Generate randpkt_core/doxygen.cfg.
[metze/wireshark/wip.git] / editcap.c
index 31a76f981e3f1dbdd0e0a0650c88e744eb6a56db..fdb80c8d09a3d3a398e76e79ae156cf67b91d57e 100644 (file)
--- a/editcap.c
+++ b/editcap.c
 #include <getopt.h>
 #endif
 
-#ifdef HAVE_SYS_TIME_H
-#include <sys/time.h>
-#endif
-
 #ifdef HAVE_LIBZ
 #include <zlib.h>     /* to get the libz version number */
 #endif
 
-#include "wtap.h"
+#include <wiretap/wtap.h>
+
+#include "epan/etypes.h"
 
-#ifndef HAVE_GETOPT
+#ifndef HAVE_GETOPT_LONG
 #include "wsutil/wsgetopt.h"
 #endif
 
 # include "wsutil/strptime.h"
 #endif
 
-#include <wsutil/privileges.h>
+#include <wsutil/crash_info.h>
 #include <wsutil/filesystem.h>
-#include <wsutil/report_err.h>
-#include <wsutil/strnatcmp.h>
 #include <wsutil/md5.h>
 #include <wsutil/plugins.h>
-#include <wsutil/crash_info.h>
-#include <wsutil/copyright_info.h>
-#include <wsutil/os_version_info.h>
+#include <wsutil/privileges.h>
+#include <wsutil/report_err.h>
+#include <wsutil/strnatcmp.h>
+#include <wsutil/str_util.h>
+#include <wsutil/ws_diag_control.h>
 #include <wsutil/ws_version_info.h>
 
-#include "version_info.h"
-
 #include "ringbuffer.h" /* For RINGBUFFER_MAX_NUM_FILES */
 
 /*
  */
 
 struct select_item {
-    int inclusive;
-    int first, second;
+    gboolean inclusive;
+    guint first, second;
 };
 
 /*
@@ -111,7 +107,7 @@ struct select_item {
 typedef struct _fd_hash_t {
     md5_byte_t digest[16];
     guint32    len;
-    nstime_t   time;
+    nstime_t   frame_time;
 } fd_hash_t;
 
 #define DEFAULT_DUP_DEPTH       5   /* Used with -d */
@@ -152,9 +148,13 @@ typedef struct _chop_t {
     int off_end_neg;
 } chop_t;
 
+
+/* Table of user comments */
+GTree *frames_user_comments = NULL;
+
 #define MAX_SELECTIONS 512
 static struct select_item     selectfrm[MAX_SELECTIONS];
-static int                    max_selected              = -1;
+static guint                  max_selected              = 0;
 static int                    keep_em                   = 0;
 #ifdef PCAP_NG_DEFAULT
 static int                    out_file_type_subtype     = WTAP_FILE_TYPE_SUBTYPE_PCAPNG; /* default to pcapng   */
@@ -169,6 +169,7 @@ static double                 err_prob                  = 0.0;
 static time_t                 starttime                 = 0;
 static time_t                 stoptime                  = 0;
 static gboolean               check_startstop           = FALSE;
+static gboolean               rem_vlan                  = FALSE;
 static gboolean               dup_detect                = FALSE;
 static gboolean               dup_detect_by_time        = FALSE;
 
@@ -264,12 +265,12 @@ fileset_extract_prefix_suffix(const char *fname, gchar **fprefix, gchar **fsuffi
 
 /* Add a selection item, a simple parser for now */
 static gboolean
-add_selection(char *sel)
+add_selection(char *sel, guint* max_selection)
 {
     char *locn;
     char *next;
 
-    if (++max_selected >= MAX_SELECTIONS) {
+    if (max_selected >= MAX_SELECTIONS) {
         /* Let the user know we stopped selecting */
         fprintf(stderr, "Out of room for packet selections!\n");
         return(FALSE);
@@ -282,8 +283,10 @@ add_selection(char *sel)
         if (verbose)
             fprintf(stderr, "Not inclusive ...");
 
-        selectfrm[max_selected].inclusive = 0;
-        selectfrm[max_selected].first = atoi(sel);
+        selectfrm[max_selected].inclusive = FALSE;
+        selectfrm[max_selected].first = (guint)strtoul(sel, NULL, 10);
+        if (selectfrm[max_selected].first < *max_selection)
+            *max_selection = selectfrm[max_selected].first;
 
         if (verbose)
             fprintf(stderr, " %i\n", selectfrm[max_selected].first);
@@ -292,26 +295,35 @@ add_selection(char *sel)
             fprintf(stderr, "Inclusive ...");
 
         next = locn + 1;
-        selectfrm[max_selected].inclusive = 1;
-        selectfrm[max_selected].first = atoi(sel);
-        selectfrm[max_selected].second = atoi(next);
+        selectfrm[max_selected].inclusive = TRUE;
+        selectfrm[max_selected].first = (guint)strtoul(sel, NULL, 10);
+        selectfrm[max_selected].second = (guint)strtoul(next, NULL, 10);
+
+        if (selectfrm[max_selected].second == 0)
+        {
+            /* Not a valid number, presume all */
+            selectfrm[max_selected].second = *max_selection = G_MAXUINT;
+        }
+        else if (selectfrm[max_selected].second < *max_selection)
+            *max_selection = selectfrm[max_selected].second;
 
         if (verbose)
             fprintf(stderr, " %i, %i\n", selectfrm[max_selected].first,
                    selectfrm[max_selected].second);
     }
 
