Add a presence flag field to the packet information structure filled in

by Wiretap, to indicate whether certain fields in that structure
actually have data in them.

Use the "time stamp present" flag to omit showing time stamp information
for packets (and "packets") that don't have time stamps; don't bother
working very hard to "fake" a time stamp for data files.

Use the "interface ID present" flag to omit the interface ID for packets
that don't have an interface ID.

We don't use the "captured length, separate from packet length, present"
flag to omit the captured length; that flag might be present but equal
to the packet length, and if you want to know if a packet was cut short
by a snapshot length, comparing the values would be the way to do that.

More work is needed to have wiretap/pcapng.c properly report the flags,
e.g. reporting no time stamp being present for a Simple Packet Block.

svn path=/trunk/; revision=41185

44 files changed, 120 insertions, 22 deletions

diff --git a/wiretap/5views.c b/wiretap/5views.c
index 98e9d325a3..90e2e75f1a 100644
--- a/wiretap/5views.c
+++ b/wiretap/5views.c
@@ -262,6 +262,7 @@ _5views_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 	TimeStamped_Header.Utc = pletohl(&TimeStamped_Header.Utc);
 	TimeStamped_Header.NanoSecondes =
 	    pletohl(&TimeStamped_Header.NanoSecondes);
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 	wth->phdr.ts.secs = TimeStamped_Header.Utc;
 	wth->phdr.ts.nsecs = TimeStamped_Header.NanoSecondes;
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/aethra.c b/wiretap/aethra.c
index ae53423785..b6099b681a 100644
--- a/wiretap/aethra.c
+++ b/wiretap/aethra.c
@@ -298,6 +298,7 @@ packet, hdr.rec_type, packet_size, hdr.flags);
 
 found:
 	msecs = pletohl(hdr.timestamp);
+	wth->phdr.presence_flags = WTAP_HAS_TS;
 	wth->phdr.ts.secs = aethra->start + (msecs / 1000);
 	wth->phdr.ts.nsecs = (msecs % 1000) * 1000000;
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/airopeek9.c b/wiretap/airopeek9.c
index 44a520b52f..b322e8bf04 100644
--- a/wiretap/airopeek9.c
+++ b/wiretap/airopeek9.c
@@ -517,6 +517,8 @@ static gboolean airopeekv9_read(wtap *wth, int *err, gchar **err_info,
 	return FALSE;
     }
 
+    wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
     /* fill in packet header length values before slicelength may be
        adjusted */
     wth->phdr.len    = hdr_info.length;
diff --git a/wiretap/ascendtext.c b/wiretap/ascendtext.c
index 612a202b09..569713e043 100644
--- a/wiretap/ascendtext.c
+++ b/wiretap/ascendtext.c
@@ -317,6 +317,7 @@ static gboolean ascend_read(wtap *wth, int *err, gchar **err_info,
     if (ascend->inittime > header.secs)
       ascend->inittime -= header.secs;
   }
+  wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
   wth->phdr.ts.secs = header.secs + ascend->inittime;
   wth->phdr.ts.nsecs = header.usecs * 1000;
   wth->phdr.caplen = header.caplen;
diff --git a/wiretap/ber.c b/wiretap/ber.c
index e426246d0a..df0b1687af 100644
--- a/wiretap/ber.c
+++ b/wiretap/ber.c
@@ -47,7 +47,6 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
   guint8 *buf;
   gint64 file_size;
   int packet_size;
-  ws_statb64 statb;
 
   *err = 0;
 
@@ -79,13 +78,12 @@ static gboolean ber_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
 
   wth->data_offset += packet_size;
 
+  wth->phdr.presence_flags = 0; /* yes, we have no bananas^Wtime stamp */
+
   wth->phdr.caplen = packet_size;
   wth->phdr.len = packet_size;
 
