From Shekhar Chandra: support for version 3.0 of netscaler packet wire format.

  https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9280

From me: fix indentation(tabs->spaces) and trailing whitespace.


svn path=/trunk/; revision=52665

1 files changed, 276 insertions, 38 deletions

diff --git a/wiretap/netscaler.c b/wiretap/netscaler.c
index 64afb855f7..82db34fe3e 100644
--- a/wiretap/netscaler.c
+++ b/wiretap/netscaler.c
@@ -36,6 +36,7 @@
 /* Defined but not used */
 #define NSPR_SIGSTR_V21 "NetScaler V21 Performance Data"
 #define NSPR_SIGSTR_V22 "NetScaler V22 Performance Data"
+#define NSPR_SIGSTR_V30 "Netscaler V30 Performance Data"
 
 /*
  * NetScaler trace files are divided into 8K pages, with each page
@@ -51,6 +52,7 @@
  * other than the type and zero or more additional padding bytes).
  */
 #define NSPR_PAGESIZE   8192
+#define NSPR_PAGESIZE_TRACE (2*NSPR_PAGESIZE)
 
 /* The different record types
 ** NOTE: The Record Type is two byte fields and unused space is recognized by
@@ -111,6 +113,7 @@ typedef struct nspr_header_v10
                                    /* end of declaration */
 #define NSPR_HEADER3B_V21 NSPR_HEADER3B_V20
 #define NSPR_HEADER3B_V22 NSPR_HEADER3B_V20
+#define NSPR_HEADER3B_V30 NSPR_HEADER3B_V20
 
 typedef struct nspr_hd_v20
 {
@@ -296,22 +299,22 @@ typedef struct nspr_pktracefull_v25
 /* New full packet trace structure v26 for vm info tracing */
 typedef struct nspr_pktracefull_v26
 {
-    NSPR_HEADER3B_V22(fp);    /* long performance header */
-    guint8 fp_DevNo;          /* Network Device (NIC) number */
-    guint8 fp_AbsTimeHr[8];   /* High resolution absolute time in nanosec */
-    guint8 fp_PcbDevNo[4];    /* PCB devno */
-    guint8 fp_lPcbDevNo[4];   /* link PCB devno */
-    guint8 fp_VlanTag[2];     /* vlan tag */
-    guint8 fp_Coreid[2];      /* coreid of the packet */
-    guint8 fp_srcNodeId[2];   /* source node # */
-    guint8 fp_destNodeId[2];  /* destination node # */
-    guint8 fp_clFlags;        /* cluster flags */
-    guint8 fp_src_vmname_len; /* vm src info */
-    guint8 fp_dst_vmname_len; /* vm src info */
+    NSPR_HEADER3B_V22(fp);     /* long performance header */
+    guint8 fp_DevNo;           /* Network Device (NIC) number */
+    guint8 fp_AbsTimeHr[8];    /* High resolution absolute time in nanosec */
+    guint8 fp_PcbDevNo[4];     /* PCB devno */
+    guint8 fp_lPcbDevNo[4];    /* link PCB devno */
+    guint8 fp_VlanTag[2];      /* vlan tag */
+    guint8 fp_Coreid[2];       /* coreid of the packet */
+    guint8 fp_srcNodeId[2];    /* source node # */
+    guint8 fp_destNodeId[2];   /* destination node # */
+    guint8 fp_clFlags;         /* cluster flags */
+    guint8 fp_src_vmname_len;  /* vm src info */
+    guint8 fp_dst_vmname_len;  /* vm src info */
     guint8 fp_reserved;
     guint8 fp_ns_activity[4];
     guint8 fp_reserved_32[12]; /* Adding more field to reduce wireshark changes every time */
-	guint8 fp_Data[4];     /* packet data starts here */
+    guint8 fp_Data[4];         /* packet data starts here */
 } nspr_pktracefull_v26_t;
 #define nspr_pktracefull_v26_s    ((guint32)(sizeof(nspr_pktracefull_v26_t) - 4))
 
@@ -424,27 +427,53 @@ typedef struct nspr_pktracepart_v25
 #define pp_src_vmname    pp_Data
 #define pp_dst_vmname    pp_Data
 