+    max_selected++;
     return(TRUE);
 }
 
 /* Was the packet selected? */
 
 static int
-selected(int recno)
+selected(guint recno)
 {
-    int i;
+    guint i;
 
-    for (i = 0; i <= max_selected; i++) {
+    for (i = 0; i < max_selected; i++) {
         if (selectfrm[i].inclusive) {
             if (selectfrm[i].first <= recno && selectfrm[i].second >= recno)
                 return 1;
@@ -536,6 +548,34 @@ set_rel_time(char *optarg_str_p)
     relative_time_window.nsecs = (int)val;
 }
 
+#define LINUX_SLL_OFFSETP 14
+#define VLAN_SIZE 4
+static void
+sll_remove_vlan_info(guint8* fd, guint32* len) {
+    if (g_ntohs(*(fd + LINUX_SLL_OFFSETP)) == ETHERTYPE_VLAN) {
+        int rest_len;
+        /* point to start of vlan */
+        fd = fd + LINUX_SLL_OFFSETP;
+        /* bytes to read after vlan info */
+        rest_len = *len - (LINUX_SLL_OFFSETP + VLAN_SIZE);
+        /* remove vlan info from packet */
+        memmove(fd, fd + VLAN_SIZE, rest_len);
+        *len -= 4;
+    }
+}
+
+static void
+remove_vlan_info(const struct wtap_pkthdr *phdr, guint8* fd, guint32* len) {
+    switch (phdr->pkt_encap) {
+        case WTAP_ENCAP_SLL:
+            sll_remove_vlan_info(fd, len);
+            break;
+        default:
+            /* no support for current pkt_encap */
+            break;
+    }
+}
+
 static gboolean
 is_duplicate(guint8* fd, guint32 len) {
     int i;
@@ -595,8 +635,8 @@ is_duplicate_rel_time(guint8* fd, guint32 len, const nstime_t *current) {
     md5_finish(&ms, fd_hash[cur_dup_entry].digest);
 
     fd_hash[cur_dup_entry].len = len;
-    fd_hash[cur_dup_entry].time.secs = current->secs;
-    fd_hash[cur_dup_entry].time.nsecs = current->nsecs;
+    fd_hash[cur_dup_entry].frame_time.secs = current->secs;
+    fd_hash[cur_dup_entry].frame_time.nsecs = current->nsecs;
 
     /*
      * Look for relative time related duplicates.
@@ -634,7 +674,7 @@ is_duplicate_rel_time(guint8* fd, guint32 len, const nstime_t *current) {
             break;
         }
 
-        if (nstime_is_unset(&(fd_hash[i].time))) {
+        if (nstime_is_unset(&(fd_hash[i].frame_time))) {
             /*
              * We've decremented to an unused fd_hash[] entry.
              * Check no more!
@@ -642,7 +682,7 @@ is_duplicate_rel_time(guint8* fd, guint32 len, const nstime_t *current) {
             break;
         }
 
-        nstime_delta(&delta, current, &fd_hash[i].time);
+        nstime_delta(&delta, current, &fd_hash[i].frame_time);
 
         if (delta.secs < 0 || delta.nsecs < 0) {
             /*
@@ -684,20 +724,6 @@ is_duplicate_rel_time(guint8* fd, guint32 len, const nstime_t *current) {
     return FALSE;
 }
 
