added compression support for capture file output. The Save/As dialog now has a check...

[obnox/wireshark/wip.git] / wiretap / libpcap.c

diff --git a/wiretap/libpcap.c b/wiretap/libpcap.c
index cdace5f5224cc925408932bee3432248e13595b7..7226f78585b2d3be249b4fa397e00c3b623a6d0b 100644 (file)
--- a/wiretap/libpcap.c
+++ b/wiretap/libpcap.c
@@ -1,6 +1,6 @@
 /* libpcap.c
  *
 /* libpcap.c
  *

- * $Id: libpcap.c,v 1.102 2003/12/18 19:07:13 guy Exp $
+ * $Id$

  *
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
  *
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>


@@ -24,6 +24,10 @@
 #include "config.h"
 #endif
 
 #include "config.h"
 #endif
 

+#ifdef HAVE_PCAP_H
+#include <pcap.h>
+#endif
+

 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>


@@ -37,12 +41,11 @@
 # ifdef HAVE_SYS_TYPES_H
 #   include <sys/types.h>
 # endif
 # ifdef HAVE_SYS_TYPES_H
 #   include <sys/types.h>
 # endif

-#include <pcap.h>

 #include "wtap-capture.h"
 #endif
 
 /*
 #include "wtap-capture.h"
 #endif
 
 /*

- * The link-layer header on ATM packets.
+ * The link-layer header on SunATM packets.

  */
 struct sunatm_hdr {
        guint8  flags;          /* destination and traffic type */
  */
 struct sunatm_hdr {
        guint8  flags;          /* destination and traffic type */


@@ -50,6 +53,15 @@ struct sunatm_hdr {
        guint16 vci;            /* VCI */
 };
 
        guint16 vci;            /* VCI */
 };
 

+/*
+ * The link-layer header on Nokia IPSO ATM packets.
+ */
+struct nokiaatm_hdr {
+       guint8  flags;          /* destination */
+       guint8  vpi;            /* VPI */
+       guint16 vci;            /* VCI */
+};
+

 /*
  * The fake link-layer header of IrDA packets as introduced by Jean Tourrilhes
  * to libpcap.
 /*
  * The fake link-layer header of IrDA packets as introduced by Jean Tourrilhes
  * to libpcap.


@@ -60,6 +72,15 @@ struct irda_sll_hdr {
     guint16 sll_protocol;   /* protocol, should be 0x0017 */
 };
 
     guint16 sll_protocol;   /* protocol, should be 0x0017 */
 };
 

+/*
+ * A header containing additional MTP information.
+ */
+struct mtp2_hdr {
+       guint8  sent;
+       guint8  annex_a_used;
+       guint16 link_number;
+};
+

 /* See source to the "libpcap" library for information on the "libpcap"
    file format. */
 
 /* See source to the "libpcap" library for information on the "libpcap"
    file format. */
 


@@ -76,20 +97,28 @@ typedef enum {
 } libpcap_try_t;
 static libpcap_try_t libpcap_try(wtap *wth, int *err);
 
 } libpcap_try_t;
 static libpcap_try_t libpcap_try(wtap *wth, int *err);
 

-static gboolean libpcap_read(wtap *wth, int *err, long *data_offset);
+static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
+    long *data_offset);

 static gboolean libpcap_seek_read(wtap *wth, long seek_off,
 static gboolean libpcap_seek_read(wtap *wth, long seek_off,

-    union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err);
-static int libpcap_read_header(wtap *wth, int *err,
-    struct pcaprec_ss990915_hdr *hdr, gboolean silent);
+    union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+    int *err, gchar **err_info);
+static int libpcap_read_header(wtap *wth, int *err, gchar **err_info,
+    struct pcaprec_ss990915_hdr *hdr);

 static void adjust_header(wtap *wth, struct pcaprec_hdr *hdr);
 static void adjust_header(wtap *wth, struct pcaprec_hdr *hdr);

-static void libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
+static void libpcap_get_sunatm_pseudoheader(const struct sunatm_hdr *atm_phdr,

     union wtap_pseudo_header *pseudo_header);
     union wtap_pseudo_header *pseudo_header);

-static gboolean libpcap_read_atm_pseudoheader(FILE_T fh,
+static gboolean libpcap_read_sunatm_pseudoheader(FILE_T fh,

     union wtap_pseudo_header *pseudo_header, int *err);
     union wtap_pseudo_header *pseudo_header, int *err);

-static gboolean libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+static gboolean libpcap_read_nokiaatm_pseudoheader(FILE_T fh,

     union wtap_pseudo_header *pseudo_header, int *err);
     union wtap_pseudo_header *pseudo_header, int *err);

+static gboolean libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);

 static gboolean libpcap_read_irda_pseudoheader(FILE_T fh,
 static gboolean libpcap_read_irda_pseudoheader(FILE_T fh,

-    union wtap_pseudo_header *pseudo_header, int *err);
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
+static gboolean libpcap_get_mtp2_pseudoheader(const struct mtp2_hdr *mtp2_hdr,
+    union wtap_pseudo_header *pseudo_header);
+static gboolean libpcap_read_mtp2_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);

 static gboolean libpcap_read_rec_data(FILE_T fh, guchar *pd, int length,
     int *err);
 static void libpcap_close(wtap *wth);
 static gboolean libpcap_read_rec_data(FILE_T fh, guchar *pd, int length,
     int *err);
 static void libpcap_close(wtap *wth);


@@ -152,6 +181,8 @@ static const struct {
        { 10,           WTAP_ENCAP_FDDI },
 #endif
 
        { 10,           WTAP_ENCAP_FDDI },
 #endif
 

+       { 32,           WTAP_ENCAP_REDBACK },
+

        /*
         * 50 is DLT_PPP_SERIAL in NetBSD; it appears that DLT_PPP
         * on BSD (at least according to standard tcpdump) has, as
        /*
         * 50 is DLT_PPP_SERIAL in NetBSD; it appears that DLT_PPP
         * on BSD (at least according to standard tcpdump) has, as


@@ -211,6 +242,14 @@ static const struct {
         */
        { 50,           WTAP_ENCAP_PPP },
 
         */
        { 50,           WTAP_ENCAP_PPP },
 

+       /*
+        * Apparently used by the Axent Raptor firewall (now Symantec
+        * Enterprise Firewall).
+        * Thanks, Axent, for not reserving that type with tcpdump.org
+        * and not telling anybody about it.
+        */
+       { 99,           WTAP_ENCAP_SYMANTEC },
+

        /*
         * These are the values that libpcap 0.5 and later use in
         * capture file headers, in an attempt to work around the
        /*
         * These are the values that libpcap 0.5 and later use in
         * capture file headers, in an attempt to work around the