+
+/* New full packet trace structure v30 for multipage spanning data */
+typedef struct  nspr_pktracefull_v30
+{
+    NSPR_HEADER3B_V30(fp);      /* long performance header */
+    guint8 fp_DevNo;            /* Network Device (NIC) number */
+    guint8 fp_AbsTimeHr[8];     /* High resolution absolute time in nanosec*/
+    guint8 fp_PcbDevNo[4];      /* PCB devno */
+    guint8 fp_lPcbDevNo[4];     /* link PCB devno */
+    guint8 fp_PktSizeOrg[2];    /* Original packet size */
+    guint8 fp_VlanTag[2];       /* vlan tag */
+    guint8 fp_Coreid[2];        /* coreid of the packet */
+    guint8 fp_srcNodeId[2];     /* cluster nodeid of the packet */
+    guint8 fp_destNodeId[2];
+    guint8 fp_clFlags;
+    guint8 fp_src_vmname_len;
+    guint8 fp_dst_vmname_len;
+    guint8 fp_reserved[3];
+    guint8 fp_ns_activity[4];
+    guint8 fp_reserved_32[12];
+    guint8 fp_Data[0];          /* packet data starts here */
+} nspr_pktracefull_v30_t;
+#define nspr_pktracefull_v30_s  (sizeof(nspr_pktracefull_v30_t))
+#define fp_src_vmname   fp_Data
+#define fp_dst_vmname   fp_Data
+
 /* New partial packet trace structure v26 for vm info tracing */
 typedef struct nspr_pktracepart_v26
 {
-    NSPR_HEADER3B_V22(pp);    /* long performance header */
-    guint8 pp_DevNo;          /* Network Device (NIC) number */
-    guint8 pp_AbsTimeHr[8];   /*High resolution absolute time in nanosec*/
-    guint8 pp_PktSizeOrg[2];  /* Original packet size */
-    guint8 pp_PktOffset[2];   /* starting offset in packet */
-    guint8 pp_PcbDevNo[4];    /* PCB devno */
-    guint8 pp_lPcbDevNo[4];   /* link PCB devno */
-    guint8 pp_VlanTag[2];     /* vlan tag */
-    guint8 pp_Coreid[2];      /* Coreid of the packet */
-    guint8 pp_srcNodeId[2];   /* source node # */
-    guint8 pp_destNodeId[2];  /* destination node # */
-    guint8 pp_clFlags;        /* cluster flags */
-    guint8 pp_src_vmname_len; /* vm info */
-    guint8 pp_dst_vmname_len; /* vm info */
+    NSPR_HEADER3B_V22(pp);      /* long performance header */
+    guint8 pp_DevNo;            /* Network Device (NIC) number */
+    guint8 pp_AbsTimeHr[8];     /* High resolution absolute time in nanosec*/
+    guint8 pp_PktSizeOrg[2];    /* Original packet size */
+    guint8 pp_PktOffset[2];     /* starting offset in packet */
+    guint8 pp_PcbDevNo[4];      /* PCB devno */
+    guint8 pp_lPcbDevNo[4];     /* link PCB devno */
+    guint8 pp_VlanTag[2];       /* vlan tag */
+    guint8 pp_Coreid[2];        /* Coreid of the packet */
+    guint8 pp_srcNodeId[2];     /* source node # */
+    guint8 pp_destNodeId[2];    /* destination node # */
+    guint8 pp_clFlags;          /* cluster flags */
+    guint8 pp_src_vmname_len;   /* vm info */
+    guint8 pp_dst_vmname_len;   /* vm info */
     guint8 pp_reserved;
     guint8 pp_ns_activity[4];
-    guint8 pp_reserved_32[12]; /* Adding more field to reduce wireshark changes every time */
-    guint8 pp_Data[4];        /* packet data starts here */
+    guint8 pp_reserved_32[12];  /* Adding more field to reduce wireshark changes every time */
+    guint8 pp_Data[4];          /* packet data starts here */
 } nspr_pktracepart_v26_t;
 #define nspr_pktracepart_v26_s    ((guint32)(sizeof(nspr_pktracepart_v26_t) -4))
 
@@ -472,7 +501,7 @@ typedef struct nspr_pktracepart_v26
 #define TRACE_FULL_V10_REC_LEN_OFF(phdr,enumprefix,structprefix,structname) \
     (phdr)->len = pletohs(&(fp)->nsprRecordSize);\
     (phdr)->caplen = (phdr)->len;\
-    TRACE_V10_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)        
+    TRACE_V10_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)
 
 #define TRACE_PART_V10_REC_LEN_OFF(phdr,enumprefix,structprefix,structname) \
     (phdr)->presence_flags |= WTAP_HAS_CAP_LEN;\
@@ -511,11 +540,15 @@ typedef struct nspr_pktracepart_v26
     __TNO(phdr,enumprefix,structprefix,structname,src_vmname_len,src_vmname_len)\
     __TNO(phdr,enumprefix,structprefix,structname,dst_vmname_len,dst_vmname_len)\
     __TNO(phdr,enumprefix,structprefix,structname,data,Data)
-    
+
+
 #define TRACE_V26_REC_LEN_OFF(phdr,enumprefix,structprefix,structname) \
     TRACE_V25_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)\
     __TNO(phdr,enumprefix,structprefix,structname,ns_activity,ns_activity)\
-    
+
+#define TRACE_V30_REC_LEN_OFF(phdr, enumprefix, structprefix, structname) \
+    TRACE_V26_REC_LEN_OFF(phdr,enumprefix,structprefix,structname)      \
+
     TRACE_V10_REC_LEN_OFF(NULL,v10_part,pp,pktracepart_v10)
     TRACE_V10_REC_LEN_OFF(NULL,v10_full,fp,pktracefull_v10)
     TRACE_V20_REC_LEN_OFF(NULL,v20_part,pp,pktracepart_v20)
@@ -532,6 +565,7 @@ typedef struct nspr_pktracepart_v26
     TRACE_V25_REC_LEN_OFF(NULL,v25_full,fp,pktracefull_v25)
     TRACE_V26_REC_LEN_OFF(NULL,v26_part,pp,pktracepart_v26)
     TRACE_V26_REC_LEN_OFF(NULL,v26_full,fp,pktracefull_v26)
+    TRACE_V30_REC_LEN_OFF(NULL,v30_full,fp,pktracefull_v30)
 