-  if (wtap_fstat(wth, &statb, err) == -1)
-    return FALSE;
-
-  wth->phdr.ts.secs = statb.st_mtime;
+  wth->phdr.ts.secs = 0;
   wth->phdr.ts.nsecs = 0;
 
   return TRUE;
diff --git a/wiretap/btsnoop.c b/wiretap/btsnoop.c
index 8863f8967f..a8e6d80e73 100644
--- a/wiretap/btsnoop.c
+++ b/wiretap/btsnoop.c
@@ -206,6 +206,7 @@ static gboolean btsnoop_read(wtap *wth, int *err, gchar **err_info,
 	ts = GINT64_FROM_BE(hdr.ts_usec);
 	ts -= KUnixTimeBase;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 	wth->phdr.ts.secs = (guint)(ts / 1000000);
 	wth->phdr.ts.nsecs = (guint)((ts % 1000000) * 1000);
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/catapult_dct2000.c b/wiretap/catapult_dct2000.c
index 865d9b9826..041ee83275 100644
--- a/wiretap/catapult_dct2000.c
+++ b/wiretap/catapult_dct2000.c
@@ -334,6 +334,8 @@ catapult_dct2000_read(wtap *wth, int *err, gchar **err_info _U_,
 
             g_snprintf(timestamp_string, MAX_TIMESTAMP_LEN, "%d.%04d", seconds, useconds/100);
 
+            wth->phdr.presence_flags = WTAP_HAS_TS;
+
             /* All packets go to Catapult DCT2000 stub dissector */
             wth->phdr.pkt_encap = WTAP_ENCAP_CATAPULT_DCT2000;
 
diff --git a/wiretap/commview.c b/wiretap/commview.c
index 31aa385646..15d619b239 100644
--- a/wiretap/commview.c
+++ b/wiretap/commview.c
@@ -212,6 +212,8 @@ commview_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 
 	wth->data_offset += cv_hdr.data_len;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
+
 	wth->phdr.len = cv_hdr.data_len;
 	wth->phdr.caplen = cv_hdr.data_len;
 
diff --git a/wiretap/cosine.c b/wiretap/cosine.c
index 390070024b..083ce596b7 100644
--- a/wiretap/cosine.c
+++ b/wiretap/cosine.c
@@ -335,6 +335,7 @@ static gboolean cosine_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;
 
 	wth->data_offset = offset;
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 	wth->phdr.caplen = caplen;
 	*data_offset = offset;
 	return TRUE;
diff --git a/wiretap/csids.c b/wiretap/csids.c
index 093d8eb4b5..fb05e34b35 100644
--- a/wiretap/csids.c
+++ b/wiretap/csids.c
@@ -187,6 +187,7 @@ static gboolean csids_read(wtap *wth, int *err, gchar **err_info,
 
   wth->data_offset += hdr.caplen;
 
+  wth->phdr.presence_flags = WTAP_HAS_TS;
   wth->phdr.len = hdr.caplen;
   wth->phdr.caplen = hdr.caplen;
   wth->phdr.ts.secs = hdr.seconds;
diff --git a/wiretap/daintree-sna.c b/wiretap/daintree-sna.c
index d9094c4452..0b66f7e897 100644
--- a/wiretap/daintree-sna.c
+++ b/wiretap/daintree-sna.c
@@ -152,6 +152,8 @@ daintree_sna_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 		wth->data_offset += strlen(readLine);
 	} while (readLine[0] == COMMENT_LINE);
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	/* parse one line of capture data */
 	if (sscanf(readLine, "%*s %18" G_GINT64_MODIFIER "u.%9d %9u %" READDATA_MAX_FIELD_SIZE "s",
 	    &seconds, &wth->phdr.ts.nsecs, &wth->phdr.len, readData) != 4) {
diff --git a/wiretap/dbs-etherwatch.c b/wiretap/dbs-etherwatch.c
index 366a118aba..7bc6ff1be6 100644
--- a/wiretap/dbs-etherwatch.c
+++ b/wiretap/dbs-etherwatch.c
@@ -477,6 +477,8 @@ parse_dbs_etherwatch_packet(wtap *wth, FILE_T fh, guint8* buf, int *err,
 	}
 
 	if (wth) {
+		wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 		p = strstr(months, mon);
 		if (p)
 			tm.tm_mon = (int)(p - months) / 3;
diff --git a/wiretap/dct3trace.c b/wiretap/dct3trace.c
index 12910bebac..f3a6169abd 100644
--- a/wiretap/dct3trace.c
+++ b/wiretap/dct3trace.c
@@ -352,6 +352,7 @@ static gboolean dct3trace_read(wtap *wth, int *err, gchar **err_info,
 	}
 