-static void
-show_version(GString *comp_info_str, GString *runtime_info_str)
-{
-    printf("Editcap (Wireshark) %s\n"
-           "\n"
-           "%s"
-           "\n"
-           "%s"
-           "\n"
-           "%s",
-           get_ws_vcs_version_info(), get_copyright_info(),
-           comp_info_str->str, runtime_info_str->str);
-}
-
 static void
 print_usage(FILE *output)
 {
@@ -715,6 +741,7 @@ print_usage(FILE *output)
     fprintf(output, "                         given time (format as YYYY-MM-DD hh:mm:ss).\n");
     fprintf(output, "\n");
     fprintf(output, "Duplicate packet removal:\n");
+    fprintf(output, "  --novlan                remove vlan info from packets before checking for duplicates.\n");
     fprintf(output, "  -d                     remove packet if duplicate (window == %d).\n", DEFAULT_DUP_DEPTH);
     fprintf(output, "  -D <dup window>        remove packet if duplicate; configurable <dup window>\n");
     fprintf(output, "                         Valid <dup window> values are 0 to %d.\n", MAX_DUP_DEPTH);
@@ -724,6 +751,7 @@ print_usage(FILE *output)
     fprintf(output, "                         LESS THAN <dup time window> prior to current packet.\n");
     fprintf(output, "                         A <dup time window> is specified in relative seconds\n");
     fprintf(output, "                         (e.g. 0.000001).\n");
+    fprintf(output, "  -a <framenum>:<comment>  Add or replace comment for given frame number\n");
     fprintf(output, "\n");
     fprintf(output, "  -I <bytes to ignore>   ignore the specified bytes at the beginning of\n");
     fprintf(output, "                         the frame during MD5 hash calculation\n");
@@ -749,7 +777,8 @@ print_usage(FILE *output)
     fprintf(output, "                         this option more than once, allowing up to 2 chopping\n");
     fprintf(output, "                         regions within a packet provided that at least 1\n");
     fprintf(output, "                         choplen is positive and at least 1 is negative.\n");
-    fprintf(output, "  -L                     adjust the frame length when chopping and/or snapping\n");
+    fprintf(output, "  -L                     adjust the frame (i.e. reported) length when chopping\n");
+    fprintf(output, "                         and/or snapping\n");
     fprintf(output, "  -t <time adjustment>   adjust the timestamp of each packet;\n");
     fprintf(output, "                         <time adjustment> is in relative seconds (e.g. -0.5).\n");
     fprintf(output, "  -S <strict adjustment> adjust timestamp of packets if necessary to insure\n");
@@ -762,6 +791,9 @@ print_usage(FILE *output)
     fprintf(output, "                         all packets to the timestamp of the first packet.\n");
     fprintf(output, "  -E <error probability> set the probability (between 0.0 and 1.0 incl.) that\n");
     fprintf(output, "                         a particular packet byte will be randomly changed.\n");
+    fprintf(output, "  -o <change offset>     When used in conjunction with -E, skip some bytes from the\n");
+    fprintf(output, "                         beginning of the packet. This allows one to preserve some\n");
+    fprintf(output, "                         bytes, in order to have some headers untouched.\n");
     fprintf(output, "\n");
     fprintf(output, "Output File(s):\n");
     fprintf(output, "  -c <packets per file>  split the packet output to different files based on\n");
@@ -852,6 +884,18 @@ list_encap_types(void) {
     g_free(encaps);
 }
 
+static int
+framenum_compare(gconstpointer a, gconstpointer b, gpointer user_data _U_)
+{
+    if (GPOINTER_TO_UINT(a) < GPOINTER_TO_UINT(b))
+        return -1;
+
+    if (GPOINTER_TO_UINT(a) > GPOINTER_TO_UINT(b))
+        return 1;
+
+    return 0;
+}
+
 #ifdef HAVE_PLUGINS
 /*
  *  Don't report failures to load plugins because most (non-wiretap) plugins
@@ -890,18 +934,42 @@ get_editcap_runtime_info(GString *str)
 #endif
 }
 
+static wtap_dumper *
+editcap_dump_open(const char *filename, guint32 snaplen,
+                  wtapng_section_t *shb_hdr,
+                  wtapng_iface_descriptions_t *idb_inf,
+                  wtapng_name_res_t *nrb_hdr, int *write_err)
+{
+  wtap_dumper *pdh;
+
+  if (strcmp(filename, "-") == 0) {
+    /* Write to the standard output. */
+    pdh = wtap_dump_open_stdout_ng(out_file_type_subtype, out_frame_type,
+                                   snaplen, FALSE /* compressed */,
+                                   shb_hdr, idb_inf, nrb_hdr,
+                                   write_err);
+  } else {
+    pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
+                            snaplen, FALSE /* compressed */,
+                            shb_hdr, idb_inf, nrb_hdr,
+                           write_err);
+  }
+  return pdh;
+}
+
 int
 main(int argc, char *argv[])
 {
     GString      *comp_info_str;
     GString      *runtime_info_str;
     wtap         *wth;
-    int           i, j, err;
-    gchar        *err_info;
+    int           i, j, read_err, write_err;
+    gchar        *read_err_info, *write_err_info;
     int           opt;
     static const struct option long_options[] = {
-        {(char *)"help", no_argument, NULL, 'h'},
-        {(char *)"version", no_argument, NULL, 'V'},
+        {"novlan", no_argument, NULL, 0x8100},
+        {"help", no_argument, NULL, 'h'},
+        {"version", no_argument, NULL, 'V'},
         {0, 0, 0, 0 }
     };
 
@@ -925,11 +993,13 @@ main(int argc, char *argv[])
     nstime_t      block_start;
     gchar        *fprefix            = NULL;
     gchar        *fsuffix            = NULL;
-
+    guint32       change_offset      = 0;
+    guint         max_packet_number  = G_MAXUINT;
     const struct wtap_pkthdr    *phdr;
-    struct wtap_pkthdr           snap_phdr;
-    wtapng_iface_descriptions_t *idb_inf;
-    wtapng_section_t            *shb_hdr;
+    struct wtap_pkthdr           temp_phdr;
+    wtapng_iface_descriptions_t *idb_inf = NULL;
+    wtapng_section_t            *shb_hdr = NULL;
+    wtapng_name_res_t           *nrb_hdr = NULL;
 
 #ifdef HAVE_PLUGINS
     char* init_progfile_dir_error;
@@ -940,13 +1010,11 @@ main(int argc, char *argv[])
     create_app_running_mutex();
 #endif /* _WIN32 */
 
-    /* Assemble the compile-time version information string */
-    comp_info_str = g_string_new("Compiled ");
-    get_compiled_version_info(comp_info_str, NULL, get_editcap_compiled_info);
+    /* Get the compile-time version information string */
+    comp_info_str = get_compiled_version_info(NULL, get_editcap_compiled_info);
 