@@ -265,21 +304,79 @@ static const struct {
        { 121,          WTAP_ENCAP_HHDLC },     /* HiPath HDLC */
        { 122,          WTAP_ENCAP_IP_OVER_FC },   /* RFC 2625 IP-over-FC */
        { 123,          WTAP_ENCAP_ATM_PDUS },  /* SunATM */
        { 121,          WTAP_ENCAP_HHDLC },     /* HiPath HDLC */
        { 122,          WTAP_ENCAP_IP_OVER_FC },   /* RFC 2625 IP-over-FC */
        { 123,          WTAP_ENCAP_ATM_PDUS },  /* SunATM */

-       { 127,          WTAP_ENCAP_WLAN_HEADER },  /* 802.11 plus WLAN header */
+       { 127,          WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP },  /* 802.11 plus radiotap WLAN header */

        { 128,          WTAP_ENCAP_TZSP },      /* Tazmen Sniffer Protocol */
        { 129,          WTAP_ENCAP_ARCNET_LINUX },
        { 128,          WTAP_ENCAP_TZSP },      /* Tazmen Sniffer Protocol */
        { 129,          WTAP_ENCAP_ARCNET_LINUX },

-
+        { 130,          WTAP_ENCAP_JUNIPER_MLPPP }, /* Juniper MLPPP on ML-, LS-, AS- PICs */
+        { 131,          WTAP_ENCAP_JUNIPER_MLFR }, /* Juniper MLFR (FRF.15) on ML-, LS-, AS- PICs */

        /*
        /*

-        * Values 130 thorugh 137 are reserved for use in Juniper
-        * hardware.
-        *
-        * 138 is reserved for Apple IP-over-IEEE 1394.
+        * Values 132-134, 136 not listed here are reserved for use
+        * in Juniper hardware.

         */
         */

+       { 135,          WTAP_ENCAP_JUNIPER_ATM2 }, /* various encapsulations captured on the ATM2 PIC */
+       { 137,          WTAP_ENCAP_JUNIPER_ATM1 }, /* various encapsulations captured on the ATM1 PIC */

 
 

-       { 144,          WTAP_ENCAP_IRDA },      /* IrDA capture */
+       { 138,          WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 },
+                                               /* Apple IP-over-IEEE 1394 */

 
 

+       { 139,          WTAP_ENCAP_MTP2_WITH_PHDR },

        { 140,          WTAP_ENCAP_MTP2 },
        { 141,          WTAP_ENCAP_MTP3 },
        { 140,          WTAP_ENCAP_MTP2 },
        { 141,          WTAP_ENCAP_MTP3 },

+       { 143,          WTAP_ENCAP_DOCSIS },
+       { 144,          WTAP_ENCAP_IRDA },      /* IrDA capture */
+
+       /* Reserved for private use. */
+       { 147,          WTAP_ENCAP_USER0 },
+       { 148,          WTAP_ENCAP_USER1 },
+       { 149,          WTAP_ENCAP_USER2 },
+       { 150,          WTAP_ENCAP_USER3 },
+       { 151,          WTAP_ENCAP_USER4 },
+       { 152,          WTAP_ENCAP_USER5 },
+       { 153,          WTAP_ENCAP_USER6 },
+       { 154,          WTAP_ENCAP_USER7 },
+       { 155,          WTAP_ENCAP_USER8 },
+       { 156,          WTAP_ENCAP_USER9 },
+       { 157,          WTAP_ENCAP_USER10 },
+       { 158,          WTAP_ENCAP_USER11 },
+       { 159,          WTAP_ENCAP_USER12 },
+       { 160,          WTAP_ENCAP_USER13 },
+       { 161,          WTAP_ENCAP_USER14 },
+       { 162,          WTAP_ENCAP_USER15 },
+
+       { 163,          WTAP_ENCAP_IEEE_802_11_WLAN_AVS },  /* 802.11 plus AVS WLAN header */
+
+       /*
+        * 164 is reserved for Juniper-private chassis-internal
+        * meta-information such as QoS profiles, etc..
+        */
+
+       { 165,          WTAP_ENCAP_BACNET_MS_TP },
+
+       /*
+        * 166 is reserved for a PPP variant in which the first byte
+        * of the 0xff03 header, the 0xff, is replaced by a direction
+        * byte.  I don't know whether any captures look like that,
+        * but it is used for some Linux IP filtering (ipfilter?).
+        */
+
+        /* Ethernet PPPoE frames captured on a service PIC */
+        { 167,          WTAP_ENCAP_JUNIPER_PPPOE },
+
+        /*
+        * 168 is reserved for more Juniper private-chassis-
+        * internal meta-information.
+        */
+
+       { 169,          WTAP_ENCAP_GPRS_LLC },
+
+       /*
+        * 170 and 171 are reserved for ITU-T G.7041/Y.1303 Generic
+        * Framing Procedure.
+        */
+
+       /* Registered by Gcom, Inc. */
+       { 172,          WTAP_GCOM_TIE1 },
+       { 173,          WTAP_GCOM_SERIAL },

 
        /*
         * To repeat:
 
        /*
         * To repeat:


@@ -456,6 +553,15 @@ static const struct {
         */
        { 19,           WTAP_ENCAP_LINUX_ATM_CLIP },
 
         */
        { 19,           WTAP_ENCAP_LINUX_ATM_CLIP },
 

+       /*
+        * nettl (HP-UX) mappings to standard DLT values
+         */
+
+       { 1,            WTAP_ENCAP_NETTL_ETHERNET },
+       { 6,            WTAP_ENCAP_NETTL_TOKEN_RING },
+       { 10,           WTAP_ENCAP_NETTL_FDDI },
+       { 101,          WTAP_ENCAP_NETTL_RAW_IP },
+

        /*
         * To repeat:
         *
        /*
         * To repeat:
         *


@@ -485,7 +591,7 @@ int wtap_pcap_encap_to_wtap_encap(int encap)
 }
 
 
 }
 
 

-int libpcap_open(wtap *wth, int *err)
+int libpcap_open(wtap *wth, int *err, gchar **err_info)

 {
        int bytes_read;
        guint32 magic;
 {
        int bytes_read;
        guint32 magic;


@@ -495,6 +601,7 @@ int libpcap_open(wtap *wth, int *err)
        gboolean aix;
        int file_encap;
 
        gboolean aix;
        int file_encap;
 

+       

        /* Read in the number that should be at the start of a "libpcap" file */
        errno = WTAP_ERR_CANT_READ;
        bytes_read = file_read(&magic, 1, sizeof magic, wth->fh);
        /* Read in the number that should be at the start of a "libpcap" file */
        errno = WTAP_ERR_CANT_READ;
        bytes_read = file_read(&magic, 1, sizeof magic, wth->fh);


@@ -513,6 +620,7 @@ int libpcap_open(wtap *wth, int *err)
                   a program using either standard or ss990417 libpcap. */
                byte_swapped = FALSE;
                modified = FALSE;
                   a program using either standard or ss990417 libpcap. */
                byte_swapped = FALSE;
                modified = FALSE;

