+                        continue;
+                    } else {
+                        if (verbose) {
+                            fprintf(stderr, "Packet: %u, Len: %u, MD5 Hash: ",
+                                    count,
+                                    rec->rec_header.packet_header.caplen);
+                            for (i = 0; i < 16; i++)
+                                fprintf(stderr, "%02x",
+                                        (unsigned char)fd_hash[cur_dup_entry].digest[i]);
+                            fprintf(stderr, "\n");
+                        }
+                    }
+                } /* suppression of duplicates */
 
-                    /* suppress duplicates by packet window */
-                    if (dup_detect) {
-                        if (is_duplicate(buf, rec->rec_header.packet_header.caplen)) {
+                if (rec->presence_flags & WTAP_HAS_TS) {
+                    /* suppress duplicates by time window */
+                    if (dup_detect_by_time) {
+                        nstime_t current;
+
+                        current.secs  = rec->ts.secs;
+                        current.nsecs = rec->ts.nsecs;
+
+                        if (is_duplicate_rel_time(buf,
+                                                  rec->rec_header.packet_header.caplen,
+                                                  &current)) {
                             if (verbose) {
                                 fprintf(stderr, "Skipped: %u, Len: %u, MD5 Hash: ",
                                         count,
@@ -1666,198 +1841,165 @@ main(int argc, char *argv[])
                                 fprintf(stderr, "\n");
                             }
                         }
-                    } /* suppression of duplicates */
-
-                    if (rec->presence_flags & WTAP_HAS_TS) {
-                        /* suppress duplicates by time window */
-                        if (dup_detect_by_time) {
-                            nstime_t current;
+                    }
+                } /* suppress duplicates by time window */
+            }
 
-                            current.secs  = rec->ts.secs;
-                            current.nsecs = rec->ts.nsecs;
-
-                            if (is_duplicate_rel_time(buf,
-                                                      rec->rec_header.packet_header.caplen,
-                                                      &current)) {
-                                if (verbose) {
-                                    fprintf(stderr, "Skipped: %u, Len: %u, MD5 Hash: ",
-                                            count,
-                                            rec->rec_header.packet_header.caplen);
-                                    for (i = 0; i < 16; i++)
-                                        fprintf(stderr, "%02x",
-                                                (unsigned char)fd_hash[cur_dup_entry].digest[i]);
-                                    fprintf(stderr, "\n");
-                                }
-                                duplicate_count++;
-                                count++;
-                                continue;
-                            } else {
-                                if (verbose) {
-                                    fprintf(stderr, "Packet: %u, Len: %u, MD5 Hash: ",
-                                            count,
-                                            rec->rec_header.packet_header.caplen);
-                                    for (i = 0; i < 16; i++)
-                                        fprintf(stderr, "%02x",
-                                                (unsigned char)fd_hash[cur_dup_entry].digest[i]);
-                                    fprintf(stderr, "\n");
-                                }
-                            }
-                        }
-                    } /* suppress duplicates by time window */
+            /* Random error mutation */
+            do_mutation = FALSE;
+            caplen = 0;
+            if (err_prob > 0.0) {
+                switch (rec->rec_type) {
+
+                case REC_TYPE_PACKET:
+                    caplen = rec->rec_header.packet_header.caplen;
+                    do_mutation = TRUE;
+                    break;
+
+                case REC_TYPE_FT_SPECIFIC_EVENT:
+                case REC_TYPE_FT_SPECIFIC_REPORT:
+                    caplen = rec->rec_header.ft_specific_header.record_len;
+                    do_mutation = TRUE;
+                    break;
+
+                case REC_TYPE_SYSCALL:
+                    caplen = rec->rec_header.syscall_header.event_filelen;
+                    do_mutation = TRUE;
+                    break;
                 }
 
-                /* Random error mutation */
-                do_mutation = FALSE;
-                caplen = 0;
-                if (err_prob > 0.0) {
-                    switch (rec->rec_type) {
-
-                    case REC_TYPE_PACKET:
-                        caplen = rec->rec_header.packet_header.caplen;
-                        do_mutation = TRUE;
-                        break;
-
-                    case REC_TYPE_SYSCALL:
-                        caplen = rec->rec_header.syscall_header.event_filelen;
-                        do_mutation = TRUE;
-                        break;
-                    }
-
-                    if (change_offset > caplen) {
-                        fprintf(stderr, "change offset %u is longer than caplen %u in packet %u\n",
-                            change_offset, caplen, count);
-                        do_mutation = FALSE;
-                    }
+                if (change_offset > caplen) {
+                    fprintf(stderr, "change offset %u is longer than caplen %u in packet %u\n",
+                        change_offset, caplen, count);
+                    do_mutation = FALSE;
                 }
+            }
 