-    /* Assemble the run-time version information string */
-    runtime_info_str = g_string_new("Running ");
-    get_runtime_version_info(runtime_info_str, get_editcap_runtime_info);
+    /* Get the run-time version information string */
+    runtime_info_str = get_runtime_version_info(get_editcap_runtime_info);
 
     /* Add it to the information to be reported on a crash. */
     ws_add_crash_info("Editcap (Wireshark) %s\n"
@@ -983,8 +1051,35 @@ main(int argc, char *argv[])
 #endif
 
     /* Process the options */
-    while ((opt = getopt_long(argc, argv, "A:B:c:C:dD:E:F:hi:I:Lrs:S:t:T:vVw:", long_options, NULL)) != -1) {
+    while ((opt = getopt_long(argc, argv, "a:A:B:c:C:dD:E:F:hi:I:Lo:rs:S:t:T:vVw:", long_options, NULL)) != -1) {
         switch (opt) {
+        case 0x8100:
+        {
+            rem_vlan = TRUE;
+            break;
+        }
+
+        case 'a':
+        {
+            guint frame_number;
+            gint string_start_index = 0;
+
+            if ((sscanf(optarg, "%u:%n", &frame_number, &string_start_index) < 1) || (string_start_index == 0)) {
+                fprintf(stderr, "editcap: \"%s\" isn't a valid <frame>:<comment>\n\n",
+                        optarg);
+                exit(1);
+            }
+
+            /* Lazily create the table */
+            if (!frames_user_comments) {
+                frames_user_comments = g_tree_new_full(framenum_compare, NULL, NULL, g_free);
+            }
+
+            /* Insert this entry (framenum -> comment) */
+            g_tree_replace(frames_user_comments, GUINT_TO_POINTER(frame_number), g_strdup(optarg+string_start_index));
+            break;
+        }
+
         case 'A':
         {
             struct tm starttm;
@@ -1094,7 +1189,7 @@ main(int argc, char *argv[])
             break;
 
         case 'E':
-            err_prob = strtod(optarg, &p);
+            err_prob = g_ascii_strtod(optarg, &p);
             if (p == optarg || err_prob < 0.0 || err_prob > 1.0) {
                 fprintf(stderr, "editcap: probability \"%s\" must be between 0.0 and 1.0\n",
                         optarg);
@@ -1116,7 +1211,7 @@ main(int argc, char *argv[])
         case 'h':
             printf("Editcap (Wireshark) %s\n"
                    "Edit and/or translate the format of capture files.\n"
-                   "See http://www.wireshark.org for more information.\n",
+                   "See https://www.wireshark.org for more information.\n",
                get_ws_vcs_version_info());
             print_usage(stdout);
             exit(0);
@@ -1143,6 +1238,10 @@ main(int argc, char *argv[])
             adjlen = TRUE;
             break;
 
+        case 'o':
+            change_offset = (guint32)strtol(optarg, &p, 10);
+            break;
+
         case 'r':
             keep_em = !keep_em;  /* Just invert */
             break;
@@ -1180,7 +1279,7 @@ main(int argc, char *argv[])
             break;
 
         case 'V':
-            show_version(comp_info_str, runtime_info_str);
+            show_version("Editcap (Wireshark)", comp_info_str, runtime_info_str);
             g_string_free(comp_info_str, TRUE);
             g_string_free(runtime_info_str, TRUE);
             exit(0);
@@ -1208,7 +1307,7 @@ main(int argc, char *argv[])
             exit(1);
             break;
         }
-    }
+    } /* processing commmand-line options */
 
 #ifdef DEBUG
     fprintf(stderr, "Optind = %i, argc = %i\n", optind, argc);
@@ -1244,18 +1343,14 @@ main(int argc, char *argv[])
         exit(1);
     }
 
-    wth = wtap_open_offline(argv[optind], WTAP_TYPE_AUTO, &err, &err_info, FALSE);
+    wth = wtap_open_offline(argv[optind], WTAP_TYPE_AUTO, &read_err, &read_err_info, FALSE);
 
     if (!wth) {
         fprintf(stderr, "editcap: Can't open %s: %s\n", argv[optind],
-                wtap_strerror(err));
-        switch (err) {
-        case WTAP_ERR_UNSUPPORTED:
-        case WTAP_ERR_UNSUPPORTED_ENCAP:
-        case WTAP_ERR_BAD_FILE:
-            fprintf(stderr, "(%s)\n", err_info);
-            g_free(err_info);
-            break;
+                wtap_strerror(read_err));
+        if (read_err_info != NULL) {
+            fprintf(stderr, "(%s)\n", read_err_info);
+            g_free(read_err_info);
         }
         exit(2);
     }
@@ -1265,8 +1360,9 @@ main(int argc, char *argv[])
                 wtap_file_type_subtype_string(wtap_file_type_subtype(wth)));
     }
 
-    shb_hdr = wtap_file_get_shb_info(wth);
+    shb_hdr = wtap_file_get_shb_for_new_file(wth);
     idb_inf = wtap_file_get_idb_info(wth);
+    nrb_hdr = wtap_file_get_nrb_for_new_file(wth);
 