+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;

                break;
 
        case PCAP_MODIFIED_MAGIC:
                break;
 
        case PCAP_MODIFIED_MAGIC:


@@ -520,6 +628,7 @@ int libpcap_open(wtap *wth, int *err)
                   a program using either ss990915 or ss991029 libpcap. */
                byte_swapped = FALSE;
                modified = TRUE;
                   a program using either ss990915 or ss991029 libpcap. */
                byte_swapped = FALSE;
                modified = TRUE;

+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;

                break;
 
        case PCAP_SWAPPED_MAGIC:
                break;
 
        case PCAP_SWAPPED_MAGIC:


@@ -528,6 +637,7 @@ int libpcap_open(wtap *wth, int *err)
                   ss990417 libpcap. */
                byte_swapped = TRUE;
                modified = FALSE;
                   ss990417 libpcap. */
                byte_swapped = TRUE;
                modified = FALSE;

+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;

                break;
 
        case PCAP_SWAPPED_MODIFIED_MAGIC:
                break;
 
        case PCAP_SWAPPED_MODIFIED_MAGIC:


@@ -536,6 +646,24 @@ int libpcap_open(wtap *wth, int *err)
                   or ss991029 libpcap. */
                byte_swapped = TRUE;
                modified = TRUE;
                   or ss991029 libpcap. */
                byte_swapped = TRUE;
                modified = TRUE;

+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;
+               break;
+
+       case PCAP_NSEC_MAGIC:
+               /* Host that wrote it has our byte order, and was running
+                  a program using either standard or ss990417 libpcap. */
+               byte_swapped = FALSE;
+               modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
+               break;
+
+       case PCAP_SWAPPED_NSEC_MAGIC:
+               /* Host that wrote it out has a byte order opposite to
+                  ours, and was running a program using either ss990915 
+                  or ss991029 libpcap. */
+               byte_swapped = TRUE;
+               modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_NSEC;

                break;
 
        default:
                break;
 
        default:


@@ -563,9 +691,9 @@ int libpcap_open(wtap *wth, int *err)
        }
        if (hdr.version_major < 2) {
                /* We only support version 2.0 and later. */
        }
        if (hdr.version_major < 2) {
                /* We only support version 2.0 and later. */

-               g_message("pcap: major version %u unsupported",
-                   hdr.version_major);

                *err = WTAP_ERR_UNSUPPORTED;
                *err = WTAP_ERR_UNSUPPORTED;

+               *err_info = g_strdup_printf("pcap: major version %u unsupported",
+                   hdr.version_major);

                return -1;
        }
 
                return -1;
        }
 


@@ -629,11 +757,22 @@ int libpcap_open(wtap *wth, int *err)
                        break;
                }
        }
                        break;
                }
        }

+
+       /*
+        * We treat a DLT_ value of 13 specially - it appears that in
+        * Nokia libpcap format, it's some form of ATM with what I
+        * suspect is a pseudo-header (even though Nokia's IPSO is
+        * based on FreeBSD, which #defines DLT_SLIP_BSDOS as 13).
+        *
+        * We don't yet know whether this is a Nokia capture, so if
+        * "wtap_pcap_encap_to_wtap_encap()" returned WTAP_ENCAP_UNKNOWN
+        * but "hdr.network" is 13, we don't treat that as an error yet.
+        */

        file_encap = wtap_pcap_encap_to_wtap_encap(hdr.network);
        file_encap = wtap_pcap_encap_to_wtap_encap(hdr.network);

-       if (file_encap == WTAP_ENCAP_UNKNOWN) {
-               g_message("pcap: network type %u unknown or unsupported",
-                   hdr.network);
+       if (file_encap == WTAP_ENCAP_UNKNOWN && hdr.network != 13) {

                *err = WTAP_ERR_UNSUPPORTED_ENCAP;
                *err = WTAP_ERR_UNSUPPORTED_ENCAP;

+               *err_info = g_strdup_printf("pcap: network type %u unknown or unsupported",
+                   hdr.network);

                return -1;
        }
 
                return -1;
        }
 


@@ -782,7 +921,11 @@ int libpcap_open(wtap *wth, int *err)
                 *
                 * Try the standard format first.
                 */
                 *
                 * Try the standard format first.
                 */

-               wth->file_type = WTAP_FILE_PCAP;
+               if(wth->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+                       wth->file_type = WTAP_FILE_PCAP_NSEC;
+               } else {
+                       wth->file_type = WTAP_FILE_PCAP;
+               }

                switch (libpcap_try(wth, err)) {
 
                case BAD_READ:
                switch (libpcap_try(wth, err)) {
 
                case BAD_READ:


@@ -864,6 +1007,23 @@ int libpcap_open(wtap *wth, int *err)
                }
        }
 
                }
        }
 

+       if (hdr.network == 13) {
+               /*
+                * OK, if this was a Nokia capture, make it
+                * WTAP_ENCAP_ATM_PDUS, otherwise return
+                * an error.
+                */
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA)
+                       wth->file_encap = WTAP_ENCAP_ATM_PDUS;
+               else {
+                       *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+                       *err_info = g_strdup_printf("pcap: network type %u unknown or unsupported",
+                           hdr.network);
+                       g_free(wth->capture.pcap);
+                       return -1;
+               }
+       }
+

        return 1;
 }
 
        return 1;
 }
 


@@ -878,7 +1038,7 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
        /*
         * Attempt to read the first record's header.
         */
        /*
         * Attempt to read the first record's header.
         */

-       if (libpcap_read_header(wth, err, &first_rec_hdr, TRUE) == -1) {
+       if (libpcap_read_header(wth, err, NULL, &first_rec_hdr) == -1) {

                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this
                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this


@@ -917,7 +1077,7 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
        /*
         * Now attempt to read the second record's header.
         */
        /*
         * Now attempt to read the second record's header.
         */

-       if (libpcap_read_header(wth, err, &second_rec_hdr, TRUE) == -1) {
+       if (libpcap_read_header(wth, err, NULL, &second_rec_hdr) == -1) {

                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this
                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this


@@ -955,15 +1115,16 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
 }
 
 /* Read the next packet */
 }
 
 /* Read the next packet */

-static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
+static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
+    long *data_offset)

 {
        struct pcaprec_ss990915_hdr hdr;
        guint packet_size;
        guint orig_size;
        int bytes_read;
 {
        struct pcaprec_ss990915_hdr hdr;
        guint packet_size;
        guint orig_size;
        int bytes_read;

-       char fddi_padding[3];
+       guchar fddi_padding[3];

 
 

-       bytes_read = libpcap_read_header(wth, err, &hdr, FALSE);
+       bytes_read = libpcap_read_header(wth, err, err_info, &hdr);

        if (bytes_read == -1) {
                /*
                 * We failed to read the header.
        if (bytes_read == -1) {
                /*
                 * We failed to read the header.