-                if (do_mutation) {
-                    int real_data_start = 0;
+            if (do_mutation) {
+                int real_data_start = 0;
 
-                    /* Protect non-protocol data */
-                    switch (rec->rec_type) {
+                /* Protect non-protocol data */
+                switch (rec->rec_type) {
 
-                    case REC_TYPE_PACKET:
-                        if (wtap_file_type_subtype(wth) == WTAP_FILE_TYPE_SUBTYPE_CATAPULT_DCT2000)
-                            real_data_start = find_dct2000_real_data(buf);
-                        break;
-                    }
+                case REC_TYPE_PACKET:
+                    if (wtap_file_type_subtype(wth) == WTAP_FILE_TYPE_SUBTYPE_CATAPULT_DCT2000)
+                        real_data_start = find_dct2000_real_data(buf);
+                    break;
+                }
 
-                    real_data_start += change_offset;
+                real_data_start += change_offset;
 
-                    for (i = real_data_start; i < (int) caplen; i++) {
-                        if (rand() <= err_prob * RAND_MAX) {
-                            err_type = rand() / (RAND_MAX / ERR_WT_TOTAL + 1);
+                for (i = real_data_start; i < (int) caplen; i++) {
+                    if (rand() <= err_prob * RAND_MAX) {
+                        err_type = rand() / (RAND_MAX / ERR_WT_TOTAL + 1);
 
-                            if (err_type < ERR_WT_BIT) {
-                                buf[i] ^= 1 << (rand() / (RAND_MAX / 8 + 1));
-                                err_type = ERR_WT_TOTAL;
-                            } else {
-                                err_type -= ERR_WT_BYTE;
-                            }
+                        if (err_type < ERR_WT_BIT) {
+                            buf[i] ^= 1 << (rand() / (RAND_MAX / 8 + 1));
+                            err_type = ERR_WT_TOTAL;
+                        } else {
+                            err_type -= ERR_WT_BYTE;
+                        }
 
-                            if (err_type < ERR_WT_BYTE) {
-                                buf[i] = rand() / (RAND_MAX / 255 + 1);
-                                err_type = ERR_WT_TOTAL;
-                            } else {
-                                err_type -= ERR_WT_BYTE;
-                            }
+                        if (err_type < ERR_WT_BYTE) {
+                            buf[i] = rand() / (RAND_MAX / 255 + 1);
+                            err_type = ERR_WT_TOTAL;
+                        } else {
+                            err_type -= ERR_WT_BYTE;
+                        }
 
-                            if (err_type < ERR_WT_ALNUM) {
-                                buf[i] = ALNUM_CHARS[rand() / (RAND_MAX / ALNUM_LEN + 1)];
-                                err_type = ERR_WT_TOTAL;
-                            } else {
-                                err_type -= ERR_WT_ALNUM;
-                            }
+                        if (err_type < ERR_WT_ALNUM) {
+                            buf[i] = ALNUM_CHARS[rand() / (RAND_MAX / ALNUM_LEN + 1)];
+                            err_type = ERR_WT_TOTAL;
+                        } else {
+                            err_type -= ERR_WT_ALNUM;
+                        }
 
-                            if (err_type < ERR_WT_FMT) {
-                                if ((unsigned int)i < caplen - 2)
-                                    g_strlcpy((char*) &buf[i], "%s", 2);
-                                err_type = ERR_WT_TOTAL;
-                            } else {
-                                err_type -= ERR_WT_FMT;
-                            }
+                        if (err_type < ERR_WT_FMT) {
+                            if ((unsigned int)i < caplen - 2)
+                                g_strlcpy((char*) &buf[i], "%s", 2);
+                            err_type = ERR_WT_TOTAL;
+                        } else {
+                            err_type -= ERR_WT_FMT;
+                        }
 