     /*
      * Now, process the rest, if any ... we only write if there is an extra
@@ -1278,26 +1374,34 @@ main(int argc, char *argv[])
             out_frame_type = wtap_file_encap(wth);
 
         for (i = optind + 2; i < argc; i++)
-            if (add_selection(argv[i]) == FALSE)
+            if (add_selection(argv[i], &max_packet_number) == FALSE)
                 break;
 
+        if (keep_em == FALSE)
+            max_packet_number = G_MAXUINT;
+
         if (dup_detect || dup_detect_by_time) {
             for (i = 0; i < dup_window; i++) {
                 memset(&fd_hash[i].digest, 0, 16);
                 fd_hash[i].len = 0;
-                nstime_set_unset(&fd_hash[i].time);
+                nstime_set_unset(&fd_hash[i].frame_time);
             }
         }
 
-        while (wtap_read(wth, &err, &err_info, &data_offset)) {
+        /* Read all of the packets in turn */
+        while (wtap_read(wth, &read_err, &read_err_info, &data_offset)) {
+            if (max_packet_number <= read_count)
+                break;
+
             read_count++;
 
             phdr = wtap_phdr(wth);
 
-            if (read_count == 1) {  /* the first packet */
+            /* Extra actions for the first packet */
+            if (read_count == 1) {
                 if (split_packet_count > 0 || secs_per_block > 0) {
                     if (!fileset_extract_prefix_suffix(argv[optind+1], &fprefix, &fsuffix))
-                        exit(2);
+                        goto error_on_exit;
 
                     filename = fileset_get_filename_by_pattern(block_cnt++, phdr, fprefix, fsuffix);
                 } else {
@@ -1310,16 +1414,17 @@ main(int argc, char *argv[])
                     shb_hdr->shb_user_appl = g_strdup("Editcap " VERSION);
                 }
 
-                pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
+                pdh = editcap_dump_open(filename,
                                         snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                        FALSE /* compressed */, shb_hdr, idb_inf, &err);
+                                        shb_hdr, idb_inf, nrb_hdr, &write_err);
 
                 if (pdh == NULL) {
                     fprintf(stderr, "editcap: Can't open or create %s: %s\n",
-                            filename, wtap_strerror(err));
-                    exit(2);
+                            filename, wtap_strerror(write_err));
+                    goto error_on_exit;
                 }
-            }
+            } /* first packet only handling */
+
 
             buf = wtap_buf_ptr(wth);
 
@@ -1329,8 +1434,7 @@ main(int argc, char *argv[])
              */
             if (phdr->presence_flags & WTAP_HAS_TS) {
                 if (nstime_is_unset(&block_start)) {
-                    block_start.secs = phdr->ts.secs;
-                    block_start.nsecs = phdr->ts.nsecs;
+                    block_start = phdr->ts;
                 }
 
                 if (secs_per_block > 0) {
@@ -1338,10 +1442,10 @@ main(int argc, char *argv[])
                            || (phdr->ts.secs - block_start.secs == secs_per_block
                                && phdr->ts.nsecs >= block_start.nsecs )) { /* time for the next file */
 
-                        if (!wtap_dump_close(pdh, &err)) {
+                        if (!wtap_dump_close(pdh, &write_err)) {
                             fprintf(stderr, "editcap: Error writing to %s: %s\n",
-                                    filename, wtap_strerror(err));
-                            exit(2);
+                                    filename, wtap_strerror(write_err));
+                            goto error_on_exit;
                         }
                         block_start.secs = block_start.secs +  secs_per_block; /* reset for next interval */
                         g_free(filename);
@@ -1351,26 +1455,26 @@ main(int argc, char *argv[])
                         if (verbose)
                             fprintf(stderr, "Continuing writing in file %s\n", filename);
 
-                        pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
+                        pdh = editcap_dump_open(filename,
                                                 snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                                FALSE /* compressed */, shb_hdr, idb_inf, &err);
+                                                shb_hdr, idb_inf, nrb_hdr, &write_err);
 
                         if (pdh == NULL) {
                             fprintf(stderr, "editcap: Can't open or create %s: %s\n",
-                                    filename, wtap_strerror(err));
-                            exit(2);
+                                    filename, wtap_strerror(write_err));
+                            goto error_on_exit;
                         }
                     }
                 }
-            }
+            }  /* time stamp handling */
 
             if (split_packet_count > 0) {
                 /* time for the next file? */
                 if (written_count > 0 && written_count % split_packet_count == 0) {
-                    if (!wtap_dump_close(pdh, &err)) {
+                    if (!wtap_dump_close(pdh, &write_err)) {
                         fprintf(stderr, "editcap: Error writing to %s: %s\n",
-                                filename, wtap_strerror(err));
-                        exit(2);
+                                filename, wtap_strerror(write_err));
+                        goto error_on_exit;
                     }
 
                     g_free(filename);
@@ -1380,16 +1484,16 @@ main(int argc, char *argv[])
                     if (verbose)
                         fprintf(stderr, "Continuing writing in file %s\n", filename);
 