@@ -1008,33 +1169,76 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
        switch (wth->file_encap) {
 
        case WTAP_ENCAP_ATM_PDUS:
        switch (wth->file_encap) {
 
        case WTAP_ENCAP_ATM_PDUS:

-               if (packet_size < sizeof (struct sunatm_hdr)) {
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {

                        /*
                        /*

-                        * Uh-oh, the packet isn't big enough to even
-                        * have a pseudo-header.
+                        * Nokia IPSO ATM.

                         */
                         */

-                       g_message("libpcap: SunATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
-                           packet_size);
-                       *err = WTAP_ERR_BAD_RECORD;
-                       return FALSE;
+                       if (packet_size < sizeof (struct nokiaatm_hdr)) {
+                               /*
+                                * Uh-oh, the packet isn't big enough to even
+                                * have a pseudo-header.
+                                */
+                               *err = WTAP_ERR_BAD_RECORD;
+                               *err_info = g_strdup_printf("libpcap: Nokia IPSO ATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+                                   packet_size);
+                               return FALSE;
+                       }
+                       if (!libpcap_read_nokiaatm_pseudoheader(wth->fh,
+                           &wth->pseudo_header, err))
+                               return FALSE;   /* Read error */
+
+                       /*
+                        * Don't count the pseudo-header as part of the
+                        * packet.
+                        */
+                       orig_size -= sizeof (struct nokiaatm_hdr);
+                       packet_size -= sizeof (struct nokiaatm_hdr);
+                       wth->data_offset += sizeof (struct nokiaatm_hdr);
+               } else {
+                       /*
+                        * SunATM.
+                        */
+                       if (packet_size < sizeof (struct sunatm_hdr)) {
+                               /*
+                                * Uh-oh, the packet isn't big enough to even
+                                * have a pseudo-header.
+                                */
+                               *err = WTAP_ERR_BAD_RECORD;
+                               *err_info = g_strdup_printf("libpcap: SunATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+                                   packet_size);
+                               return FALSE;
+                       }
+                       if (!libpcap_read_sunatm_pseudoheader(wth->fh,
+                           &wth->pseudo_header, err))
+                               return FALSE;   /* Read error */
+
+                       /*
+                        * Don't count the pseudo-header as part of the
+                        * packet.
+                        */
+                       orig_size -= sizeof (struct sunatm_hdr);
+                       packet_size -= sizeof (struct sunatm_hdr);
+                       wth->data_offset += sizeof (struct sunatm_hdr);

                }
                }

-               if (!libpcap_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
-                   err))
-                       return FALSE;   /* Read error */
+               break;

 
 

+       case WTAP_ENCAP_ETHERNET:

                /*
                /*

-                * Don't count the pseudo-header as part of the packet.
+                * We don't know whether there's an FCS in this frame or not.

                 */
                 */

-               orig_size -= sizeof (struct sunatm_hdr);
-               packet_size -= sizeof (struct sunatm_hdr);
-               wth->data_offset += sizeof (struct sunatm_hdr);
+               wth->pseudo_header.eth.fcs_len = -1;

                break;
 
                break;
 

-       case WTAP_ENCAP_ETHERNET:
+       case WTAP_ENCAP_IEEE_802_11:
+       case WTAP_ENCAP_PRISM_HEADER:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_AVS:

                /*
                 * We don't know whether there's an FCS in this frame or not.
                /*
                 * We don't know whether there's an FCS in this frame or not.

+                * XXX - are there any OSes where the capture mechanism
+                * supplies an FCS?

                 */
                 */

-               wth->pseudo_header.eth.fcs_len = -1;
+               wth->pseudo_header.ieee_802_11.fcs_len = -1;

                break;
 
        case WTAP_ENCAP_IRDA:
                break;
 
        case WTAP_ENCAP_IRDA:


@@ -1043,13 +1247,13 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
                         * Uh-oh, the packet isn't big enough to even
                         * have a pseudo-header.
                         */
                         * Uh-oh, the packet isn't big enough to even
                         * have a pseudo-header.
                         */

-                       g_message("libpcap: IrDA file has a %u-byte packet, too small to have even an IrDA pseudo-header\n",
-                           packet_size);

                        *err = WTAP_ERR_BAD_RECORD;
                        *err = WTAP_ERR_BAD_RECORD;

+                       *err_info = g_strdup_printf("libpcap: IrDA file has a %u-byte packet, too small to have even an IrDA pseudo-header\n",
+                           packet_size);

                        return FALSE;
                }
                if (!libpcap_read_irda_pseudoheader(wth->fh, &wth->pseudo_header,
                        return FALSE;
                }
                if (!libpcap_read_irda_pseudoheader(wth->fh, &wth->pseudo_header,

-                   err))
+                   err, err_info))

                        return FALSE;   /* Read error */
 
                /*
                        return FALSE;   /* Read error */
 
                /*


@@ -1059,6 +1263,28 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
                packet_size -= sizeof (struct irda_sll_hdr);
                wth->data_offset += sizeof (struct irda_sll_hdr);
                break;
                packet_size -= sizeof (struct irda_sll_hdr);
                wth->data_offset += sizeof (struct irda_sll_hdr);
                break;

+       case WTAP_ENCAP_MTP2_WITH_PHDR:
+               if (packet_size < sizeof (struct mtp2_hdr)) {
+                       /*
+                        * Uh-oh, the packet isn't big enough to even
+                        * have a pseudo-header.
+                        */
+                       *err = WTAP_ERR_BAD_RECORD;
+                       *err_info = g_strdup_printf("libpcap: MTP2 file has a %u-byte packet, too small to have even an MTP2 pseudo-header\n",
+                           packet_size);
+                       return FALSE;
+               }
+               if (!libpcap_read_mtp2_pseudoheader(wth->fh, &wth->pseudo_header,
+                   err, err_info))
+                       return FALSE;   /* Read error */
+
+               /*
+                * Don't count the pseudo-header as part of the packet.
+                */
+               orig_size -= sizeof (struct mtp2_hdr);
+               packet_size -= sizeof (struct mtp2_hdr);
+               wth->data_offset += sizeof (struct mtp2_hdr);
+               break;

        }
 
        buffer_assure_space(wth->frame_buffer, packet_size);
        }
 
        buffer_assure_space(wth->frame_buffer, packet_size);


@@ -1067,20 +1293,38 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
                return FALSE;   /* Read error */
        wth->data_offset += packet_size;
 
                return FALSE;   /* Read error */
        wth->data_offset += packet_size;
 