 #undef __TNV1O
 #undef __TNV1L
@@ -575,6 +609,8 @@ static gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info,
                                  gint64 *data_offset);
 static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info,
                                  gint64 *data_offset);
+static gboolean nstrace_read_v30(wtap *wth, int *err, gchar **err_info,
+                                 gint64 *data_offset);
 static gboolean nstrace_seek_read_v10(wtap *wth, gint64 seek_off,
                                       struct wtap_pkthdr *phdr,
                                       Buffer *buf, int length,
@@ -583,6 +619,10 @@ static gboolean nstrace_seek_read_v20(wtap *wth, gint64 seek_off,
                                       struct wtap_pkthdr *phdr,
                                       Buffer *buf, int length,
                                       int *err, gchar **err_info);
+static gboolean nstrace_seek_read_v30(wtap *wth, gint64 seek_off,
+                                      struct wtap_pkthdr *phdr,
+                                      Buffer *buf, int length,
+                                      int *err, gchar **err_info);
 static void nstrace_close(wtap *wth);
 
 static gboolean nstrace_set_start_time_v10(wtap *wth);
@@ -599,14 +639,14 @@ static gboolean nstrace_dump(wtap_dumper *wdh, const struct wtap_pkthdr *phdr,
  * the last page of a file can be short.
  */
 #define GET_READ_PAGE_SIZE(remaining_file_size) ((gint32)((remaining_file_size>NSPR_PAGESIZE)?NSPR_PAGESIZE:remaining_file_size))
-
+#define GET_READ_PAGE_SIZEV3(remaining_file_size) ((gint32)((remaining_file_size>NSPR_PAGESIZE_TRACE)?NSPR_PAGESIZE_TRACE:remaining_file_size))
 
 static guint64 ns_hrtime2nsec(guint32 tm)
 {
     guint32    val = tm & NSPR_HRTIME_MASKTM;
     switch(tm & NSPR_HRTIME_MASKFMT)
     {
-    case NSPR_HRTIME_SEC:    return (guint64)val*1000000000;
+    case NSPR_HRTIME_SEC:     return (guint64)val*1000000000;
     case NSPR_HRTIME_MSEC:    return (guint64)val*1000000;
     case NSPR_HRTIME_USEC:    return (guint64)val*1000;
     case NSPR_HRTIME_NSEC:    return val;
@@ -644,6 +684,13 @@ int nstrace_open(wtap *wth, int *err, gchar **err_info)
         wth->file_encap = WTAP_ENCAP_NSTRACE_2_0;
         break;
 
+    case WTAP_FILE_NETSCALER_3_0:
+        wth->file_encap = WTAP_ENCAP_NSTRACE_3_0;
+        g_free(nstrace_buf);
+        nstrace_buf = (gchar *)g_malloc(NSPR_PAGESIZE_TRACE);
+        page_size = GET_READ_PAGE_SIZEV3(file_size);
+        break;
+
     default:
         *err = WTAP_ERR_UNSUPPORTED;
         *err_info = g_strdup_printf("nstrace: file type %d unsupported", wth->file_type);
@@ -679,6 +726,11 @@ int nstrace_open(wtap *wth, int *err, gchar **err_info)
         wth->subtype_read = nstrace_read_v20;
         wth->subtype_seek_read = nstrace_seek_read_v20;
         break;
+
+    case WTAP_FILE_NETSCALER_3_0:
+        wth->subtype_read = nstrace_read_v30;
+        wth->subtype_seek_read = nstrace_seek_read_v30;
+        break;
     }
     wth->subtype_close = nstrace_close;
 
@@ -737,6 +789,7 @@ int nstrace_open(wtap *wth, int *err, gchar **err_info)
 
 nspm_signature_func(10)
 nspm_signature_func(20)
+nspm_signature_func(30)
 
