added compression support for capture file output. The Save/As dialog now has a check...
[obnox/wireshark/wip.git] / wiretap / libpcap.c
index fe67df0bb13b332a16165a2e41c2cb8ac2a9d38d..7226f78585b2d3be249b4fa397e00c3b623a6d0b 100644 (file)
@@ -1,20 +1,20 @@
 /* libpcap.c
  *
- * $Id: libpcap.c,v 1.80 2002/07/29 06:09:59 guy Exp $
+ * $Id$
  *
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
- * 
+ *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
  * of the License, or (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 #include "config.h"
 #endif
 
+#ifdef HAVE_PCAP_H
+#include <pcap.h>
+#endif
+
 #include <stdlib.h>
+#include <string.h>
 #include <errno.h>
 #include "wtap-int.h"
 #include "file_wrappers.h"
 #include "buffer.h"
+#include "atm.h"
 #include "libpcap.h"
 
 #ifdef HAVE_PCAP_H
 # ifdef HAVE_SYS_TYPES_H
 #   include <sys/types.h>
 # endif
-#include <pcap.h>
 #include "wtap-capture.h"
 #endif
 
 /*
- * The link-layer header on ATM packets.
+ * The link-layer header on SunATM packets.
  */
 struct sunatm_hdr {
        guint8  flags;          /* destination and traffic type */
@@ -48,6 +53,34 @@ struct sunatm_hdr {
        guint16 vci;            /* VCI */
 };
 
+/*
+ * The link-layer header on Nokia IPSO ATM packets.
+ */
+struct nokiaatm_hdr {
+       guint8  flags;          /* destination */
+       guint8  vpi;            /* VPI */
+       guint16 vci;            /* VCI */
+};
+
+/*
+ * The fake link-layer header of IrDA packets as introduced by Jean Tourrilhes
+ * to libpcap.
+ */
+struct irda_sll_hdr {
+    guint16 sll_pkttype;    /* packet type */
+    guint8 unused[12];      /* usused SLL header fields */
+    guint16 sll_protocol;   /* protocol, should be 0x0017 */
+};
+
+/*
+ * A header containing additional MTP information.
+ */
+struct mtp2_hdr {
+       guint8  sent;
+       guint8  annex_a_used;
+       guint16 link_number;
+};
+
 /* See source to the "libpcap" library for information on the "libpcap"
    file format. */
 
@@ -64,16 +97,28 @@ typedef enum {
 } libpcap_try_t;
 static libpcap_try_t libpcap_try(wtap *wth, int *err);
 
-static gboolean libpcap_read(wtap *wth, int *err, long *data_offset);
+static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
+    long *data_offset);
 static gboolean libpcap_seek_read(wtap *wth, long seek_off,
-    union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err);
-static int libpcap_read_header(wtap *wth, int *err,
-    struct pcaprec_ss990915_hdr *hdr, gboolean silent);
+    union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+    int *err, gchar **err_info);
+static int libpcap_read_header(wtap *wth, int *err, gchar **err_info,
+    struct pcaprec_ss990915_hdr *hdr);
 static void adjust_header(wtap *wth, struct pcaprec_hdr *hdr);
-static void libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
+static void libpcap_get_sunatm_pseudoheader(const struct sunatm_hdr *atm_phdr,
     union wtap_pseudo_header *pseudo_header);
-static gboolean libpcap_read_atm_pseudoheader(FILE_T fh,
+static gboolean libpcap_read_sunatm_pseudoheader(FILE_T fh,
     union wtap_pseudo_header *pseudo_header, int *err);
+static gboolean libpcap_read_nokiaatm_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err);
+static gboolean libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
+static gboolean libpcap_read_irda_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
+static gboolean libpcap_get_mtp2_pseudoheader(const struct mtp2_hdr *mtp2_hdr,
+    union wtap_pseudo_header *pseudo_header);
+static gboolean libpcap_read_mtp2_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info);
 static gboolean libpcap_read_rec_data(FILE_T fh, guchar *pd, int length,
     int *err);
 static void libpcap_close(wtap *wth);
@@ -101,6 +146,16 @@ static gboolean libpcap_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
  * using them are foreign, and we don't hazard a guess as to which
  * platform they came from; we could, I guess, choose the most likely
  * platform).
+ *
+ * Note: if you need a new encapsulation type for libpcap files, do
+ * *N*O*T* use *ANY* of the values listed here!  I.e., do *NOT*
+ * add a new encapsulation type by changing an existing entry;
+ * leave the existing entries alone.
+ *
+ * Instead, send mail to tcpdump-workers@tcpdump.org, asking for a new
+ * DLT_ value, and specifying the purpose of the new value.  When you
+ * get the new DLT_ value, use that numerical value in the "dlt_value"
+ * field of "pcap_to_wtap_map[]".
  */
 
 static const struct {
@@ -126,6 +181,8 @@ static const struct {
        { 10,           WTAP_ENCAP_FDDI },
 #endif
 
+       { 32,           WTAP_ENCAP_REDBACK },
+
        /*
         * 50 is DLT_PPP_SERIAL in NetBSD; it appears that DLT_PPP
         * on BSD (at least according to standard tcpdump) has, as
@@ -185,6 +242,14 @@ static const struct {
         */
        { 50,           WTAP_ENCAP_PPP },
 