 	/* We've got a full packet! */
+	wth->phdr.presence_flags = 0; /* no time stamp, no separate "on the wire" length */
 	wth->phdr.ts.secs = 0;
 	wth->phdr.ts.nsecs = 0;
 	wth->phdr.caplen = buf_len;
diff --git a/wiretap/erf.c b/wiretap/erf.c
index aee62fa304..2ffddfabdb 100644
--- a/wiretap/erf.c
+++ b/wiretap/erf.c
@@ -377,6 +377,7 @@ static int erf_read_header(FILE_T fh,
   if (phdr != NULL) {
     guint64 ts = pletohll(&erf_header->ts);
 
+    phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
     phdr->ts.secs = (long) (ts >> 32);
     ts = ((ts & 0xffffffff) * 1000 * 1000 * 1000);
     ts += (ts & 0x80000000) << 1; /* rounding */
diff --git a/wiretap/etherpeek.c b/wiretap/etherpeek.c
index e28b373f0e..b0cb8c12b3 100644
--- a/wiretap/etherpeek.c
+++ b/wiretap/etherpeek.c
@@ -402,6 +402,8 @@ static gboolean etherpeek_read_v7(wtap *wth, int *err, gchar **err_info,
 		sliceLength = length;
 	}
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+	
 	/* fill in packet header length values before slicelength may be
 	   adjusted */
 	wth->phdr.len    = length;
diff --git a/wiretap/eyesdn.c b/wiretap/eyesdn.c
index c2bf571e7c..897e32e329 100644
--- a/wiretap/eyesdn.c
+++ b/wiretap/eyesdn.c
@@ -367,6 +367,7 @@ parse_eyesdn_rec_hdr(wtap *wth, FILE_T fh,
 	}
 
 	if (wth) {
+		wth->phdr.presence_flags = WTAP_HAS_TS;
 		wth->phdr.ts.secs = secs;
 		wth->phdr.ts.nsecs = usecs * 1000;
 		wth->phdr.caplen = pkt_len;
diff --git a/wiretap/hcidump.c b/wiretap/hcidump.c
index 07242fe4e1..fdcc3cb175 100644
--- a/wiretap/hcidump.c
+++ b/wiretap/hcidump.c
@@ -80,6 +80,7 @@ static gboolean hcidump_read(wtap *wth, int *err, gchar **err_info,
 	}
 	wth->data_offset += packet_size;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
 	wth->phdr.ts.secs = GUINT32_FROM_LE(dh.ts_sec);
 	wth->phdr.ts.nsecs = GUINT32_FROM_LE(dh.ts_usec) * 1000;
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/i4btrace.c b/wiretap/i4btrace.c
index ce6421aefc..05b6087583 100644
--- a/wiretap/i4btrace.c
+++ b/wiretap/i4btrace.c
@@ -156,6 +156,8 @@ static gboolean i4btrace_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;
 	}
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
+
 	wth->phdr.len = length;
 	wth->phdr.caplen = length;
 
diff --git a/wiretap/ipfix.c b/wiretap/ipfix.c
index cdfcdc53e9..07a7c0acee 100644
--- a/wiretap/ipfix.c
+++ b/wiretap/ipfix.c
@@ -275,6 +275,7 @@ ipfix_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
     wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
                    msg_hdr.message_length, wth->fh, err, err_info);
 