-                    pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
+                    pdh = editcap_dump_open(filename,
                                             snaplen ? MIN(snaplen, wtap_snapshot_length(wth)) : wtap_snapshot_length(wth),
-                                            FALSE /* compressed */, shb_hdr, idb_inf, &err);
+                                            shb_hdr, idb_inf, nrb_hdr, &write_err);
                     if (pdh == NULL) {
                         fprintf(stderr, "editcap: Can't open or create %s: %s\n",
-                                filename, wtap_strerror(err));
-                        exit(2);
+                                filename, wtap_strerror(write_err));
+                        goto error_on_exit;
                     }
                 }
-            }
+            } /* split packet handling */
 
             if (check_startstop) {
                 /*
@@ -1420,22 +1524,26 @@ main(int argc, char *argv[])
                 phdr = wtap_phdr(wth);
 
                 if (snaplen != 0) {
+                    /* Limit capture length to snaplen */
                     if (phdr->caplen > snaplen) {
-                        snap_phdr = *phdr;
-                        snap_phdr.caplen = snaplen;
-                        phdr = &snap_phdr;
+                        /* Copy and change rather than modify returned phdr */
+                        temp_phdr = *phdr;
+                        temp_phdr.caplen = snaplen;
+                        phdr = &temp_phdr;
                     }
+                    /* If -L, also set reported length to snaplen */
                     if (adjlen && phdr->len > snaplen) {
-                        snap_phdr = *phdr;
-                        snap_phdr.len = snaplen;
-                        phdr = &snap_phdr;
+                        /* Copy and change rather than modify returned phdr */
+                        temp_phdr = *phdr;
+                        temp_phdr.len = snaplen;
+                        phdr = &temp_phdr;
                     }
                 }
 
                 /* CHOP */
-                snap_phdr = *phdr;
-                handle_chopping(chop, &snap_phdr, phdr, &buf, adjlen);
-                phdr = &snap_phdr;
+                temp_phdr = *phdr;
+                handle_chopping(chop, &temp_phdr, phdr, &buf, adjlen);
+                phdr = &temp_phdr;
 
                 if (phdr->presence_flags & WTAP_HAS_TS) {
                     /* Do we adjust timestamps to ensure strict chronological
@@ -1446,8 +1554,7 @@ main(int argc, char *argv[])
                                 nstime_t current;
                                 nstime_t delta;
 
-                                current.secs = phdr->ts.secs;
-                                current.nsecs = phdr->ts.nsecs;
+                                current = phdr->ts;
 
                                 nstime_delta(&delta, &current, &previous_time);
 
@@ -1460,17 +1567,17 @@ main(int argc, char *argv[])
                                      * chronological order (oldest to newest).
                                      */
                                     /* fprintf(stderr, "++out of order, need to adjust this packet!\n"); */
-                                    snap_phdr = *phdr;
-                                    snap_phdr.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
-                                    snap_phdr.ts.nsecs = previous_time.nsecs;
-                                    if (snap_phdr.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
+                                    temp_phdr = *phdr;
+                                    temp_phdr.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
+                                    temp_phdr.ts.nsecs = previous_time.nsecs;
+                                    if (temp_phdr.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
                                         /* carry */
-                                        snap_phdr.ts.secs++;
-                                        snap_phdr.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
+                                        temp_phdr.ts.secs++;
+                                        temp_phdr.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
                                     } else {
-                                        snap_phdr.ts.nsecs += strict_time_adj.tv.nsecs;
+                                        temp_phdr.ts.nsecs += strict_time_adj.tv.nsecs;
                                     }
-                                    phdr = &snap_phdr;
+                                    phdr = &temp_phdr;
                                 }
                             } else {
                                 /*
@@ -1478,55 +1585,56 @@ main(int argc, char *argv[])
                                  * Unconditionally set each timestamp to previous
                                  * packet's timestamp plus delta.
                                  */
-                                snap_phdr = *phdr;
-                                snap_phdr.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
-                                snap_phdr.ts.nsecs = previous_time.nsecs;
-                                if (snap_phdr.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
+                                temp_phdr = *phdr;
+                                temp_phdr.ts.secs = previous_time.secs + strict_time_adj.tv.secs;
+                                temp_phdr.ts.nsecs = previous_time.nsecs;
+                                if (temp_phdr.ts.nsecs + strict_time_adj.tv.nsecs > ONE_BILLION) {
                                     /* carry */
-                                    snap_phdr.ts.secs++;
-                                    snap_phdr.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
+                                    temp_phdr.ts.secs++;
+                                    temp_phdr.ts.nsecs += strict_time_adj.tv.nsecs - ONE_BILLION;
                                 } else {
-                                    snap_phdr.ts.nsecs += strict_time_adj.tv.nsecs;
+                                    temp_phdr.ts.nsecs += strict_time_adj.tv.nsecs;
                                 }
-                                phdr = &snap_phdr;
+                                phdr = &temp_phdr;
                             }
                         }
-                        previous_time.secs = phdr->ts.secs;
-                        previous_time.nsecs = phdr->ts.nsecs;
+                        previous_time = phdr->ts;
                     }
 