+       /*
+        * Apparently used by the Axent Raptor firewall (now Symantec
+        * Enterprise Firewall).
+        * Thanks, Axent, for not reserving that type with tcpdump.org
+        * and not telling anybody about it.
+        */
+       { 99,           WTAP_ENCAP_SYMANTEC },
+
        /*
         * These are the values that libpcap 0.5 and later use in
         * capture file headers, in an attempt to work around the
@@ -212,8 +277,8 @@ static const struct {
        { 106,          WTAP_ENCAP_LINUX_ATM_CLIP },
        { 107,          WTAP_ENCAP_FRELAY },    /* Frame Relay */
        { 108,          WTAP_ENCAP_NULL },      /* OpenBSD loopback */
-#if 0
        { 109,          WTAP_ENCAP_ENC },       /* OpenBSD IPSEC enc */
+#if 0
        { 110,          WTAP_ENCAP_LANE_802_3 },/* ATM LANE 802.3 */
        { 111,          WTAP_ENCAP_HIPPI },     /* NetBSD HIPPI */
 #endif
@@ -237,7 +302,95 @@ static const struct {
        { 118,          WTAP_ENCAP_CISCO_IOS },
        { 119,          WTAP_ENCAP_PRISM_HEADER }, /* Prism monitor mode hdr */
        { 121,          WTAP_ENCAP_HHDLC },     /* HiPath HDLC */
-       { 123,          WTAP_ENCAP_ATM_SNIFFER }, /* SunATM */
+       { 122,          WTAP_ENCAP_IP_OVER_FC },   /* RFC 2625 IP-over-FC */
+       { 123,          WTAP_ENCAP_ATM_PDUS },  /* SunATM */
+       { 127,          WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP },  /* 802.11 plus radiotap WLAN header */
+       { 128,          WTAP_ENCAP_TZSP },      /* Tazmen Sniffer Protocol */
+       { 129,          WTAP_ENCAP_ARCNET_LINUX },
+        { 130,          WTAP_ENCAP_JUNIPER_MLPPP }, /* Juniper MLPPP on ML-, LS-, AS- PICs */
+        { 131,          WTAP_ENCAP_JUNIPER_MLFR }, /* Juniper MLFR (FRF.15) on ML-, LS-, AS- PICs */
+       /*
+        * Values 132-134, 136 not listed here are reserved for use
+        * in Juniper hardware.
+        */
+       { 135,          WTAP_ENCAP_JUNIPER_ATM2 }, /* various encapsulations captured on the ATM2 PIC */
+       { 137,          WTAP_ENCAP_JUNIPER_ATM1 }, /* various encapsulations captured on the ATM1 PIC */
+
+       { 138,          WTAP_ENCAP_APPLE_IP_OVER_IEEE1394 },
+                                               /* Apple IP-over-IEEE 1394 */
+
+       { 139,          WTAP_ENCAP_MTP2_WITH_PHDR },
+       { 140,          WTAP_ENCAP_MTP2 },
+       { 141,          WTAP_ENCAP_MTP3 },
+       { 143,          WTAP_ENCAP_DOCSIS },
+       { 144,          WTAP_ENCAP_IRDA },      /* IrDA capture */
+
+       /* Reserved for private use. */
+       { 147,          WTAP_ENCAP_USER0 },
+       { 148,          WTAP_ENCAP_USER1 },
+       { 149,          WTAP_ENCAP_USER2 },
+       { 150,          WTAP_ENCAP_USER3 },
+       { 151,          WTAP_ENCAP_USER4 },
+       { 152,          WTAP_ENCAP_USER5 },
+       { 153,          WTAP_ENCAP_USER6 },
+       { 154,          WTAP_ENCAP_USER7 },
+       { 155,          WTAP_ENCAP_USER8 },
+       { 156,          WTAP_ENCAP_USER9 },
+       { 157,          WTAP_ENCAP_USER10 },
+       { 158,          WTAP_ENCAP_USER11 },
+       { 159,          WTAP_ENCAP_USER12 },
+       { 160,          WTAP_ENCAP_USER13 },
+       { 161,          WTAP_ENCAP_USER14 },
+       { 162,          WTAP_ENCAP_USER15 },
+
+       { 163,          WTAP_ENCAP_IEEE_802_11_WLAN_AVS },  /* 802.11 plus AVS WLAN header */
+
+       /*
+        * 164 is reserved for Juniper-private chassis-internal
+        * meta-information such as QoS profiles, etc..
+        */
+
+       { 165,          WTAP_ENCAP_BACNET_MS_TP },
+
+       /*
+        * 166 is reserved for a PPP variant in which the first byte
+        * of the 0xff03 header, the 0xff, is replaced by a direction
+        * byte.  I don't know whether any captures look like that,
+        * but it is used for some Linux IP filtering (ipfilter?).
+        */
+
+        /* Ethernet PPPoE frames captured on a service PIC */
+        { 167,          WTAP_ENCAP_JUNIPER_PPPOE },
+
+        /*
+        * 168 is reserved for more Juniper private-chassis-
+        * internal meta-information.
+        */
+
+       { 169,          WTAP_ENCAP_GPRS_LLC },
+
+       /*
+        * 170 and 171 are reserved for ITU-T G.7041/Y.1303 Generic
+        * Framing Procedure.
+        */
+
+       /* Registered by Gcom, Inc. */
+       { 172,          WTAP_GCOM_TIE1 },
+       { 173,          WTAP_GCOM_SERIAL },
+
+       /*
+        * To repeat:
+        *
+        * If you need a new encapsulation type for libpcap files, do
+        * *N*O*T* use *ANY* of the values listed here!  I.e., do *NOT*
+        * add a new encapsulation type by changing an existing entry;
+        * leave the existing entries alone.
+        *
+        * Instead, send mail to tcpdump-workers@tcpdump.org, asking for
+        * a new DLT_ value, and specifying the purpose of the new value.
+        * When you get the new DLT_ value, use that numerical value in
+        * the "dlt_value" field of "pcap_to_wtap_map[]".
+        */
 
        /*
         * The following are entries for libpcap type values that have
@@ -319,7 +472,7 @@ static const struct {
 #if defined(DLT_ATM_RFC1483) && (DLT_ATM_RFC1483 == 13)
        { 13,           WTAP_ENCAP_ATM_RFC1483 },
 #elif defined(DLT_ENC) && (DLT_ENC == 13)
-       /* Put entry for DLT_ENC here */
+       { 13,           WTAP_ENCAP_ENC },
 #endif
 
        /*
@@ -380,7 +533,7 @@ static const struct {
         * defined with the value 17.
         */
 #if !defined(DLT_LANE8023) || (DLT_LANE8023 != 17)
-       { 17,           WTAP_ENCAP_PFLOG },
+       { 17,           WTAP_ENCAP_OLD_PFLOG },
 #endif
 
        /*
@@ -399,6 +552,30 @@ static const struct {
         * purpose - hopefully nobody will do so in the future.
         */
        { 19,           WTAP_ENCAP_LINUX_ATM_CLIP },
+
+       /*
+        * nettl (HP-UX) mappings to standard DLT values
+         */
+
+       { 1,            WTAP_ENCAP_NETTL_ETHERNET },
+       { 6,            WTAP_ENCAP_NETTL_TOKEN_RING },
+       { 10,           WTAP_ENCAP_NETTL_FDDI },
+       { 101,          WTAP_ENCAP_NETTL_RAW_IP },
+
+       /*
+        * To repeat:
+        *
+        * If you need a new encapsulation type for libpcap files, do
+        * *N*O*T* use *ANY* of the values listed here!  I.e., do *NOT*
+        * add a new encapsulation type by changing an existing entry;
+        * leave the existing entries alone.
+        *
+        * Instead, send mail to tcpdump-workers@tcpdump.org, asking for
+        * a new DLT_ value, and specifying the purpose of the new value.
+        * When you get the new DLT_ value, use that numerical value in
+        * the "dlt_value" field of "pcap_to_wtap_map[]".
+        */
+
 };
 #define NUM_PCAP_ENCAPS (sizeof pcap_to_wtap_map / sizeof pcap_to_wtap_map[0])
 
@@ -414,7 +591,7 @@ int wtap_pcap_encap_to_wtap_encap(int encap)
 }
 
 
-int libpcap_open(wtap *wth, int *err)
+int libpcap_open(wtap *wth, int *err, gchar **err_info)
 {
        int bytes_read;
        guint32 magic;
@@ -424,6 +601,7 @@ int libpcap_open(wtap *wth, int *err)
        gboolean aix;
        int file_encap;
 