-       wth->phdr.ts.tv_sec = hdr.hdr.ts_sec;
-       wth->phdr.ts.tv_usec = hdr.hdr.ts_usec;
+       wth->phdr.ts.secs = hdr.hdr.ts_sec;
+       if(wth->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+               wth->phdr.ts.nsecs = hdr.hdr.ts_usec;
+       } else {
+               wth->phdr.ts.nsecs = hdr.hdr.ts_usec * 1000;
+       }

        wth->phdr.caplen = packet_size;
        wth->phdr.len = orig_size;
        wth->phdr.caplen = packet_size;
        wth->phdr.len = orig_size;

-       wth->phdr.pkt_encap = wth->file_encap;

 
 

-       /*
-        * If this is ATM LANE traffic, try to guess what type of LANE
-        * traffic it is based on the packet contents.
-        */
-       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
-           wth->pseudo_header.atm.type == TRAF_LANE) {
-               atm_guess_lane_type(buffer_start_ptr(wth->frame_buffer),
-                   wth->phdr.caplen, &wth->pseudo_header);
+       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        *
+                        * Guess the traffic type based on the packet
+                        * contents.
+                        */
+                       atm_guess_traffic_type(buffer_start_ptr(wth->frame_buffer),
+                           wth->phdr.caplen, &wth->pseudo_header);
+               } else {
+                       /*
+                        * SunATM.
+                        *
+                        * If this is ATM LANE traffic, try to guess what
+                        * type of LANE traffic it is based on the packet
+                        * contents.
+                        */
+                       if (wth->pseudo_header.atm.type == TRAF_LANE) {
+                               atm_guess_lane_type(buffer_start_ptr(wth->frame_buffer),
+                                   wth->phdr.caplen, &wth->pseudo_header);
+                       }
+               }

        }
 
        return TRUE;
        }
 
        return TRUE;


@@ -1088,7 +1332,8 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
 
 static gboolean
 libpcap_seek_read(wtap *wth, long seek_off,
 
 static gboolean
 libpcap_seek_read(wtap *wth, long seek_off,

-    union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err)
+    union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+    int *err, gchar **err_info)

 {
        if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
                return FALSE;
 {
        if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
                return FALSE;


@@ -1096,10 +1341,24 @@ libpcap_seek_read(wtap *wth, long seek_off,
        switch (wth->file_encap) {
 
        case WTAP_ENCAP_ATM_PDUS:
        switch (wth->file_encap) {
 
        case WTAP_ENCAP_ATM_PDUS:

-               if (!libpcap_read_atm_pseudoheader(wth->random_fh, pseudo_header,
-                   err)) {
-                       /* Read error */
-                       return FALSE;
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        */
+                       if (!libpcap_read_nokiaatm_pseudoheader(wth->random_fh,
+                           pseudo_header, err)) {
+                               /* Read error */
+                               return FALSE;
+                       }
+               } else {
+                       /*
+                        * SunATM.
+                        */
+                       if (!libpcap_read_sunatm_pseudoheader(wth->random_fh,
+                           pseudo_header, err)) {
+                               /* Read error */
+                               return FALSE;
+                       }

                }
                break;
 
                }
                break;
 


@@ -1110,9 +1369,28 @@ libpcap_seek_read(wtap *wth, long seek_off,
                pseudo_header->eth.fcs_len = -1;
                break;
 
                pseudo_header->eth.fcs_len = -1;
                break;
 

+       case WTAP_ENCAP_IEEE_802_11:
+       case WTAP_ENCAP_PRISM_HEADER:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_AVS:
+               /*
+                * We don't know whether there's an FCS in this frame or not.
+                * XXX - are there any OSes where the capture mechanism
+                * supplies an FCS?
+                */
+               pseudo_header->ieee_802_11.fcs_len = -1;
+               break;
+

        case WTAP_ENCAP_IRDA:
                if (!libpcap_read_irda_pseudoheader(wth->random_fh, pseudo_header,
        case WTAP_ENCAP_IRDA:
                if (!libpcap_read_irda_pseudoheader(wth->random_fh, pseudo_header,

-                   err)) {
+                   err, err_info)) {
+                       /* Read error */
+                       return FALSE;
+               }
+               break;
+       case WTAP_ENCAP_MTP2_WITH_PHDR:
+               if (!libpcap_read_mtp2_pseudoheader(wth->random_fh, pseudo_header,
+                   err, err_info)) {

                        /* Read error */
                        return FALSE;
                }
                        /* Read error */
                        return FALSE;
                }


@@ -1125,23 +1403,35 @@ libpcap_seek_read(wtap *wth, long seek_off,
        if (!libpcap_read_rec_data(wth->random_fh, pd, length, err))
                return FALSE;   /* failed */
 
        if (!libpcap_read_rec_data(wth->random_fh, pd, length, err))
                return FALSE;   /* failed */
 

-       /*
-        * If this is ATM LANE traffic, try to guess what type of LANE
-        * traffic it is based on the packet contents.
-        */
-       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS &&
-           pseudo_header->atm.type == TRAF_LANE)
-               atm_guess_lane_type(pd, length, pseudo_header);
+       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        *
+                        * Guess the traffic type based on the packet
+                        * contents.
+                        */
+                       atm_guess_traffic_type(pd, length, pseudo_header);
+               } else {
+                       /*
+                        * SunATM.
+                        *
+                        * If this is ATM LANE traffic, try to guess what
+                        * type of LANE traffic it is based on the packet
+                        * contents.
+                        */
+                       if (pseudo_header->atm.type == TRAF_LANE)
+                               atm_guess_lane_type(pd, length, pseudo_header);
+               }
+       }

        return TRUE;
 }
 
        return TRUE;
 }
 

-/* Read the header of the next packet; if "silent" is TRUE, don't complain
-   to the console, as we're testing to see if the file appears to be of a
-   particular type.
+/* Read the header of the next packet.

 
    Return -1 on an error, or the number of bytes of header read on success. */
 
    Return -1 on an error, or the number of bytes of header read on success. */

-static int libpcap_read_header(wtap *wth, int *err,
-    struct pcaprec_ss990915_hdr *hdr, gboolean silent)
+static int libpcap_read_header(wtap *wth, int *err, gchar **err_info,
+    struct pcaprec_ss990915_hdr *hdr)

 {
        int     bytes_to_read, bytes_read;
 
 {
        int     bytes_to_read, bytes_read;
 


@@ -1151,6 +1441,7 @@ static int libpcap_read_header(wtap *wth, int *err,
 
        case WTAP_FILE_PCAP:
        case WTAP_FILE_PCAP_AIX:
 
        case WTAP_FILE_PCAP:
        case WTAP_FILE_PCAP_AIX:

+       case WTAP_FILE_PCAP_NSEC:

                bytes_to_read = sizeof (struct pcaprec_hdr);
                break;
 
                bytes_to_read = sizeof (struct pcaprec_hdr);
                break;
 


@@ -1191,11 +1482,11 @@ static int libpcap_read_header(wtap *wth, int *err,
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */

-               if (!silent) {
-                       g_message("pcap: File has %u-byte packet, bigger than maximum of %u",
+               *err = WTAP_ERR_BAD_RECORD;
+               if (err_info != NULL) {
+                       *err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger than maximum of %u",

                            hdr->hdr.incl_len, WTAP_MAX_PACKET_SIZE);
                }
                            hdr->hdr.incl_len, WTAP_MAX_PACKET_SIZE);
                }

-               *err = WTAP_ERR_BAD_RECORD;

                return -1;
        }
 
                return -1;
        }
 


@@ -1208,11 +1499,11 @@ static int libpcap_read_header(wtap *wth, int *err,
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */

-               if (!silent) {
-                       g_message("pcap: File has %u-byte packet, bigger than maximum of %u",
+               *err = WTAP_ERR_BAD_RECORD;
+               if (err_info != NULL) {
+                       *err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger than maximum of %u",

                            hdr->hdr.orig_len, WTAP_MAX_PACKET_SIZE);
                }
                            hdr->hdr.orig_len, WTAP_MAX_PACKET_SIZE);
                }

-               *err = WTAP_ERR_BAD_RECORD;

                return -1;
        }
 
                return -1;
        }
 


@@ -1262,7 +1553,7 @@ adjust_header(wtap *wth, struct pcaprec_hdr *hdr)
 }
 
 static void
 }
 
 static void

-libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
+libpcap_get_sunatm_pseudoheader(const struct sunatm_hdr *atm_phdr,

     union wtap_pseudo_header *pseudo_header)
 {
        guint8  vpi;
     union wtap_pseudo_header *pseudo_header)
 {
        guint8  vpi;


@@ -1271,11 +1562,6 @@ libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
        vpi = atm_phdr->vpi;
        vci = pntohs(&atm_phdr->vci);
 
        vpi = atm_phdr->vpi;
        vci = pntohs(&atm_phdr->vci);
 

-       /*
-        * The lower 4 bits of the first byte of the header indicate
-        * the type of traffic, as per the "atmioctl.h" header in
-        * SunATM.
-        */

        switch (atm_phdr->flags & 0x0F) {
 
        case 0x01:      /* LANE */
        switch (atm_phdr->flags & 0x0F) {
 
        case 0x01:      /* LANE */


@@ -1342,8 +1628,8 @@ libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
 }
 
 static gboolean
 }
 
 static gboolean

-libpcap_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
-    int *err)
+libpcap_read_sunatm_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err)

 {
        struct sunatm_hdr atm_phdr;
        int     bytes_read;
 {
        struct sunatm_hdr atm_phdr;
        int     bytes_read;


@@ -1357,29 +1643,65 @@ libpcap_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header
                return FALSE;
        }
 
                return FALSE;
        }
 

-       libpcap_get_atm_pseudoheader(&atm_phdr, pseudo_header);
+       libpcap_get_sunatm_pseudoheader(&atm_phdr, pseudo_header);

 
        return TRUE;
 }
 
 static gboolean
 
        return TRUE;
 }
 
 static gboolean

-libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+libpcap_read_nokiaatm_pseudoheader(FILE_T fh,

     union wtap_pseudo_header *pseudo_header, int *err)
     union wtap_pseudo_header *pseudo_header, int *err)

+{
+       struct nokiaatm_hdr atm_phdr;
+       int     bytes_read;
+       guint8  vpi;
+       guint16 vci;
+
+       errno = WTAP_ERR_CANT_READ;
+       bytes_read = file_read(&atm_phdr, 1, sizeof (struct nokiaatm_hdr), fh);
+       if (bytes_read != sizeof (struct nokiaatm_hdr)) {
+               *err = file_error(fh);
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+
+       vpi = atm_phdr.vpi;
+       vci = pntohs(&atm_phdr.vci);
+
+       pseudo_header->atm.vpi = vpi;
+       pseudo_header->atm.vci = vci;
+       pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
+
+       /* We don't have this information */
+       pseudo_header->atm.flags = 0;
+       pseudo_header->atm.cells = 0;
+       pseudo_header->atm.aal5t_u2u = 0;
+       pseudo_header->atm.aal5t_len = 0;
+       pseudo_header->atm.aal5t_chksum = 0;
+
+       return TRUE;
+}
+
+static gboolean
+libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info)

 {
        if (pntohs(&irda_phdr->sll_protocol) != 0x0017) {
 {
        if (pntohs(&irda_phdr->sll_protocol) != 0x0017) {

-               g_message("libpcap: IrDA capture has a packet with an invalid sll_protocol field\n");

                *err = WTAP_ERR_BAD_RECORD;
                *err = WTAP_ERR_BAD_RECORD;

+               if (err_info != NULL)
+                       *err_info = g_strdup("libpcap: IrDA capture has a packet with an invalid sll_protocol field\n");

                return FALSE;
        }
 
        pseudo_header->irda.pkttype = pntohs(&irda_phdr->sll_pkttype);
 
                return FALSE;
        }
 
        pseudo_header->irda.pkttype = pntohs(&irda_phdr->sll_pkttype);
 

-    return TRUE;
+       return TRUE;

 }
 
 static gboolean
 libpcap_read_irda_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
 }
 
 static gboolean
 libpcap_read_irda_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,

-    int *err)
+    int *err, gchar **err_info)

 {
        struct irda_sll_hdr irda_phdr;
        int     bytes_read;
 {
        struct irda_sll_hdr irda_phdr;
        int     bytes_read;


@@ -1393,7 +1715,37 @@ libpcap_read_irda_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_heade
                return FALSE;
        }
 
                return FALSE;
        }
 

-       return libpcap_get_irda_pseudoheader(&irda_phdr, pseudo_header, err);
+       return libpcap_get_irda_pseudoheader(&irda_phdr, pseudo_header, err,
+           err_info);
+}
+
+static gboolean
+libpcap_get_mtp2_pseudoheader(const struct mtp2_hdr *mtp2_hdr, union wtap_pseudo_header *pseudo_header)
+{
+       pseudo_header->mtp2.sent         = mtp2_hdr->sent;
+       pseudo_header->mtp2.annex_a_used = mtp2_hdr->annex_a_used;
+       pseudo_header->mtp2.link_number  = pntohs(&mtp2_hdr->link_number);
+
+       return TRUE;
+}
+
+static gboolean
+libpcap_read_mtp2_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info _U_)
+{
+       struct mtp2_hdr mtp2_hdr;
+       int    bytes_read;
+
+       errno = WTAP_ERR_CANT_READ;
+       bytes_read = file_read(&mtp2_hdr, 1, sizeof (struct mtp2_hdr), fh);
+       if (bytes_read != sizeof (struct mtp2_hdr)) {
+               *err = file_error(fh);
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+
+       return libpcap_get_mtp2_pseudoheader(&mtp2_hdr, pseudo_header);
+            