-                    /* assume that if the frame's tv_sec is 0, then
-                     * the timestamp isn't supported */
-                    if (phdr->ts.secs > 0 && time_adj.tv.secs != 0) {
-                        snap_phdr = *phdr;
+                    if (time_adj.tv.secs != 0) {
+                        temp_phdr = *phdr;
                         if (time_adj.is_negative)
-                            snap_phdr.ts.secs -= time_adj.tv.secs;
+                            temp_phdr.ts.secs -= time_adj.tv.secs;
                         else
-                            snap_phdr.ts.secs += time_adj.tv.secs;
-                        phdr = &snap_phdr;
+                            temp_phdr.ts.secs += time_adj.tv.secs;
+                        phdr = &temp_phdr;
                     }
 
-                    /* assume that if the frame's tv_sec is 0, then
-                     * the timestamp isn't supported */
-                    if (phdr->ts.secs > 0 && time_adj.tv.nsecs != 0) {
-                        snap_phdr = *phdr;
+                    if (time_adj.tv.nsecs != 0) {
+                        temp_phdr = *phdr;
                         if (time_adj.is_negative) { /* subtract */
-                            if (snap_phdr.ts.nsecs < time_adj.tv.nsecs) { /* borrow */
-                                snap_phdr.ts.secs--;
-                                snap_phdr.ts.nsecs += ONE_BILLION;
+                            if (temp_phdr.ts.nsecs < time_adj.tv.nsecs) { /* borrow */
+                                temp_phdr.ts.secs--;
+                                temp_phdr.ts.nsecs += ONE_BILLION;
                             }
-                            snap_phdr.ts.nsecs -= time_adj.tv.nsecs;
+                            temp_phdr.ts.nsecs -= time_adj.tv.nsecs;
                         } else {                  /* add */
-                            if (snap_phdr.ts.nsecs + time_adj.tv.nsecs > ONE_BILLION) {
+                            if (temp_phdr.ts.nsecs + time_adj.tv.nsecs > ONE_BILLION) {
                                 /* carry */
-                                snap_phdr.ts.secs++;
-                                snap_phdr.ts.nsecs += time_adj.tv.nsecs - ONE_BILLION;
+                                temp_phdr.ts.secs++;
+                                temp_phdr.ts.nsecs += time_adj.tv.nsecs - ONE_BILLION;
                             } else {
-                                snap_phdr.ts.nsecs += time_adj.tv.nsecs;
+                                temp_phdr.ts.nsecs += time_adj.tv.nsecs;
                             }
                         }
-                        phdr = &snap_phdr;
+                        phdr = &temp_phdr;
                     }
+                } /* time stamp adjustment */
+
+                /* remove vlan info */
+                if (rem_vlan) {
+                    /* TODO: keep casting const like this? change pointer instead of value? */
+                    remove_vlan_info(phdr, buf, (guint32 *) &phdr->caplen);
                 }
 
                 /* suppress duplicates by packet window */
@@ -1553,7 +1661,7 @@ main(int argc, char *argv[])
                             fprintf(stderr, "\n");
                         }
                     }
-                }
+                } /* suppression of duplicates */
 
                 if (phdr->presence_flags & WTAP_HAS_TS) {
                     /* suppress duplicates by time window */
@@ -1586,16 +1694,23 @@ main(int argc, char *argv[])
                             }
                         }
                     }
+                } /* suppress duplicates by time window */
+
+                if (change_offset > phdr->caplen) {
+                    fprintf(stderr, "change offset %u is longer than caplen %u in packet %u\n",
+                        change_offset, phdr->caplen, count);
                 }
 
                 /* Random error mutation */
-                if (err_prob > 0.0) {
+                if (err_prob > 0.0 && change_offset <= phdr->caplen) {
                     int real_data_start = 0;
 
                     /* Protect non-protocol data */
                     if (wtap_file_type_subtype(wth) == WTAP_FILE_TYPE_SUBTYPE_CATAPULT_DCT2000)
                         real_data_start = find_dct2000_real_data(buf);
 
+                    real_data_start += change_offset;
+
                     for (i = real_data_start; i < (int) phdr->caplen; i++) {
                         if (rand() <= err_prob * RAND_MAX) {
                             err_type = rand() / (RAND_MAX / ERR_WT_TOTAL + 1);
@@ -1636,11 +1751,24 @@ main(int argc, char *argv[])
                             }
                         }
                     }
+                } /* random error mutation */
+
+                /* Find a packet comment we may need to write */
+                if (frames_user_comments) {
+                    const char *comment =
+                        (const char*)g_tree_lookup(frames_user_comments, GUINT_TO_POINTER(read_count));
+                    if (comment != NULL) {
+                        /* Copy and change rather than modify returned phdr */
+                        temp_phdr = *phdr;
+                        temp_phdr.opt_comment = g_strdup(comment);
+                        phdr = &temp_phdr;
+                    }
                 }
 