+       
        /* Read in the number that should be at the start of a "libpcap" file */
        errno = WTAP_ERR_CANT_READ;
        bytes_read = file_read(&magic, 1, sizeof magic, wth->fh);
@@ -442,6 +620,7 @@ int libpcap_open(wtap *wth, int *err)
                   a program using either standard or ss990417 libpcap. */
                byte_swapped = FALSE;
                modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;
                break;
 
        case PCAP_MODIFIED_MAGIC:
@@ -449,6 +628,7 @@ int libpcap_open(wtap *wth, int *err)
                   a program using either ss990915 or ss991029 libpcap. */
                byte_swapped = FALSE;
                modified = TRUE;
+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;
                break;
 
        case PCAP_SWAPPED_MAGIC:
@@ -457,6 +637,7 @@ int libpcap_open(wtap *wth, int *err)
                   ss990417 libpcap. */
                byte_swapped = TRUE;
                modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;
                break;
 
        case PCAP_SWAPPED_MODIFIED_MAGIC:
@@ -465,6 +646,24 @@ int libpcap_open(wtap *wth, int *err)
                   or ss991029 libpcap. */
                byte_swapped = TRUE;
                modified = TRUE;
+               wth->tsprecision = WTAP_FILE_TSPREC_USEC;
+               break;
+
+       case PCAP_NSEC_MAGIC:
+               /* Host that wrote it has our byte order, and was running
+                  a program using either standard or ss990417 libpcap. */
+               byte_swapped = FALSE;
+               modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
+               break;
+
+       case PCAP_SWAPPED_NSEC_MAGIC:
+               /* Host that wrote it out has a byte order opposite to
+                  ours, and was running a program using either ss990915 
+                  or ss991029 libpcap. */
+               byte_swapped = TRUE;
+               modified = FALSE;
+               wth->tsprecision = WTAP_FILE_TSPREC_NSEC;
                break;
 
        default:
@@ -492,9 +691,9 @@ int libpcap_open(wtap *wth, int *err)
        }
        if (hdr.version_major < 2) {
                /* We only support version 2.0 and later. */
-               g_message("pcap: major version %u unsupported",
-                   hdr.version_major);
                *err = WTAP_ERR_UNSUPPORTED;
+               *err_info = g_strdup_printf("pcap: major version %u unsupported",
+                   hdr.version_major);
                return -1;
        }
 
@@ -512,9 +711,17 @@ int libpcap_open(wtap *wth, int *err)
         *      FDDI            15
         *
         * which correspond to DLT_IEEE802 (used for Token Ring),
-        * DLT_PPP, and DLT_SLIP_BSDOS, respectively.  We shall
-        * assume that if the minor version number is 2, and
-        * the network type is 6, 9, or 15, that it's AIX libpcap.
+        * DLT_PPP, and DLT_SLIP_BSDOS, respectively.  The ifType value
+        * for a loopback interface is 24, which currently isn't
+        * used by any version of libpcap I know about (and, as
+        * tcpdump.org are assigning DLT_ values above 100, and
+        * NetBSD started assigning values starting at 50, and
+        * the values chosen by other libpcaps appear to stop at
+        * 19, it's probably not going to be used by any libpcap
+        * in the future).
+        *
+        * We shall assume that if the minor version number is 2, and
+        * the network type is 6, 9, 15, or 24, that it's AIX libpcap.
         *
         * I'm assuming those older versions of libpcap didn't
         * use DLT_IEEE802 for Token Ring, and didn't use DLT_SLIP_BSDOS
@@ -543,13 +750,29 @@ int libpcap_open(wtap *wth, int *err)
                        hdr.network = 10;       /* DLT_FDDI, FDDI */
                        aix = TRUE;
                        break;
+
+               case 24:
+                       hdr.network = 0;        /* DLT_NULL, loopback */
+                       aix = TRUE;
+                       break;
                }
        }
+
+       /*
+        * We treat a DLT_ value of 13 specially - it appears that in
+        * Nokia libpcap format, it's some form of ATM with what I
+        * suspect is a pseudo-header (even though Nokia's IPSO is
+        * based on FreeBSD, which #defines DLT_SLIP_BSDOS as 13).
+        *
+        * We don't yet know whether this is a Nokia capture, so if
+        * "wtap_pcap_encap_to_wtap_encap()" returned WTAP_ENCAP_UNKNOWN
+        * but "hdr.network" is 13, we don't treat that as an error yet.
+        */
        file_encap = wtap_pcap_encap_to_wtap_encap(hdr.network);
-       if (file_encap == WTAP_ENCAP_UNKNOWN) {
-               g_message("pcap: network type %u unknown or unsupported",
-                   hdr.network);
+       if (file_encap == WTAP_ENCAP_UNKNOWN && hdr.network != 13) {
                *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+               *err_info = g_strdup_printf("pcap: network type %u unknown or unsupported",
+                   hdr.network);
                return -1;
        }
 
@@ -564,6 +787,42 @@ int libpcap_open(wtap *wth, int *err)
        wth->file_encap = file_encap;
        wth->snapshot_length = hdr.snaplen;
 
+       /* In file format version 2.3, the order of the "incl_len" and
+          "orig_len" fields in the per-packet header was reversed,
+          in order to match the BPF header layout.
+
+          Therefore, in files with versions prior to that, we must swap
+          those two fields.
+
+          Unfortunately, some files were, according to a comment in the
+          "libpcap" source, written with version 2.3 in their headers
+          but without the interchanged fields, so if "incl_len" is
+          greater than "orig_len" - which would make no sense - we
+          assume that we need to swap them in version 2.3 files
+          as well.
+
+          In addition, DG/UX's tcpdump uses version 543.0, and writes
+          the two fields in the pre-2.3 order. */
+       switch (hdr.version_major) {
+
+       case 2:
+               if (hdr.version_minor < 3)
+                       wth->capture.pcap->lengths_swapped = SWAPPED;
+               else if (hdr.version_minor == 3)
+                       wth->capture.pcap->lengths_swapped = MAYBE_SWAPPED;
+               else
+                       wth->capture.pcap->lengths_swapped = NOT_SWAPPED;
+               break;
+
+       case 543:
+               wth->capture.pcap->lengths_swapped = SWAPPED;
+               break;
+
+       default:
+               wth->capture.pcap->lengths_swapped = NOT_SWAPPED;
+               break;
+       }
+
        /*
         * Is this AIX format?
         */
@@ -662,7 +921,11 @@ int libpcap_open(wtap *wth, int *err)
                 *
                 * Try the standard format first.
                 */
-               wth->file_type = WTAP_FILE_PCAP;
+               if(wth->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+                       wth->file_type = WTAP_FILE_PCAP_NSEC;
+               } else {
+                       wth->file_type = WTAP_FILE_PCAP;
+               }
                switch (libpcap_try(wth, err)) {
 
                case BAD_READ:
@@ -744,6 +1007,23 @@ int libpcap_open(wtap *wth, int *err)
                }
        }
 
+       if (hdr.network == 13) {
+               /*
+                * OK, if this was a Nokia capture, make it
+                * WTAP_ENCAP_ATM_PDUS, otherwise return
+                * an error.
+                */
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA)
+                       wth->file_encap = WTAP_ENCAP_ATM_PDUS;
+               else {
+                       *err = WTAP_ERR_UNSUPPORTED_ENCAP;
+                       *err_info = g_strdup_printf("pcap: network type %u unknown or unsupported",
+                           hdr.network);
+                       g_free(wth->capture.pcap);
+                       return -1;
+               }
+       }
+
        return 1;
 }
 