+    wth->phdr.presence_flags = 0;
     wth->phdr.len = msg_hdr.message_length;
     wth->phdr.caplen = msg_hdr.message_length;
     wth->phdr.ts.secs =  0;
diff --git a/wiretap/iptrace.c b/wiretap/iptrace.c
index b9a382c810..3b6c7739e2 100644
--- a/wiretap/iptrace.c
+++ b/wiretap/iptrace.c
@@ -212,6 +212,7 @@ static gboolean iptrace_read_1_0(wtap *wth, int *err, gchar **err_info,
 		return FALSE;	/* Read error */
 	wth->data_offset += packet_size;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
 	wth->phdr.len = packet_size;
 	wth->phdr.caplen = packet_size;
 	wth->phdr.ts.secs = pntohl(&header[4]);
@@ -426,6 +427,7 @@ static gboolean iptrace_read_2_0(wtap *wth, int *err, gchar **err_info,
 		return FALSE;	/* Read error */
 	wth->data_offset += packet_size;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
 	wth->phdr.len = packet_size;
 	wth->phdr.caplen = packet_size;
 	wth->phdr.ts.secs = pntohl(&header[32]);
diff --git a/wiretap/iseries.c b/wiretap/iseries.c
index d77ee728e9..66eec92204 100644
--- a/wiretap/iseries.c
+++ b/wiretap/iseries.c
@@ -616,6 +616,8 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
       return -1;
     }
 
+  wth->phdr.presence_flags = WTAP_HAS_CAP_LEN;
+
   /*
    * If we have Wiretap Header then populate it here
    *
@@ -625,6 +627,7 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
    */
   if (iseries->have_date)
     {
+      wth->phdr.presence_flags |= WTAP_HAS_TS;
       tm.tm_year = 100 + iseries->year;
       tm.tm_mon = iseries->month - 1;
       tm.tm_mday = iseries->day;
@@ -645,9 +648,9 @@ iseries_parse_packet (wtap * wth, FILE_T fh,
 	}
     }
 
-    wth->phdr.caplen = cap_len;
-    wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET;
-    pseudo_header->eth.fcs_len = -1;
+  wth->phdr.caplen = cap_len;
+  wth->phdr.pkt_encap = WTAP_ENCAP_ETHERNET;
+  pseudo_header->eth.fcs_len = -1;
 
   /*
    * Start Reading packet contents
diff --git a/wiretap/k12.c b/wiretap/k12.c
index 0ff3d68f16..cabfd26935 100644
--- a/wiretap/k12.c
+++ b/wiretap/k12.c
@@ -450,6 +450,8 @@ static gboolean k12_read(wtap *wth, int *err, gchar **err_info, gint64 *data_off
 
     wth->data_offset = offset;
 
+    wth->phdr.presence_flags = WTAP_HAS_TS;
+
     ts = pntohll(buffer + K12_PACKET_TIMESTAMP);
 
     wth->phdr.ts.secs = (guint32) ((ts / 2000000) + 631152000);
diff --git a/wiretap/k12text.l b/wiretap/k12text.l
index 95fd387b9c..867725231c 100644
--- a/wiretap/k12text.l
+++ b/wiretap/k12text.l
@@ -250,6 +250,8 @@ k12text_read(wtap *wth, int *err, char ** err_info, gint64 *data_offset)
 	*data_offset = wth->data_offset;       /* file position for beginning of this frame   */
 	wth->data_offset += file_bytes_read;   /* file position after end of this frame       */
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	wth->phdr.ts.secs = 946681200 + (3600*g_h) + (60*g_m) + g_s;
 	wth->phdr.ts.nsecs = 1000000*g_ms + 1000*g_ns;
 
diff --git a/wiretap/lanalyzer.c b/wiretap/lanalyzer.c
index 5fbf8714c2..d762f386c0 100644
--- a/wiretap/lanalyzer.c
+++ b/wiretap/lanalyzer.c
@@ -522,6 +522,8 @@ static gboolean lanalyzer_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;
 	}
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	time_low = pletohs(&descriptor[8]);
 	time_med = pletohs(&descriptor[10]);
 	time_high = pletohs(&descriptor[12]);
diff --git a/wiretap/libpcap.c b/wiretap/libpcap.c
index c5d1b31738..22ace095ae 100644
--- a/wiretap/libpcap.c
+++ b/wiretap/libpcap.c
@@ -661,6 +661,8 @@ static gboolean libpcap_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;	/* Read error */
 	wth->data_offset += packet_size;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	/* Update the Timestamp, if not already done */
 	if (wth->file_encap != WTAP_ENCAP_ERF) {
 	  wth->phdr.ts.secs = hdr.hdr.ts_sec;
diff --git a/wiretap/mime_file.c b/wiretap/mime_file.c
index 2cb1ebdb36..ff46ab9e7a 100644
--- a/wiretap/mime_file.c
+++ b/wiretap/mime_file.c
@@ -93,7 +93,9 @@ mime_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 		return FALSE;
 	}
 