-                if (!wtap_dump(pdh, phdr, buf, &err)) {
-                    switch (err) {
-                    case WTAP_ERR_UNSUPPORTED_ENCAP:
+                /* Attempt to dump out current frame to the output file */
+                if (!wtap_dump(pdh, phdr, buf, &write_err, &write_err_info)) {
+                    switch (write_err) {
+                    case WTAP_ERR_UNWRITABLE_ENCAP:
                         /*
                          * This is a problem with the particular frame we're
                          * writing and the file type and subtype we're
@@ -1648,7 +1776,7 @@ main(int argc, char *argv[])
                          * and file type/subtype.
                          */
                         fprintf(stderr,
-                                "editcap: Frame %u of \"%s\" has a network type that can't be saved in a \"%s\" file\n.",
+                                "editcap: Frame %u of \"%s\" has a network type that can't be saved in a \"%s\" file.\n",
                                 read_count, argv[optind],
                                 wtap_file_type_subtype_string(out_file_type_subtype));
                         break;
@@ -1661,17 +1789,45 @@ main(int argc, char *argv[])
                          * and file type/subtype.
                          */
                         fprintf(stderr,
-                                "editcap: Frame %u of \"%s\" is too large for a \"%s\" file\n.",
+                                "editcap: Frame %u of \"%s\" is too large for a \"%s\" file.\n",
+                                read_count, argv[optind],
+                                wtap_file_type_subtype_string(out_file_type_subtype));
+                        break;
+
+                    case WTAP_ERR_UNWRITABLE_REC_TYPE:
+                        /*
+                         * This is a problem with the particular record we're
+                         * writing and the file type and subtype we're
+                         * writing; note that, and report the record number
+                         * and file type/subtype.
+                         */
+                        fprintf(stderr,
+                                "editcap: Record %u of \"%s\" has a record type that can't be saved in a \"%s\" file.\n",
                                 read_count, argv[optind],
                                 wtap_file_type_subtype_string(out_file_type_subtype));
                         break;
 
+                    case WTAP_ERR_UNWRITABLE_REC_DATA:
+                        /*
+                         * This is a problem with the particular record we're
+                         * writing and the file type and subtype we're
+                         * writing; note that, and report the record number
+                         * and file type/subtype.
+                         */
+                        fprintf(stderr,
+                                "editcap: Record %u of \"%s\" has data that can't be saved in a \"%s\" file.\n(%s)\n",
+                                read_count, argv[optind],
+                                wtap_file_type_subtype_string(out_file_type_subtype),
+                                write_err_info != NULL ? write_err_info : "no information supplied");
+                        g_free(write_err_info);
+                        break;
+
                     default:
                         fprintf(stderr, "editcap: Error writing to %s: %s\n",
-                                filename, wtap_strerror(err));
+                                filename, wtap_strerror(write_err));
                         break;
                     }
-                    exit(2);
+                    goto error_on_exit;
                 }
                 written_count++;
             }
@@ -1681,19 +1837,15 @@ main(int argc, char *argv[])
         g_free(fprefix);
         g_free(fsuffix);
 
-        if (err != 0) {
+        if (read_err != 0) {
             /* Print a message noting that the read failed somewhere along the
              * line. */
             fprintf(stderr,
                     "editcap: An error occurred while reading \"%s\": %s.\n",
-                    argv[optind], wtap_strerror(err));
-            switch (err) {
-            case WTAP_ERR_UNSUPPORTED:
-            case WTAP_ERR_UNSUPPORTED_ENCAP:
-            case WTAP_ERR_BAD_FILE:
-                fprintf(stderr, "(%s)\n", err_info);
-                g_free(err_info);
-                break;
+                    argv[optind], wtap_strerror(read_err));
+            if (read_err_info != NULL) {
+                fprintf(stderr, "(%s)\n", read_err_info);
+                g_free(read_err_info);
             }
         }
 
@@ -1703,26 +1855,33 @@ main(int argc, char *argv[])
             g_free (filename);
             filename = g_strdup(argv[optind+1]);
 
-            pdh = wtap_dump_open_ng(filename, out_file_type_subtype, out_frame_type,
+            pdh = editcap_dump_open(filename,
                                     snaplen ? MIN(snaplen, wtap_snapshot_length(wth)): wtap_snapshot_length(wth),
-                                    FALSE /* compressed */, shb_hdr, idb_inf, &err);
+                                    shb_hdr, idb_inf, nrb_hdr, &write_err);
             if (pdh == NULL) {
                 fprintf(stderr, "editcap: Can't open or create %s: %s\n",
-                        filename, wtap_strerror(err));
-                exit(2);
+                        filename, wtap_strerror(write_err));
+                goto error_on_exit;
             }
         }
 
         g_free(idb_inf);
         idb_inf = NULL;
 
-        if (!wtap_dump_close(pdh, &err)) {
+        if (!wtap_dump_close(pdh, &write_err)) {
             fprintf(stderr, "editcap: Error writing to %s: %s\n", filename,
-                    wtap_strerror(err));
-            exit(2);
+                    wtap_strerror(write_err));
+            goto error_on_exit;
         }
-        g_free(shb_hdr);
+        wtap_free_shb(shb_hdr);
+        shb_hdr = NULL;
+        wtap_free_nrb(nrb_hdr);
+        nrb_hdr = NULL;
         g_free(filename);
+
+        if (frames_user_comments) {
+            g_tree_destroy(frames_user_comments);
+        }
     }
 
     if (dup_detect) {
@@ -1738,6 +1897,12 @@ main(int argc, char *argv[])
     }
 
     return 0;
+
+error_on_exit:
+    wtap_free_shb(shb_hdr);
+    wtap_free_nrb(nrb_hdr);
+    g_free(idb_inf);
+    exit(2);
 }
 
 /* Skip meta-information read from file to return offset of real