 }
 
 static gboolean
 }
 
 static gboolean


@@ -1427,6 +1779,7 @@ static int wtap_wtap_encap_to_pcap_encap(int encap)
 
        case WTAP_ENCAP_FDDI:
        case WTAP_ENCAP_FDDI_BITSWAPPED:
 
        case WTAP_ENCAP_FDDI:
        case WTAP_ENCAP_FDDI_BITSWAPPED:

+       case WTAP_ENCAP_NETTL_FDDI:

                /*
                 * Special-case WTAP_ENCAP_FDDI and
                 * WTAP_ENCAP_FDDI_BITSWAPPED; both of them get mapped
                /*
                 * Special-case WTAP_ENCAP_FDDI and
                 * WTAP_ENCAP_FDDI_BITSWAPPED; both of them get mapped


@@ -1439,14 +1792,39 @@ static int wtap_wtap_encap_to_pcap_encap(int encap)
 
        case WTAP_ENCAP_PPP_WITH_PHDR:
                /*
 
        case WTAP_ENCAP_PPP_WITH_PHDR:
                /*

-                * Also special-case PPP and Frame Relay with direction
-                * bits; map them to PPP and Frame Relay, even though
-                * that means that the direction of the packet is lost.
+                * Also special-case PPP with direction bits; map it to
+                * PPP, even though that means that the direction of the
+                * packet is lost.

                 */
                return 9;
 
        case WTAP_ENCAP_FRELAY_WITH_PHDR:
                 */
                return 9;
 
        case WTAP_ENCAP_FRELAY_WITH_PHDR:

+               /*
+                * Do the same with Frame Relay.
+                */

                return 107;
                return 107;

+
+       case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+               /*
+                * Map this to DLT_IEEE802_11, for now, even though
+                * that means the radio information will be lost.
+                * Once tcpdump support for the BSD radiotap header
+                * is sufficiently widespread, we should probably
+                * use that, instead - although we should probably
+                * ultimately just have WTAP_ENCAP_IEEE_802_11
+                * as the only Wiretap encapsulation for 802.11,
+                * and have the pseudo-header include a radiotap-style
+                * list of attributes.  If we do that, though, we
+                * should probably bypass the regular Wiretap code
+                * when writing out packets during a capture, and just
+                * do the equivalent of a libpcap write (unfortunately,
+                * libpcap doesn't have an "open dump by file descriptor"
+                * function, so we can't just use "pcap_dump()"), so
+                * that we don't spend cycles mapping from libpcap to
+                * Wiretap and then back to libpcap.  (There are other
+                * reasons to do that, e.g. to handle AIX libpcap better.)
+                */
+               return 105;

        }
 
        for (i = 0; i < NUM_PCAP_ENCAPS; i++) {
        }
 
        for (i = 0; i < NUM_PCAP_ENCAPS; i++) {


@@ -1472,8 +1850,8 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
           be a "struct bpf_timeval", with member sizes wired to 32
           bits - and we may go that way ourselves in the future, so
           copy the members individually. */
           be a "struct bpf_timeval", with member sizes wired to 32
           bits - and we may go that way ourselves in the future, so
           copy the members individually. */

-       whdr->ts.tv_sec = phdr->ts.tv_sec;
-       whdr->ts.tv_usec = phdr->ts.tv_usec;
+       whdr->ts.secs = phdr->ts.tv_sec;
+       whdr->ts.nsecs = phdr->ts.tv_usec * 1000;

        whdr->caplen = phdr->caplen;
        whdr->len = phdr->len;
        whdr->pkt_encap = linktype;
        whdr->caplen = phdr->caplen;
        whdr->len = phdr->len;
        whdr->pkt_encap = linktype;


@@ -1495,7 +1873,7 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
                        *err = WTAP_ERR_BAD_RECORD;
                        return NULL;
                }
                        *err = WTAP_ERR_BAD_RECORD;
                        return NULL;
                }

-               libpcap_get_atm_pseudoheader((const struct sunatm_hdr *)pd,
+               libpcap_get_sunatm_pseudoheader((const struct sunatm_hdr *)pd,

                    pseudo_header);
 
                /*
                    pseudo_header);
 
                /*


@@ -1524,7 +1902,7 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
                        return NULL;
                }
                if (!libpcap_get_irda_pseudoheader((const struct irda_sll_hdr *)pd,
                        return NULL;
                }
                if (!libpcap_get_irda_pseudoheader((const struct irda_sll_hdr *)pd,

-                       pseudo_header, err))
+                       pseudo_header, err, NULL))

                        return NULL;
 
                /*
                        return NULL;
 
                /*


@@ -1534,6 +1912,27 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
                whdr->caplen -= sizeof (struct irda_sll_hdr);
                pd += sizeof (struct irda_sll_hdr);
        }
                whdr->caplen -= sizeof (struct irda_sll_hdr);
                pd += sizeof (struct irda_sll_hdr);
        }

+       else if (linktype == WTAP_ENCAP_MTP2_WITH_PHDR) {
+               if (whdr->caplen < sizeof (struct mtp2_hdr)) {
+                       /*
+                        * Uh-oh, the packet isn't big enough to even
+                        * have a pseudo-header.
+                        */
+                       g_message("libpcap: MTP2 capture has a %u-byte packet, too small to have even an MTP2 pseudo-header\n",
+                           whdr->caplen);
+                       *err = WTAP_ERR_BAD_RECORD;
+                       return NULL;
+               }
+               if (!libpcap_get_mtp2_pseudoheader((const struct mtp2_hdr *)pd, pseudo_header))
+                       return NULL;
+
+               /*
+                * Don't count the pseudo-header as part of the packet.
+                */
+               whdr->len -= sizeof (struct mtp2_hdr);
+               whdr->caplen -= sizeof (struct mtp2_hdr);
+               pd += sizeof (struct mtp2_hdr);
+       }

        return pd;
 }
 #endif
        return pd;
 }
 #endif


@@ -1571,11 +1970,18 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
        case WTAP_FILE_PCAP_SS990417:   /* modified, but with the old magic, sigh */
        case WTAP_FILE_PCAP_NOKIA:      /* Nokia libpcap of some sort */
                magic = PCAP_MAGIC;
        case WTAP_FILE_PCAP_SS990417:   /* modified, but with the old magic, sigh */
        case WTAP_FILE_PCAP_NOKIA:      /* Nokia libpcap of some sort */
                magic = PCAP_MAGIC;

+               wdh->tsprecision = WTAP_FILE_TSPREC_USEC;

                break;
 
        case WTAP_FILE_PCAP_SS990915:   /* new magic, extra crap */
        case WTAP_FILE_PCAP_SS991029:
                magic = PCAP_MODIFIED_MAGIC;
                break;
 
        case WTAP_FILE_PCAP_SS990915:   /* new magic, extra crap */
        case WTAP_FILE_PCAP_SS991029:
                magic = PCAP_MODIFIED_MAGIC;