-	wth->phdr.ts.secs = (time_t) wth->data_offset;
+	wth->phdr.presence_flags = 0;
+
+	wth->phdr.ts.secs = 0;
 	wth->phdr.ts.nsecs = 0;
 
 	*data_offset = wth->data_offset;
diff --git a/wiretap/mpeg.c b/wiretap/mpeg.c
index cf60fe2375..eedbd6ca2b 100644
--- a/wiretap/mpeg.c
+++ b/wiretap/mpeg.c
@@ -232,6 +232,7 @@ mpeg_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 				packet_size, err, err_info))
 		return FALSE;
 	wth->data_offset += packet_size;
+	wth->phdr.presence_flags = WTAP_HAS_TS; /* XXX - relative, not absolute! */
 	wth->phdr.ts = ts;
 	wth->phdr.caplen = packet_size;
 	wth->phdr.len = packet_size;
@@ -297,7 +298,7 @@ good_magic:
 
 	mpeg = (mpeg_t *)g_malloc(sizeof(mpeg_t));
 	wth->priv = (void *)mpeg;
-	mpeg->now.secs = time(NULL);
+	mpeg->now.secs = 0;
 	mpeg->now.nsecs = 0;
 	mpeg->t0 = mpeg->now.secs;
 
diff --git a/wiretap/netmon.c b/wiretap/netmon.c
index 23a2d8a23b..53563dedff 100644
--- a/wiretap/netmon.c
+++ b/wiretap/netmon.c
@@ -677,6 +677,7 @@ again:
 	}
 	secs += (time_t)(t/1000000000);
 	nsecs = (guint32)(t%1000000000);
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 	wth->phdr.ts.secs = netmon->start_secs + secs;
 	wth->phdr.ts.nsecs = nsecs;
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/netscaler.c b/wiretap/netscaler.c
index a4a634d1d7..5f07aaca94 100644
--- a/wiretap/netscaler.c
+++ b/wiretap/netscaler.c
@@ -700,6 +700,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 			case NSPR_PDPKTRACEFULLTXB_V10:
 			case NSPR_PDPKTRACEFULLRX_V10:
 
+				wth->phdr.presence_flags = WTAP_HAS_TS;
+
 				nsg_creltime += ns_hrtime2nsec(pletohl(&fp->fp_RelTimeHr));
 				wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);
 				wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);
@@ -724,6 +726,8 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 			case NSPR_PDPKTRACEPARTTXB_V10:
 			case NSPR_PDPKTRACEPARTRX_V10:
 