-                            if (err_type < ERR_WT_AA) {
-                                for (j = i; j < (int) caplen; j++)
-                                    buf[j] = 0xAA;
-                                i = caplen;
-                            }
+                        if (err_type < ERR_WT_AA) {
+                            for (j = i; j < (int) caplen; j++)
+                                buf[j] = 0xAA;
+                            i = caplen;
                         }
                     }
-                } /* random error mutation */
-
-                /* Find a packet comment we may need to write */
-                if (frames_user_comments) {
-                    const char *comment =
-                        (const char*)g_tree_lookup(frames_user_comments, GUINT_TO_POINTER(read_count));
-                    /* XXX: What about comment changed to no comment? */
-                    if (comment != NULL) {
-                        /* Copy and change rather than modify returned rec */
-                        temp_rec = *rec;
-                        temp_rec.opt_comment = g_strdup(comment);
-                        temp_rec.has_comment_changed = TRUE;
-                        rec = &temp_rec;
-                    } else {
-                        /* Copy and change rather than modify returned rec */
-                        temp_rec = *rec;
-                        temp_rec.has_comment_changed = FALSE;
-                        rec = &temp_rec;
-                    }
                 }
-
-                /* Attempt to dump out current frame to the output file */
-                if (!wtap_dump(pdh, rec, buf, &write_err, &write_err_info)) {
-                    cfile_write_failure_message("editcap", argv[optind],
-                                                filename,
-                                                write_err, write_err_info,
-                                                read_count,
-                                                out_file_type_subtype);
-                    ret = DUMP_ERROR;
-                    goto clean_exit;
+            } /* random error mutation */
+
+            /* Find a packet comment we may need to write */
+            if (frames_user_comments) {
+                const char *comment =
+                    (const char*)g_tree_lookup(frames_user_comments, GUINT_TO_POINTER(read_count));
+                /* XXX: What about comment changed to no comment? */
+                if (comment != NULL) {
+                    /* Copy and change rather than modify returned rec */
+                    temp_rec = *rec;
+                    temp_rec.opt_comment = g_strdup(comment);
+                    temp_rec.has_comment_changed = TRUE;
+                    rec = &temp_rec;
+                } else {
+                    /* Copy and change rather than modify returned rec */
+                    temp_rec = *rec;
+                    temp_rec.has_comment_changed = FALSE;
+                    rec = &temp_rec;
                 }
-                written_count++;
             }
-            count++;
-        }
-
-        g_free(fprefix);
-        g_free(fsuffix);
-
-        if (read_err != 0) {
-            /* Print a message noting that the read failed somewhere along the
-             * line. */
-            cfile_read_failure_message("editcap", argv[optind], read_err,
-                                       read_err_info);
-        }
 
-        if (!pdh) {
-            /* No valid packages found, open the outfile so we can write an
-             * empty header */
-            g_free (filename);
-            filename = g_strdup(argv[optind+1]);
-
-            pdh = editcap_dump_open(filename,
-                                    snaplen ? MIN(snaplen, wtap_snapshot_length(wth)): wtap_snapshot_length(wth),
-                                    shb_hdrs, idb_inf, nrb_hdrs, &write_err);
-            if (pdh == NULL) {
-                cfile_dump_open_failure_message("editcap", filename,
-                                                write_err,
-                                                out_file_type_subtype);
-                ret = INVALID_FILE;
+            /* Attempt to dump out current frame to the output file */
+            if (!wtap_dump(pdh, rec, buf, &write_err, &write_err_info)) {
+                cfile_write_failure_message("editcap", argv[optind],
+                                            filename,
+                                            write_err, write_err_info,
+                                            read_count,
+                                            out_file_type_subtype);
+                ret = DUMP_ERROR;
                 goto clean_exit;
             }
+            written_count++;
         }
+        count++;
+    }
 
-        if (!wtap_dump_close(pdh, &write_err)) {
-            cfile_close_failure_message(filename, write_err);
-            ret = WRITE_ERROR;
+    g_free(fprefix);
+    g_free(fsuffix);
+
+    if (read_err != 0) {
+        /* Print a message noting that the read failed somewhere along the
+         * line. */
+        cfile_read_failure_message("editcap", argv[optind], read_err,
+                                   read_err_info);
+    }
+
+    if (!pdh) {
+        /* No valid packages found, open the outfile so we can write an
+         * empty header */
+        g_free (filename);
+        filename = g_strdup(argv[optind+1]);
+
+        pdh = editcap_dump_open(filename, &params, &write_err);
+        if (pdh == NULL) {
+            cfile_dump_open_failure_message("editcap", filename,
+                                            write_err,
+                                            out_file_type_subtype);
+            ret = INVALID_FILE;
             goto clean_exit;
         }
-        g_free(filename);
+    }
 
-        if (frames_user_comments) {
-            g_tree_destroy(frames_user_comments);
-        }
+    if (!wtap_dump_close(pdh, &write_err)) {
+        cfile_close_failure_message(filename, write_err);
+        ret = WRITE_ERROR;
+        goto clean_exit;
+    }
+    g_free(filename);
+
+    if (frames_user_comments) {
+        g_tree_destroy(frames_user_comments);
     }
 
     if (dup_detect) {
@@ -1873,9 +2015,12 @@ main(int argc, char *argv[])
     }
 
 clean_exit:
-    wtap_block_array_free(shb_hdrs);
-    wtap_block_array_free(nrb_hdrs);
-    g_free(idb_inf);
+    if (dsb_filenames) {
+        g_array_free(dsb_types, TRUE);
+        g_ptr_array_free(dsb_filenames, TRUE);
+    }
+    g_free(params.idb_inf);
+    wtap_dump_params_cleanup(&params);
     if (wth != NULL)
         wtap_close(wth);
     wtap_cleanup();