@@ -758,7 +1038,7 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
        /*
         * Attempt to read the first record's header.
         */
-       if (libpcap_read_header(wth, err, &first_rec_hdr, TRUE) == -1) {
+       if (libpcap_read_header(wth, err, NULL, &first_rec_hdr) == -1) {
                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this
@@ -797,7 +1077,7 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
        /*
         * Now attempt to read the second record's header.
         */
-       if (libpcap_read_header(wth, err, &second_rec_hdr, TRUE) == -1) {
+       if (libpcap_read_header(wth, err, NULL, &second_rec_hdr) == -1) {
                if (*err == 0 || *err == WTAP_ERR_SHORT_READ) {
                        /*
                         * EOF or short read - assume the file is in this
@@ -835,14 +1115,16 @@ static libpcap_try_t libpcap_try(wtap *wth, int *err)
 }
 
 /* Read the next packet */
-static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
+static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
+    long *data_offset)
 {
        struct pcaprec_ss990915_hdr hdr;
        guint packet_size;
        guint orig_size;
        int bytes_read;
+       guchar fddi_padding[3];
 
-       bytes_read = libpcap_read_header(wth, err, &hdr, FALSE);
+       bytes_read = libpcap_read_header(wth, err, err_info, &hdr);
        if (bytes_read == -1) {
                /*
                 * We failed to read the header.
@@ -854,6 +1136,28 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
        packet_size = hdr.hdr.incl_len;
        orig_size = hdr.hdr.orig_len;
 
+       /*
+        * AIX appears to put 3 bytes of padding in front of FDDI
+        * frames; strip that crap off.
+        */
+       if (wth->file_type == WTAP_FILE_PCAP_AIX &&
+           (wth->file_encap == WTAP_ENCAP_FDDI ||
+            wth->file_encap == WTAP_ENCAP_FDDI_BITSWAPPED)) {
+               /*
+                * The packet size is really a record size and includes
+                * the padding.
+                */
+               packet_size -= 3;
+               orig_size -= 3;
+               wth->data_offset += 3;
+
+               /*
+                * Read the padding.
+                */
+               if (!libpcap_read_rec_data(wth->fh, fddi_padding, 3, err))
+                       return FALSE;   /* Read error */
+       }
+
        *data_offset = wth->data_offset;
 
        /*
@@ -862,27 +1166,125 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
         * the VCI; read them and generate the pseudo-header from
         * them.
         */
-       if (wth->file_encap == WTAP_ENCAP_ATM_SNIFFER) {
-               if (packet_size < sizeof (struct sunatm_hdr)) {
+       switch (wth->file_encap) {
+
+       case WTAP_ENCAP_ATM_PDUS:
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        */
+                       if (packet_size < sizeof (struct nokiaatm_hdr)) {
+                               /*
+                                * Uh-oh, the packet isn't big enough to even
+                                * have a pseudo-header.
+                                */
+                               *err = WTAP_ERR_BAD_RECORD;
+                               *err_info = g_strdup_printf("libpcap: Nokia IPSO ATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+                                   packet_size);
+                               return FALSE;
+                       }
+                       if (!libpcap_read_nokiaatm_pseudoheader(wth->fh,
+                           &wth->pseudo_header, err))
+                               return FALSE;   /* Read error */
+
+                       /*
+                        * Don't count the pseudo-header as part of the
+                        * packet.
+                        */
+                       orig_size -= sizeof (struct nokiaatm_hdr);
+                       packet_size -= sizeof (struct nokiaatm_hdr);
+                       wth->data_offset += sizeof (struct nokiaatm_hdr);
+               } else {
+                       /*
+                        * SunATM.
+                        */
+                       if (packet_size < sizeof (struct sunatm_hdr)) {
+                               /*
+                                * Uh-oh, the packet isn't big enough to even
+                                * have a pseudo-header.
+                                */
+                               *err = WTAP_ERR_BAD_RECORD;
+                               *err_info = g_strdup_printf("libpcap: SunATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+                                   packet_size);
+                               return FALSE;
+                       }
+                       if (!libpcap_read_sunatm_pseudoheader(wth->fh,
+                           &wth->pseudo_header, err))
+                               return FALSE;   /* Read error */
+
+                       /*
+                        * Don't count the pseudo-header as part of the
+                        * packet.
+                        */
+                       orig_size -= sizeof (struct sunatm_hdr);
+                       packet_size -= sizeof (struct sunatm_hdr);
+                       wth->data_offset += sizeof (struct sunatm_hdr);
+               }
+               break;
+
+       case WTAP_ENCAP_ETHERNET:
+               /*
+                * We don't know whether there's an FCS in this frame or not.
+                */
+               wth->pseudo_header.eth.fcs_len = -1;
+               break;
+
+       case WTAP_ENCAP_IEEE_802_11:
+       case WTAP_ENCAP_PRISM_HEADER:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_AVS:
+               /*
+                * We don't know whether there's an FCS in this frame or not.
+                * XXX - are there any OSes where the capture mechanism
+                * supplies an FCS?
+                */
+               wth->pseudo_header.ieee_802_11.fcs_len = -1;
+               break;
+
+       case WTAP_ENCAP_IRDA:
+               if (packet_size < sizeof (struct irda_sll_hdr)) {
                        /*
                         * Uh-oh, the packet isn't big enough to even
                         * have a pseudo-header.
                         */
-                       g_message("libpcap: SunATM file has a %u-byte packet, too small to have even an ATM pseudo-header\n",
+                       *err = WTAP_ERR_BAD_RECORD;
+                       *err_info = g_strdup_printf("libpcap: IrDA file has a %u-byte packet, too small to have even an IrDA pseudo-header\n",
                            packet_size);
+                       return FALSE;
+               }
+               if (!libpcap_read_irda_pseudoheader(wth->fh, &wth->pseudo_header,
+                   err, err_info))
+                       return FALSE;   /* Read error */
+
+               /*
+                * Don't count the pseudo-header as part of the packet.
+                */
+               orig_size -= sizeof (struct irda_sll_hdr);
+               packet_size -= sizeof (struct irda_sll_hdr);
+               wth->data_offset += sizeof (struct irda_sll_hdr);
+               break;
+       case WTAP_ENCAP_MTP2_WITH_PHDR:
+               if (packet_size < sizeof (struct mtp2_hdr)) {
+                       /*
+                        * Uh-oh, the packet isn't big enough to even
+                        * have a pseudo-header.
+                        */
                        *err = WTAP_ERR_BAD_RECORD;
+                       *err_info = g_strdup_printf("libpcap: MTP2 file has a %u-byte packet, too small to have even an MTP2 pseudo-header\n",
+                           packet_size);
                        return FALSE;
                }
-               if (!libpcap_read_atm_pseudoheader(wth->fh, &wth->pseudo_header,
-                   err))
+               if (!libpcap_read_mtp2_pseudoheader(wth->fh, &wth->pseudo_header,
+                   err, err_info))
                        return FALSE;   /* Read error */
 
                /*
                 * Don't count the pseudo-header as part of the packet.
                 */
-               orig_size -= sizeof (struct sunatm_hdr);
-               packet_size -= sizeof (struct sunatm_hdr);
-               wth->data_offset += sizeof (struct sunatm_hdr);
+               orig_size -= sizeof (struct mtp2_hdr);
+               packet_size -= sizeof (struct mtp2_hdr);
+               wth->data_offset += sizeof (struct mtp2_hdr);
+               break;
        }
 
        buffer_assure_space(wth->frame_buffer, packet_size);
@@ -891,43 +1293,145 @@ static gboolean libpcap_read(wtap *wth, int *err, long *data_offset)
                return FALSE;   /* Read error */
        wth->data_offset += packet_size;
 