+				wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 				nsg_creltime += ns_hrtime2nsec(pletohl(&pp->pp_RelTimeHr));
 				wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);
 				wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);
@@ -777,6 +781,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 
 #define TIMEDEFV20(fp,type) \
 	do {\
+		wth->phdr.presence_flags |= WTAP_HAS_TS;\
 		nsg_creltime += ns_hrtime2nsec(pletohl(fp->type##_RelTimeHr));\
 		wth->phdr.ts.secs = nstrace->nspm_curtime + (guint32) (nsg_creltime / 1000000000);\
 		wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);\
@@ -784,6 +789,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 
 #define TIMEDEFV23(fp,type) \
 	do {\
+		wth->phdr.presence_flags |= WTAP_HAS_TS;\
 		/* access _AbsTimeHr as a 64bit value */\
 		nsg_creltime = pletohll(fp->type##_AbsTimeHr);\
 		wth->phdr.ts.secs = (guint32) (nsg_creltime / 1000000000);\
@@ -795,6 +801,7 @@ gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 
 #define PPSIZEDEFV20(pp,ver) \
 	do {\
+		wth->phdr.presence_flags |= WTAP_HAS_CAP_LEN;\
 		wth->phdr.len = pletohs(&pp->pp_PktSizeOrg) + nspr_pktracepart_v##ver##_s;\
 		wth->phdr.caplen = nspr_getv20recordsize((nspr_hd_v20_t *)pp);\
 	}while(0)
diff --git a/wiretap/netscreen.c b/wiretap/netscreen.c
index e3c29e70f3..d5011c84ce 100644
--- a/wiretap/netscreen.c
+++ b/wiretap/netscreen.c
@@ -233,6 +233,8 @@ static gboolean netscreen_read(wtap *wth, int *err, gchar **err_info,
 	if (offset < 0)
 		return FALSE;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	/* Parse the header */
 	pkt_len = parse_netscreen_rec_hdr(wth, line, cap_int, &cap_dir, cap_dst,
 		&wth->pseudo_header, err, err_info);
diff --git a/wiretap/nettl.c b/wiretap/nettl.c
index 735fe9edf7..83868011bf 100644
--- a/wiretap/nettl.c
+++ b/wiretap/nettl.c
@@ -640,6 +640,7 @@ nettl_read_rec_header(wtap *wth, FILE_T fh, struct wtap_pkthdr *phdr,
 	    length, padlen);
 	return -1;
     }
+    phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
     phdr->len = length - padlen;
     if (caplen < padlen) {
 	*err = WTAP_ERR_BAD_FILE;
diff --git a/wiretap/network_instruments.c b/wiretap/network_instruments.c
index a574934a22..7ffa513cd7 100644
--- a/wiretap/network_instruments.c
+++ b/wiretap/network_instruments.c
@@ -303,6 +303,7 @@ static gboolean observer_read(wtap *wth, int *err, gchar **err_info,
     }
 
     /* set the wiretap packet header fields */
+    wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
     wth->phdr.pkt_encap = observer_to_wtap_encap(packet_header.network_type);
     if(wth->file_encap == WTAP_ENCAP_FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS) {
         wth->phdr.len = packet_header.network_size;
diff --git a/wiretap/netxray.c b/wiretap/netxray.c
index f7285fd7ca..231c877b7f 100644
--- a/wiretap/netxray.c
+++ b/wiretap/netxray.c
@@ -1008,6 +1008,7 @@ reread:
 	    &wth->pseudo_header, &hdr);
 
 	if (netxray->version_major == 0) {
+		wth->phdr.presence_flags = WTAP_HAS_TS;
 		t = (double)pletohl(&hdr.old_hdr.timelo)
 		    + (double)pletohl(&hdr.old_hdr.timehi)*4294967296.0;
 		t /= netxray->ticks_per_sec;
@@ -1022,6 +1023,7 @@ reread:
 		wth->phdr.caplen = packet_size - padding;
 		wth->phdr.len = wth->phdr.caplen;
 	} else {
+		wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 		t = (double)pletohl(&hdr.hdr_1_x.timelo)
 		    + (double)pletohl(&hdr.hdr_1_x.timehi)*4294967296.0;
 		t /= netxray->ticks_per_sec;
diff --git a/wiretap/ngsniffer.c b/wiretap/ngsniffer.c
index 211ddbb90e..0529cf4c60 100644
--- a/wiretap/ngsniffer.c
+++ b/wiretap/ngsniffer.c
@@ -1198,6 +1198,7 @@ found:
 		return FALSE;
 	}
 
+	wth->phdr.presence_flags = true_size ? WTAP_HAS_TS|WTAP_HAS_CAP_LEN : WTAP_HAS_TS;
 	wth->phdr.len = true_size ? true_size : size;
 	wth->phdr.caplen = size;
 
diff --git a/wiretap/packetlogger.c b/wiretap/packetlogger.c
index 7e03b79a52..e8435698d7 100644
--- a/wiretap/packetlogger.c
+++ b/wiretap/packetlogger.c
@@ -131,6 +131,8 @@ packetlogger_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 
 	wth->data_offset += (pl_hdr.len + 4);
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
+
 	wth->phdr.len = pl_hdr.len - 8;
 	wth->phdr.caplen = pl_hdr.len - 8;
 