+               wdh->tsprecision = WTAP_FILE_TSPREC_USEC;
+               break;
+
+       case WTAP_FILE_PCAP_NSEC:               /* same as WTAP_FILE_PCAP, but nsec precision */
+               magic = PCAP_NSEC_MAGIC;
+               wdh->tsprecision = WTAP_FILE_TSPREC_NSEC;

                break;
 
        default:
                break;
 
        default:


@@ -1585,10 +1991,10 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
                return FALSE;
        }
 
                return FALSE;
        }
 

-       nwritten = fwrite(&magic, 1, sizeof magic, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &magic, sizeof magic);

        if (nwritten != sizeof magic) {
        if (nwritten != sizeof magic) {

-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);

                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;


@@ -1614,10 +2020,10 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
        file_hdr.snaplen = (wdh->snaplen != 0) ? wdh->snaplen :
                                                 WTAP_MAX_PACKET_SIZE;
        file_hdr.network = wtap_wtap_encap_to_pcap_encap(wdh->encap);
        file_hdr.snaplen = (wdh->snaplen != 0) ? wdh->snaplen :
                                                 WTAP_MAX_PACKET_SIZE;
        file_hdr.network = wtap_wtap_encap_to_pcap_encap(wdh->encap);

-       nwritten = fwrite(&file_hdr, 1, sizeof file_hdr, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr);

        if (nwritten != sizeof file_hdr) {
        if (nwritten != sizeof file_hdr) {

-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);

                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;


@@ -1639,6 +2045,7 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
        size_t nwritten;
        struct sunatm_hdr atm_hdr;
        struct irda_sll_hdr irda_hdr;
        size_t nwritten;
        struct sunatm_hdr atm_hdr;
        struct irda_sll_hdr irda_hdr;

+       struct mtp2_hdr mtp2_hdr;

        int hdrsize;
 
        if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
        int hdrsize;
 
        if (wdh->encap == WTAP_ENCAP_ATM_PDUS)


@@ -1648,13 +2055,18 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
        else
                hdrsize = 0;
 
        else
                hdrsize = 0;
 

-       rec_hdr.hdr.ts_sec = phdr->ts.tv_sec;
-       rec_hdr.hdr.ts_usec = phdr->ts.tv_usec;
+       rec_hdr.hdr.ts_sec = phdr->ts.secs;
+       if(wdh->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+               rec_hdr.hdr.ts_usec = phdr->ts.nsecs;
+       } else {
+               rec_hdr.hdr.ts_usec = phdr->ts.nsecs / 1000;
+       }

        rec_hdr.hdr.incl_len = phdr->caplen + hdrsize;
        rec_hdr.hdr.orig_len = phdr->len + hdrsize;
        switch (wdh->file_type) {
 
        case WTAP_FILE_PCAP:
        rec_hdr.hdr.incl_len = phdr->caplen + hdrsize;
        rec_hdr.hdr.orig_len = phdr->len + hdrsize;
        switch (wdh->file_type) {
 
        case WTAP_FILE_PCAP:

+       case WTAP_FILE_PCAP_NSEC:

                hdr_size = sizeof (struct pcaprec_hdr);
                break;
 
                hdr_size = sizeof (struct pcaprec_hdr);
                break;
 


@@ -1711,10 +2123,10 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
                return FALSE;
        }
 
                return FALSE;
        }
 

-       nwritten = fwrite(&rec_hdr, 1, hdr_size, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &rec_hdr, hdr_size);

        if (nwritten != hdr_size) {
        if (nwritten != hdr_size) {

-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);

                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;


@@ -1754,12 +2166,12 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
                        }
                        break;
                }
                        }
                        break;
                }

-               atm_hdr.vpi = pseudo_header->atm.vpi;
+               atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;

                atm_hdr.vci = phtons(&pseudo_header->atm.vci);
                atm_hdr.vci = phtons(&pseudo_header->atm.vci);

-               nwritten = fwrite(&atm_hdr, 1, sizeof atm_hdr, wdh->fh);
+               nwritten = wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr);

                if (nwritten != sizeof atm_hdr) {
                if (nwritten != sizeof atm_hdr) {

-                       if (nwritten == 0 && ferror(wdh->fh))
-                               *err = errno;
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);

                        else
                                *err = WTAP_ERR_SHORT_WRITE;
                        return FALSE;
                        else
                                *err = WTAP_ERR_SHORT_WRITE;
                        return FALSE;


@@ -1772,22 +2184,40 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
                 */
                memset(&irda_hdr, 0, sizeof(irda_hdr));
                irda_hdr.sll_pkttype  = phtons(&pseudo_header->irda.pkttype);
                 */
                memset(&irda_hdr, 0, sizeof(irda_hdr));
                irda_hdr.sll_pkttype  = phtons(&pseudo_header->irda.pkttype);

-               irda_hdr.sll_protocol = htons(0x0017);
-               nwritten = fwrite(&irda_hdr, 1, sizeof(irda_hdr), wdh->fh);
+               irda_hdr.sll_protocol = g_htons(0x0017);
+               nwritten = wtap_dump_file_write(wdh, &irda_hdr, sizeof(irda_hdr));

                if (nwritten != sizeof(irda_hdr)) {
                if (nwritten != sizeof(irda_hdr)) {

-                       if (nwritten == 0 && ferror(wdh->fh))
-                               *err = errno;
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);

                        else
                                *err = WTAP_ERR_SHORT_WRITE;
                        return FALSE;
                }
                wdh->bytes_dumped += sizeof(irda_hdr);
        }
                        else
                                *err = WTAP_ERR_SHORT_WRITE;
                        return FALSE;
                }
                wdh->bytes_dumped += sizeof(irda_hdr);
        }

+       else if (wdh->encap == WTAP_ENCAP_MTP2_WITH_PHDR) {
+               /*
+                * Write the MTP2 header.
+                */
+               memset(&mtp2_hdr, 0, sizeof(mtp2_hdr));
+               mtp2_hdr.sent         = pseudo_header->mtp2.sent;
+               mtp2_hdr.annex_a_used = pseudo_header->mtp2.annex_a_used;
+               mtp2_hdr.link_number  = phtons(&pseudo_header->mtp2.link_number);
+               nwritten = wtap_dump_file_write(wdh, &mtp2_hdr, sizeof(mtp2_hdr));
+               if (nwritten != sizeof(mtp2_hdr)) {
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);
+                       else
+                               *err = WTAP_ERR_SHORT_WRITE;
+                       return FALSE;
+               }
+               wdh->bytes_dumped += sizeof(mtp2_hdr);
+       }

 
 

-       nwritten = fwrite(pd, 1, phdr->caplen, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, pd, phdr->caplen);

        if (nwritten != phdr->caplen) {
        if (nwritten != phdr->caplen) {

-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);

                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;