-       wth->phdr.ts.tv_sec = hdr.hdr.ts_sec;
-       wth->phdr.ts.tv_usec = hdr.hdr.ts_usec;
+       wth->phdr.ts.secs = hdr.hdr.ts_sec;
+       if(wth->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+               wth->phdr.ts.nsecs = hdr.hdr.ts_usec;
+       } else {
+               wth->phdr.ts.nsecs = hdr.hdr.ts_usec * 1000;
+       }
        wth->phdr.caplen = packet_size;
        wth->phdr.len = orig_size;
-       wth->phdr.pkt_encap = wth->file_encap;
+
+       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        *
+                        * Guess the traffic type based on the packet
+                        * contents.
+                        */
+                       atm_guess_traffic_type(buffer_start_ptr(wth->frame_buffer),
+                           wth->phdr.caplen, &wth->pseudo_header);
+               } else {
+                       /*
+                        * SunATM.
+                        *
+                        * If this is ATM LANE traffic, try to guess what
+                        * type of LANE traffic it is based on the packet
+                        * contents.
+                        */
+                       if (wth->pseudo_header.atm.type == TRAF_LANE) {
+                               atm_guess_lane_type(buffer_start_ptr(wth->frame_buffer),
+                                   wth->phdr.caplen, &wth->pseudo_header);
+                       }
+               }
+       }
 
        return TRUE;
 }
 
 static gboolean
 libpcap_seek_read(wtap *wth, long seek_off,
-    union wtap_pseudo_header *pseudo_header, guchar *pd, int length, int *err)
+    union wtap_pseudo_header *pseudo_header, guchar *pd, int length,
+    int *err, gchar **err_info)
 {
        if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
                return FALSE;
 
-       if (wth->file_encap == WTAP_ENCAP_ATM_SNIFFER) {
-               if (!libpcap_read_atm_pseudoheader(wth->random_fh, pseudo_header,
-                   err)) {
+       switch (wth->file_encap) {
+
+       case WTAP_ENCAP_ATM_PDUS:
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        */
+                       if (!libpcap_read_nokiaatm_pseudoheader(wth->random_fh,
+                           pseudo_header, err)) {
+                               /* Read error */
+                               return FALSE;
+                       }
+               } else {
+                       /*
+                        * SunATM.
+                        */
+                       if (!libpcap_read_sunatm_pseudoheader(wth->random_fh,
+                           pseudo_header, err)) {
+                               /* Read error */
+                               return FALSE;
+                       }
+               }
+               break;
+
+       case WTAP_ENCAP_ETHERNET:
+               /*
+                * We don't know whether there's an FCS in this frame or not.
+                */
+               pseudo_header->eth.fcs_len = -1;
+               break;
+
+       case WTAP_ENCAP_IEEE_802_11:
+       case WTAP_ENCAP_PRISM_HEADER:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_RADIOTAP:
+       case WTAP_ENCAP_IEEE_802_11_WLAN_AVS:
+               /*
+                * We don't know whether there's an FCS in this frame or not.
+                * XXX - are there any OSes where the capture mechanism
+                * supplies an FCS?
+                */
+               pseudo_header->ieee_802_11.fcs_len = -1;
+               break;
+
+       case WTAP_ENCAP_IRDA:
+               if (!libpcap_read_irda_pseudoheader(wth->random_fh, pseudo_header,
+                   err, err_info)) {
                        /* Read error */
                        return FALSE;
                }
+               break;
+       case WTAP_ENCAP_MTP2_WITH_PHDR:
+               if (!libpcap_read_mtp2_pseudoheader(wth->random_fh, pseudo_header,
+                   err, err_info)) {
+                       /* Read error */
+                       return FALSE;
+               }
+               break;
        }
 
        /*
         * Read the packet data.
         */
-       return libpcap_read_rec_data(wth->random_fh, pd, length, err);
+       if (!libpcap_read_rec_data(wth->random_fh, pd, length, err))
+               return FALSE;   /* failed */
+
+       if (wth->file_encap == WTAP_ENCAP_ATM_PDUS) {
+               if (wth->file_type == WTAP_FILE_PCAP_NOKIA) {
+                       /*
+                        * Nokia IPSO ATM.
+                        *
+                        * Guess the traffic type based on the packet
+                        * contents.
+                        */
+                       atm_guess_traffic_type(pd, length, pseudo_header);
+               } else {
+                       /*
+                        * SunATM.
+                        *
+                        * If this is ATM LANE traffic, try to guess what
+                        * type of LANE traffic it is based on the packet
+                        * contents.
+                        */
+                       if (pseudo_header->atm.type == TRAF_LANE)
+                               atm_guess_lane_type(pd, length, pseudo_header);
+               }
+       }
+       return TRUE;
 }
 
-/* Read the header of the next packet; if "silent" is TRUE, don't complain
-   to the console, as we're testing to see if the file appears to be of a
-   particular type.
+/* Read the header of the next packet.
 
    Return -1 on an error, or the number of bytes of header read on success. */
-static int libpcap_read_header(wtap *wth, int *err,
-    struct pcaprec_ss990915_hdr *hdr, gboolean silent)
+static int libpcap_read_header(wtap *wth, int *err, gchar **err_info,
+    struct pcaprec_ss990915_hdr *hdr)
 {
        int     bytes_to_read, bytes_read;
 
@@ -937,6 +1441,7 @@ static int libpcap_read_header(wtap *wth, int *err,
 
        case WTAP_FILE_PCAP:
        case WTAP_FILE_PCAP_AIX:
+       case WTAP_FILE_PCAP_NSEC:
                bytes_to_read = sizeof (struct pcaprec_hdr);
                break;
 
@@ -977,11 +1482,11 @@ static int libpcap_read_header(wtap *wth, int *err,
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */
-               if (!silent) {
-                       g_message("pcap: File has %u-byte packet, bigger than maximum of %u",
+               *err = WTAP_ERR_BAD_RECORD;
+               if (err_info != NULL) {
+                       *err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger than maximum of %u",
                            hdr->hdr.incl_len, WTAP_MAX_PACKET_SIZE);
                }
-               *err = WTAP_ERR_BAD_RECORD;
                return -1;
        }
 
@@ -994,11 +1499,11 @@ static int libpcap_read_header(wtap *wth, int *err,
                 * this is can tell when it's not the type we're guessing
                 * it is.
                 */
-               if (!silent) {
-                       g_message("pcap: File has %u-byte packet, bigger than maximum of %u",
+               *err = WTAP_ERR_BAD_RECORD;
+               if (err_info != NULL) {
+                       *err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger than maximum of %u",
                            hdr->hdr.orig_len, WTAP_MAX_PACKET_SIZE);
                }
-               *err = WTAP_ERR_BAD_RECORD;
                return -1;
        }
 