diff --git a/wiretap/pcapng.c b/wiretap/pcapng.c
index f1f1942cb6..12b9cf667b 100644
--- a/wiretap/pcapng.c
+++ b/wiretap/pcapng.c
@@ -2027,6 +2027,14 @@ pcapng_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 		id = (gint)wblock.data.packet.interface_id;
 		int_data = g_array_index(pcapng->interface_data, interface_data_t, id);
 		time_units_per_second = int_data.time_units_per_second;
+		/* XXX - not WTAP_HAS_TS for an SPB */
+		wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN|WTAP_HAS_INTERFACE_ID;
+		if (wblock.data.packet.opt_comment != NULL)
+			wth->phdr.presence_flags |= WTAP_HAS_COMMENTS;
+		/* XXX - only if the option is present, for an EPB */
+		wth->phdr.presence_flags |= WTAP_HAS_DROP_COUNT;
+		/* XXX - only if the option is present */
+		wth->phdr.presence_flags |= WTAP_HAS_PACK_FLAGS;
 		wth->phdr.pkt_encap = int_data.wtap_encap;
 		wth->phdr.ts.secs = (time_t)(ts / time_units_per_second);
 		wth->phdr.ts.nsecs = (int)(((ts % time_units_per_second) * 1000000000) / time_units_per_second);
diff --git a/wiretap/pppdump.c b/wiretap/pppdump.c
index 46465bca7a..84cbadd92d 100644
--- a/wiretap/pppdump.c
+++ b/wiretap/pppdump.c
@@ -356,6 +356,7 @@ pppdump_read(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
 	*data_offset = state->pkt_cnt;
 	state->pkt_cnt++;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS;
 	wth->phdr.len		= num_bytes;
 	wth->phdr.caplen	= num_bytes;
 	wth->phdr.ts.secs	= state->timestamp;
diff --git a/wiretap/radcom.c b/wiretap/radcom.c
index a4fe9b30e6..a81d72ccf0 100644
--- a/wiretap/radcom.c
+++ b/wiretap/radcom.c
@@ -308,6 +308,8 @@ static gboolean radcom_read(wtap *wth, int *err, gchar **err_info,
 		real_length -= 2;
 	}
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
 	wth->phdr.len = real_length;
 	wth->phdr.caplen = length;
 
diff --git a/wiretap/snoop.c b/wiretap/snoop.c
index c284465ee1..a0296db139 100644
--- a/wiretap/snoop.c
+++ b/wiretap/snoop.c
@@ -591,6 +591,7 @@ static gboolean snoop_read(wtap *wth, int *err, gchar **err_info,
 		return FALSE;	/* Read error */
 	wth->data_offset += packet_size;
 
+	wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 	wth->phdr.ts.secs = g_ntohl(hdr.ts_sec);
 	wth->phdr.ts.nsecs = g_ntohl(hdr.ts_usec) * 1000;
 	wth->phdr.caplen = packet_size;
diff --git a/wiretap/tnef.c b/wiretap/tnef.c
index d43ffc9270..f7772509d0 100644
--- a/wiretap/tnef.c
+++ b/wiretap/tnef.c
@@ -40,7 +40,6 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of
   guint8 *buf;
   gint64 file_size;
   int packet_size;
-  ws_statb64 statb;
 
   *err = 0;
 
@@ -72,13 +71,12 @@ static gboolean tnef_read(wtap *wth, int *err, gchar **err_info, gint64 *data_of
 
   wth->data_offset += packet_size;
 
+  wth->phdr.presence_flags = 0; /* no time stamp, no "real length" */
+
   wth->phdr.caplen = packet_size;
   wth->phdr.len = packet_size;
 
-  if (wtap_fstat(wth, &statb, err) == -1)
-    return FALSE;
-
-  wth->phdr.ts.secs = statb.st_mtime;
+  wth->phdr.ts.secs = 0;
   wth->phdr.ts.nsecs = 0;
 
   return TRUE;
diff --git a/wiretap/toshiba.c b/wiretap/toshiba.c
index 921bd988aa..7f29072636 100644
--- a/wiretap/toshiba.c
+++ b/wiretap/toshiba.c
@@ -355,6 +355,7 @@ parse_toshiba_rec_hdr(wtap *wth, FILE_T fh,
 	}
 
 	if (wth) {
+		wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
 		wth->phdr.ts.secs = hr * 3600 + min * 60 + sec;
 		wth->phdr.ts.nsecs = csec * 10000000;
 		wth->phdr.caplen = pkt_len;
diff --git a/wiretap/visual.c b/wiretap/visual.c
index e516f14e64..de10c33f43 100644
--- a/wiretap/visual.c
+++ b/wiretap/visual.c
@@ -379,6 +379,8 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info,
     }
     wth->data_offset += packet_size;
 