@@ -1008,6 +1513,8 @@ static int libpcap_read_header(wtap *wth, int *err,
 static void
 adjust_header(wtap *wth, struct pcaprec_hdr *hdr)
 {
+       guint32 temp;
+
        if (wth->capture.pcap->byte_swapped) {
                /* Byte-swap the record header fields. */
                hdr->ts_sec = BSWAP32(hdr->ts_sec);
@@ -1021,28 +1528,32 @@ adjust_header(wtap *wth, struct pcaprec_hdr *hdr)
        if (wth->file_type == WTAP_FILE_PCAP_AIX)
                hdr->ts_usec = hdr->ts_usec/1000;
 
-       /* In file format version 2.3, the "incl_len" and "orig_len" fields
-          were swapped, in order to match the BPF header layout.
+       /* Swap the "incl_len" and "orig_len" fields, if necessary. */
+       switch (wth->capture.pcap->lengths_swapped) {
 
-          Unfortunately, some files were, according to a comment in the
-          "libpcap" source, written with version 2.3 in their headers
-          but without the interchanged fields, so if "incl_len" is
-          greater than "orig_len" - which would make no sense - we
-          assume that we need to swap them.  */
-       if (wth->capture.pcap->version_major == 2 &&
-           (wth->capture.pcap->version_minor < 3 ||
-            (wth->capture.pcap->version_minor == 3 &&
-             hdr->incl_len > hdr->orig_len))) {
-               guint32 temp;
+       case NOT_SWAPPED:
+               break;
+
+       case MAYBE_SWAPPED:
+               if (hdr->incl_len <= hdr->orig_len) {
+                       /*
+                        * The captured length is <= the actual length,
+                        * so presumably they weren't swapped.
+                        */
+                       break;
+               }
+               /* FALLTHROUGH */
 
+       case SWAPPED:
                temp = hdr->orig_len;
                hdr->orig_len = hdr->incl_len;
                hdr->incl_len = temp;
+               break;
        }
 }
 
 static void
-libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
+libpcap_get_sunatm_pseudoheader(const struct sunatm_hdr *atm_phdr,
     union wtap_pseudo_header *pseudo_header)
 {
        guint8  vpi;
@@ -1051,11 +1562,6 @@ libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
        vpi = atm_phdr->vpi;
        vci = pntohs(&atm_phdr->vci);
 
-       /*
-        * The lower 4 bits of the first byte of the header indicate
-        * the type of traffic, as per the "atmioctl.h" header in
-        * SunATM.
-        */
        switch (atm_phdr->flags & 0x0F) {
 
        case 0x01:      /* LANE */
@@ -1111,9 +1617,10 @@ libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
 
        pseudo_header->atm.vpi = vpi;
        pseudo_header->atm.vci = vci;
-       pseudo_header->atm.channel = (atm_phdr->flags & 0x80) ? 1 : 0;
+       pseudo_header->atm.channel = (atm_phdr->flags & 0x80) ? 0 : 1;
 
        /* We don't have this information */
+       pseudo_header->atm.flags = 0;
        pseudo_header->atm.cells = 0;
        pseudo_header->atm.aal5t_u2u = 0;
        pseudo_header->atm.aal5t_len = 0;
@@ -1121,8 +1628,8 @@ libpcap_get_atm_pseudoheader(const struct sunatm_hdr *atm_phdr,
 }
 
 static gboolean
-libpcap_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
-    int *err)
+libpcap_read_sunatm_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err)
 {
        struct sunatm_hdr atm_phdr;
        int     bytes_read;
@@ -1136,11 +1643,111 @@ libpcap_read_atm_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header
                return FALSE;
        }
 
-       libpcap_get_atm_pseudoheader(&atm_phdr, pseudo_header);
+       libpcap_get_sunatm_pseudoheader(&atm_phdr, pseudo_header);
+
+       return TRUE;
+}
+
+static gboolean
+libpcap_read_nokiaatm_pseudoheader(FILE_T fh,
+    union wtap_pseudo_header *pseudo_header, int *err)
+{
+       struct nokiaatm_hdr atm_phdr;
+       int     bytes_read;
+       guint8  vpi;
+       guint16 vci;
+
+       errno = WTAP_ERR_CANT_READ;
+       bytes_read = file_read(&atm_phdr, 1, sizeof (struct nokiaatm_hdr), fh);
+       if (bytes_read != sizeof (struct nokiaatm_hdr)) {
+               *err = file_error(fh);
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+
+       vpi = atm_phdr.vpi;
+       vci = pntohs(&atm_phdr.vci);
+
+       pseudo_header->atm.vpi = vpi;
+       pseudo_header->atm.vci = vci;
+       pseudo_header->atm.channel = (atm_phdr.flags & 0x80) ? 0 : 1;
+
+       /* We don't have this information */
+       pseudo_header->atm.flags = 0;
+       pseudo_header->atm.cells = 0;
+       pseudo_header->atm.aal5t_u2u = 0;
+       pseudo_header->atm.aal5t_len = 0;
+       pseudo_header->atm.aal5t_chksum = 0;
+
+       return TRUE;
+}
+
+static gboolean
+libpcap_get_irda_pseudoheader(const struct irda_sll_hdr *irda_phdr,
+    union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info)
+{
+       if (pntohs(&irda_phdr->sll_protocol) != 0x0017) {
+               *err = WTAP_ERR_BAD_RECORD;
+               if (err_info != NULL)
+                       *err_info = g_strdup("libpcap: IrDA capture has a packet with an invalid sll_protocol field\n");
+               return FALSE;
+       }
+
+       pseudo_header->irda.pkttype = pntohs(&irda_phdr->sll_pkttype);
 
        return TRUE;
 }
 
+static gboolean
+libpcap_read_irda_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header,
+    int *err, gchar **err_info)
+{
+       struct irda_sll_hdr irda_phdr;
+       int     bytes_read;
+
+       errno = WTAP_ERR_CANT_READ;
+       bytes_read = file_read(&irda_phdr, 1, sizeof (struct irda_sll_hdr), fh);
+       if (bytes_read != sizeof (struct irda_sll_hdr)) {
+               *err = file_error(fh);
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+
+       return libpcap_get_irda_pseudoheader(&irda_phdr, pseudo_header, err,
+           err_info);
+}
+
+static gboolean
+libpcap_get_mtp2_pseudoheader(const struct mtp2_hdr *mtp2_hdr, union wtap_pseudo_header *pseudo_header)
+{
+       pseudo_header->mtp2.sent         = mtp2_hdr->sent;
+       pseudo_header->mtp2.annex_a_used = mtp2_hdr->annex_a_used;
+       pseudo_header->mtp2.link_number  = pntohs(&mtp2_hdr->link_number);
+
+       return TRUE;
+}
+
+static gboolean
+libpcap_read_mtp2_pseudoheader(FILE_T fh, union wtap_pseudo_header *pseudo_header, int *err, gchar **err_info _U_)
+{
+       struct mtp2_hdr mtp2_hdr;
+       int    bytes_read;
+
+       errno = WTAP_ERR_CANT_READ;
+       bytes_read = file_read(&mtp2_hdr, 1, sizeof (struct mtp2_hdr), fh);
+       if (bytes_read != sizeof (struct mtp2_hdr)) {
+               *err = file_error(fh);
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+
+       return libpcap_get_mtp2_pseudoheader(&mtp2_hdr, pseudo_header);
+            
+}
+
 static gboolean
 libpcap_read_rec_data(FILE_T fh, guchar *pd, int length, int *err)
 {
@@ -1168,15 +1775,58 @@ static int wtap_wtap_encap_to_pcap_encap(int encap)
 {
        unsigned int i;
 
-       /*
-        * Special-case WTAP_ENCAP_FDDI and WTAP_ENCAP_FDDI_BITSWAPPED;
-        * both of them get mapped to DLT_FDDI (even though that may
-        * mean that the bit order in the FDDI MAC addresses is wrong;
-        * so it goes - libpcap format doesn't record the byte order,
-        * so that's not fixable).
-        */
-       if (encap == WTAP_ENCAP_FDDI || encap == WTAP_ENCAP_FDDI_BITSWAPPED)
+       switch (encap) {
+
+       case WTAP_ENCAP_FDDI:
+       case WTAP_ENCAP_FDDI_BITSWAPPED:
+       case WTAP_ENCAP_NETTL_FDDI:
+               /*
+                * Special-case WTAP_ENCAP_FDDI and
+                * WTAP_ENCAP_FDDI_BITSWAPPED; both of them get mapped
+                * to DLT_FDDI (even though that may mean that the bit
+                * order in the FDDI MAC addresses is wrong; so it goes
+                * - libpcap format doesn't record the byte order,
+                * so that's not fixable).
+                */
                return 10;      /* that's DLT_FDDI */
+
+       case WTAP_ENCAP_PPP_WITH_PHDR:
+               /*
+                * Also special-case PPP with direction bits; map it to
+                * PPP, even though that means that the direction of the
+                * packet is lost.
+                */
+               return 9;
+
+       case WTAP_ENCAP_FRELAY_WITH_PHDR:
+               /*
+                * Do the same with Frame Relay.
+                */
+               return 107;
+
+       case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+               /*
+                * Map this to DLT_IEEE802_11, for now, even though
+                * that means the radio information will be lost.
+                * Once tcpdump support for the BSD radiotap header
+                * is sufficiently widespread, we should probably
+                * use that, instead - although we should probably
+                * ultimately just have WTAP_ENCAP_IEEE_802_11
+                * as the only Wiretap encapsulation for 802.11,
+                * and have the pseudo-header include a radiotap-style
+                * list of attributes.  If we do that, though, we
+                * should probably bypass the regular Wiretap code
+                * when writing out packets during a capture, and just
+                * do the equivalent of a libpcap write (unfortunately,
+                * libpcap doesn't have an "open dump by file descriptor"
+                * function, so we can't just use "pcap_dump()"), so
+                * that we don't spend cycles mapping from libpcap to
+                * Wiretap and then back to libpcap.  (There are other
+                * reasons to do that, e.g. to handle AIX libpcap better.)
+                */
+               return 105;
+       }
+
        for (i = 0; i < NUM_PCAP_ENCAPS; i++) {
                if (pcap_to_wtap_map[i].wtap_encap_value == encap)
                        return pcap_to_wtap_map[i].dlt_value;
@@ -1200,8 +1850,8 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
           be a "struct bpf_timeval", with member sizes wired to 32
           bits - and we may go that way ourselves in the future, so
           copy the members individually. */
-       whdr->ts.tv_sec = phdr->ts.tv_sec;
-       whdr->ts.tv_usec = phdr->ts.tv_usec;
+       whdr->ts.secs = phdr->ts.tv_sec;
+       whdr->ts.nsecs = phdr->ts.tv_usec * 1000;
        whdr->caplen = phdr->caplen;
        whdr->len = phdr->len;
        whdr->pkt_encap = linktype;
@@ -1212,7 +1862,7 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
         * the VCI; read them and generate the pseudo-header from
         * them.
         */
-       if (linktype == WTAP_ENCAP_ATM_SNIFFER) {
+       if (linktype == WTAP_ENCAP_ATM_PDUS) {
                if (whdr->caplen < sizeof (struct sunatm_hdr)) {
                        /*
                         * Uh-oh, the packet isn't big enough to even
@@ -1223,7 +1873,7 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
                        *err = WTAP_ERR_BAD_RECORD;
                        return NULL;
                }
-               libpcap_get_atm_pseudoheader((struct sunatm_hdr *)pd,
+               libpcap_get_sunatm_pseudoheader((const struct sunatm_hdr *)pd,
                    pseudo_header);
 
                /*
@@ -1232,6 +1882,56 @@ wtap_process_pcap_packet(gint linktype, const struct pcap_pkthdr *phdr,
                whdr->len -= sizeof (struct sunatm_hdr);
                whdr->caplen -= sizeof (struct sunatm_hdr);
                pd += sizeof (struct sunatm_hdr);
+
+               /*
+                * If this is ATM LANE traffic, try to guess what type of
+                * LANE traffic it is based on the packet contents.
+                */
+               if (pseudo_header->atm.type == TRAF_LANE)
+                       atm_guess_lane_type(pd, whdr->caplen, pseudo_header);
+       }
+       else if (linktype == WTAP_ENCAP_IRDA) {
+               if (whdr->caplen < sizeof (struct irda_sll_hdr)) {
+                       /*
+                        * Uh-oh, the packet isn't big enough to even
+                        * have a pseudo-header.
+                        */
+                       g_message("libpcap: IrDA capture has a %u-byte packet, too small to have even an IrDA pseudo-header\n",
+                           whdr->caplen);
+                       *err = WTAP_ERR_BAD_RECORD;
+                       return NULL;
+               }
+               if (!libpcap_get_irda_pseudoheader((const struct irda_sll_hdr *)pd,
+                       pseudo_header, err, NULL))
+                       return NULL;
+
+               /*
+                * Don't count the pseudo-header as part of the packet.
+                */
+               whdr->len -= sizeof (struct irda_sll_hdr);
+               whdr->caplen -= sizeof (struct irda_sll_hdr);
+               pd += sizeof (struct irda_sll_hdr);
+       }
+       else if (linktype == WTAP_ENCAP_MTP2_WITH_PHDR) {
+               if (whdr->caplen < sizeof (struct mtp2_hdr)) {
+                       /*
+                        * Uh-oh, the packet isn't big enough to even
+                        * have a pseudo-header.
+                        */
+                       g_message("libpcap: MTP2 capture has a %u-byte packet, too small to have even an MTP2 pseudo-header\n",
+                           whdr->caplen);
+                       *err = WTAP_ERR_BAD_RECORD;
+                       return NULL;
+               }
+               if (!libpcap_get_mtp2_pseudoheader((const struct mtp2_hdr *)pd, pseudo_header))
+                       return NULL;
+
+               /*
+                * Don't count the pseudo-header as part of the packet.
+                */
+               whdr->len -= sizeof (struct mtp2_hdr);
+               whdr->caplen -= sizeof (struct mtp2_hdr);
+               pd += sizeof (struct mtp2_hdr);
        }
        return pd;
 }
@@ -1270,11 +1970,18 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
        case WTAP_FILE_PCAP_SS990417:   /* modified, but with the old magic, sigh */
        case WTAP_FILE_PCAP_NOKIA:      /* Nokia libpcap of some sort */
                magic = PCAP_MAGIC;
+               wdh->tsprecision = WTAP_FILE_TSPREC_USEC;
                break;
 
        case WTAP_FILE_PCAP_SS990915:   /* new magic, extra crap */
        case WTAP_FILE_PCAP_SS991029:
                magic = PCAP_MODIFIED_MAGIC;
+               wdh->tsprecision = WTAP_FILE_TSPREC_USEC;
+               break;
+
+       case WTAP_FILE_PCAP_NSEC:               /* same as WTAP_FILE_PCAP, but nsec precision */
+               magic = PCAP_NSEC_MAGIC;
+               wdh->tsprecision = WTAP_FILE_TSPREC_NSEC;
                break;
 
        default:
@@ -1284,10 +1991,10 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
                return FALSE;
        }
 