+    wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+
     /* Set the packet time and length. */
     t = visual->start_time;
     t += ((double)pletohl(&vpkt_hdr.ts_delta))*1000;
diff --git a/wiretap/vms.c b/wiretap/vms.c
index 109b20964d..2b02dbf0d0 100644
--- a/wiretap/vms.c
+++ b/wiretap/vms.c
@@ -444,6 +444,7 @@ parse_vms_rec_hdr(wtap *wth, FILE_T fh, int *err, gchar **err_info)
         tm.tm_year -= 1900;
 
 	tm.tm_isdst = -1;
+        wth->phdr.presence_flags = WTAP_HAS_TS;
         wth->phdr.ts.secs = mktime(&tm);
         wth->phdr.ts.nsecs = csec * 10000000;
         wth->phdr.caplen = pkt_len;
diff --git a/wiretap/wtap.h b/wiretap/wtap.h
index 10c498c55f..1f0a23baac 100644
--- a/wiretap/wtap.h
+++ b/wiretap/wtap.h
@@ -821,18 +821,46 @@ struct wtap_nstime {
 };
 
 struct wtap_pkthdr {
+	guint32			presence_flags;	/* what stuff do we have? */
 	struct wtap_nstime	ts;
-	guint32				caplen;			/* data length in the file */
-	guint32				len;			/* data length on the wire */
-	int					pkt_encap;
+	guint32			caplen;		/* data length in the file */
+	guint32			len;		/* data length on the wire */
+	int			pkt_encap;
 	/* pcapng variables */
-	guint32				interface_id;   /* identifier of the interface. */
+	guint32			interface_id;   /* identifier of the interface. */
 	/* options */
-	gchar				*opt_comment;	/* NULL if not available */
-	guint64				drop_count;		/* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */
-	guint32				pack_flags;     /* XXX - 0 for now (any value for "we don't have it"?) */
+	gchar			*opt_comment;	/* NULL if not available */
+	guint64			drop_count;	/* number of packets lost (by the interface and the operating system) between this packet and the preceding one. */
+	guint32			pack_flags;     /* XXX - 0 for now (any value for "we don't have it"?) */
 };
 
+/*
+ * Bits in presence_flags, indicating which of the fields we have.
+ *
+ * For the time stamp, we may need some more flags to indicate
+ * whether the time stamp is an absolute date-and-time stamp, an
+ * absolute time-only stamp (which can make relative time
+ * calculations tricky, as you could in theory have two time
+ * stamps separated by an unknown number of days), or a time stamp
+ * relative to some unspecified time in the past (see mpeg.c).
+ *
+ * There is no presence flag for len - there has to be *some* length
+ * value for the packet.  (The "captured length" can be missing if
+ * the file format doesn't report a captured length distinct from
+ * the on-the-network length because the application(s) producing those
+ * files don't support slicing packets.)
+ *
+ * There could be a presence flag for the packet encapsulation - if it's
+ * absent, use the file encapsulation - but it's not clear that's useful;
+ * we currently do that in the module for the file format.
+ */
+#define WTAP_HAS_TS		0x00000001	/* time stamp */
+#define WTAP_HAS_CAP_LEN	0x00000002	/* captured length separate from on-the-network length */
+#define WTAP_HAS_INTERFACE_ID	0x00000004	/* interface ID */
+#define WTAP_HAS_COMMENTS	0x00000008	/* comments */
+#define WTAP_HAS_DROP_COUNT	0x00000010	/* drop count */
+#define WTAP_HAS_PACK_FLAGS	0x00000020	/* packet flags */
+
 /**
  * Holds the option strings from pcapng:s Section Header block(SHB).
  */