-       nwritten = fwrite(&magic, 1, sizeof magic, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &magic, sizeof magic);
        if (nwritten != sizeof magic) {
-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
@@ -1313,10 +2020,10 @@ gboolean libpcap_dump_open(wtap_dumper *wdh, gboolean cant_seek _U_, int *err)
        file_hdr.snaplen = (wdh->snaplen != 0) ? wdh->snaplen :
                                                 WTAP_MAX_PACKET_SIZE;
        file_hdr.network = wtap_wtap_encap_to_pcap_encap(wdh->encap);
-       nwritten = fwrite(&file_hdr, 1, sizeof file_hdr, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &file_hdr, sizeof file_hdr);
        if (nwritten != sizeof file_hdr) {
-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
@@ -1337,20 +2044,29 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
        size_t hdr_size;
        size_t nwritten;
        struct sunatm_hdr atm_hdr;
-       int atm_hdrsize;
-
-       if (wdh->encap == WTAP_ENCAP_ATM_SNIFFER)
-               atm_hdrsize = sizeof (struct sunatm_hdr);
+       struct irda_sll_hdr irda_hdr;
+       struct mtp2_hdr mtp2_hdr;
+       int hdrsize;
+
+       if (wdh->encap == WTAP_ENCAP_ATM_PDUS)
+               hdrsize = sizeof (struct sunatm_hdr);
+       else if (wdh->encap == WTAP_ENCAP_IRDA)
+               hdrsize = sizeof (struct irda_sll_hdr);
        else
-               atm_hdrsize = 0;
+               hdrsize = 0;
 
-       rec_hdr.hdr.ts_sec = phdr->ts.tv_sec;
-       rec_hdr.hdr.ts_usec = phdr->ts.tv_usec;
-       rec_hdr.hdr.incl_len = phdr->caplen + atm_hdrsize;
-       rec_hdr.hdr.orig_len = phdr->len + atm_hdrsize;
+       rec_hdr.hdr.ts_sec = phdr->ts.secs;
+       if(wdh->tsprecision == WTAP_FILE_TSPREC_NSEC) {
+               rec_hdr.hdr.ts_usec = phdr->ts.nsecs;
+       } else {
+               rec_hdr.hdr.ts_usec = phdr->ts.nsecs / 1000;
+       }
+       rec_hdr.hdr.incl_len = phdr->caplen + hdrsize;
+       rec_hdr.hdr.orig_len = phdr->len + hdrsize;
        switch (wdh->file_type) {
 
        case WTAP_FILE_PCAP:
+       case WTAP_FILE_PCAP_NSEC:
                hdr_size = sizeof (struct pcaprec_hdr);
                break;
 
@@ -1407,22 +2123,22 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
                return FALSE;
        }
 
-       nwritten = fwrite(&rec_hdr, 1, hdr_size, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, &rec_hdr, hdr_size);
        if (nwritten != hdr_size) {
-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;
        }
        wdh->bytes_dumped += hdr_size;
 
-       if (wdh->encap == WTAP_ENCAP_ATM_SNIFFER) {
+       if (wdh->encap == WTAP_ENCAP_ATM_PDUS) {
                /*
                 * Write the ATM header.
                 */
                atm_hdr.flags =
-                   (pseudo_header->atm.channel != 0) ? 0x80 : 0x00;
+                   (pseudo_header->atm.channel == 0) ? 0x80 : 0x00;
                switch (pseudo_header->atm.aal) {
 
                case AAL_SIGNALLING:
@@ -1450,23 +2166,58 @@ static gboolean libpcap_dump(wtap_dumper *wdh,
                        }
                        break;
                }
-               atm_hdr.vpi = pseudo_header->atm.vpi;
+               atm_hdr.vpi = (guint8) pseudo_header->atm.vpi;
                atm_hdr.vci = phtons(&pseudo_header->atm.vci);
-               nwritten = fwrite(&atm_hdr, 1, sizeof atm_hdr, wdh->fh);
+               nwritten = wtap_dump_file_write(wdh, &atm_hdr, sizeof atm_hdr);
                if (nwritten != sizeof atm_hdr) {
-                       if (nwritten == 0 && ferror(wdh->fh))
-                               *err = errno;
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);
                        else
                                *err = WTAP_ERR_SHORT_WRITE;
                        return FALSE;
                }
                wdh->bytes_dumped += sizeof atm_hdr;
        }
+       else if (wdh->encap == WTAP_ENCAP_IRDA) {
+               /*
+                * Write the IrDA header.
+                */
+               memset(&irda_hdr, 0, sizeof(irda_hdr));
+               irda_hdr.sll_pkttype  = phtons(&pseudo_header->irda.pkttype);
+               irda_hdr.sll_protocol = g_htons(0x0017);
+               nwritten = wtap_dump_file_write(wdh, &irda_hdr, sizeof(irda_hdr));
+               if (nwritten != sizeof(irda_hdr)) {
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);
+                       else
+                               *err = WTAP_ERR_SHORT_WRITE;
+                       return FALSE;
+               }
+               wdh->bytes_dumped += sizeof(irda_hdr);
+       }
+       else if (wdh->encap == WTAP_ENCAP_MTP2_WITH_PHDR) {
+               /*
+                * Write the MTP2 header.
+                */
+               memset(&mtp2_hdr, 0, sizeof(mtp2_hdr));
+               mtp2_hdr.sent         = pseudo_header->mtp2.sent;
+               mtp2_hdr.annex_a_used = pseudo_header->mtp2.annex_a_used;
+               mtp2_hdr.link_number  = phtons(&pseudo_header->mtp2.link_number);
+               nwritten = wtap_dump_file_write(wdh, &mtp2_hdr, sizeof(mtp2_hdr));
+               if (nwritten != sizeof(mtp2_hdr)) {
+                       if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                               *err = wtap_dump_file_ferror(wdh);
+                       else
+                               *err = WTAP_ERR_SHORT_WRITE;
+                       return FALSE;
+               }
+               wdh->bytes_dumped += sizeof(mtp2_hdr);
+       }
 
-       nwritten = fwrite(pd, 1, phdr->caplen, wdh->fh);
+       nwritten = wtap_dump_file_write(wdh, pd, phdr->caplen);
        if (nwritten != phdr->caplen) {
-               if (nwritten == 0 && ferror(wdh->fh))
-                       *err = errno;
+               if (nwritten == 0 && wtap_dump_file_ferror(wdh))
+                       *err = wtap_dump_file_ferror(wdh);
                else
                        *err = WTAP_ERR_SHORT_WRITE;
                return FALSE;