 /*
 ** Check signature and return the version number of the signature.
@@ -766,9 +819,13 @@ nspm_signature_version(wtap *wth, gchar *nstrace_buf, gint32 len)
 #define sigv20p    ((nspr_signature_v20_t*)dp)
             if ((sigv20p->sig_RecordType == NSPR_SIGNATURE_V20) &&
                 (sigv20p->sig_RecordSize <= len) &&
-                ((gint32)sizeof(NSPR_SIGSTR_V20) <= len) &&
-                (!nspm_signature_isv20(sigv20p->sig_Signature)))
-                return WTAP_FILE_NETSCALER_2_0;
+                ((gint32)sizeof(NSPR_SIGSTR_V20) <= len))
+            {
+                if (!nspm_signature_isv20(sigv20p->sig_Signature))
+                    return WTAP_FILE_NETSCALER_2_0;
+                else if (!nspm_signature_isv30(sigv20p->sig_Signature))
+                    return WTAP_FILE_NETSCALER_3_0;
+            }
 #undef    sigv20p
         }
     }
@@ -839,7 +896,8 @@ static gboolean nstrace_set_start_time(wtap *wth)
         return nstrace_set_start_time_v10(wth);
     else if (wth->file_type == WTAP_FILE_NETSCALER_2_0)
         return nstrace_set_start_time_v20(wth);
-
+    else if (wth->file_type == WTAP_FILE_NETSCALER_3_0)
+        return nstrace_set_start_time_v20(wth);
     return FALSE;
 }
 
@@ -990,6 +1048,17 @@ static gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *
 #define TIMEDEFV24(fp,type) TIMEDEFV23(fp,type)
 #define TIMEDEFV25(fp,type) TIMEDEFV24(fp,type)
 #define TIMEDEFV26(fp,type) TIMEDEFV24(fp,type)
+
+#define TIMEDEFV30(fp,type) \
+    do {                                                        \
+        wth->phdr.presence_flags |= WTAP_HAS_TS;                \
+        /* access _AbsTimeHr as a 64bit value */                \
+        nsg_creltime = pletohll(fp->type##_AbsTimeHr);                  \
+        wth->phdr.ts.secs = (guint32) (nsg_creltime / 1000000000);      \
+        wth->phdr.ts.nsecs = (guint32) (nsg_creltime % 1000000000);     \
+    }while(0)
+
+
 #define PPSIZEDEFV20(phdr,pp,ver) \
     do {\
         (phdr)->presence_flags |= WTAP_HAS_CAP_LEN;\
@@ -1017,6 +1086,16 @@ static gboolean nstrace_read_v10(wtap *wth, int *err, gchar **err_info, gint64 *
 #define FPSIZEDEFV25(phdr,fp,ver) FPSIZEDEFV20(phdr,fp,ver)
 #define FPSIZEDEFV26(phdr,fp,ver) FPSIZEDEFV20(phdr,fp,ver)
 
+#define FPSIZEDEFV30(phdr,fp,ver)\
+    do {\
+        (phdr)->len = pletohs(&fp->fp_PktSizeOrg) + nspr_pktracefull_v##ver##_s;\
+        (phdr)->caplen = nspr_getv20recordsize((nspr_hd_v20_t *)fp);\
+        if ((phdr)->len != (phdr)->caplen)\
+            {\
+            (phdr)->presence_flags |= WTAP_HAS_CAP_LEN;\
+        }\
+        }while(0)
+
 #define PACKET_DESCRIBE(phdr,FPTIMEDEF,SIZEDEF,ver,enumprefix,type,structname,TYPE)\
     do {\
         nspr_##structname##_t *fp= (nspr_##structname##_t*)&nstrace_buf[nstrace_buf_offset];\
@@ -1142,6 +1221,112 @@ static gboolean nstrace_read_v20(wtap *wth, int *err, gchar **err_info, gint64 *
 
 #undef PACKET_DESCRIBE
 
+#define PACKET_DESCRIBE(phdr,FPTIMEDEF,SIZEDEF,ver,enumprefix,type,structname,TYPE)\
+    do {\
+    nspr_##structname##_t *fp = (nspr_##structname##_t *) &nstrace_buf[nstrace_buf_offset];\
+    TIMEDEFV##ver(fp,type);\
+    SIZEDEF##ver((phdr),fp,ver);\
+    TRACE_V##ver##_REC_LEN_OFF((phdr),enumprefix,type,structname);\
+    (phdr)->pseudo_header.nstr.rec_type = NSPR_HEADER_VERSION##TYPE;\
+    buffer_assure_space(wth->frame_buffer, (phdr)->caplen);\
+    *data_offset = nstrace->xxx_offset + nstrace_buf_offset;\
+    while (nstrace_tmpbuff_off < nspr_##structname##_s) {\
+        nstrace_tmpbuff[nstrace_tmpbuff_off++] = nstrace_buf[nstrace_buf_offset++];\
+    }\
+    nst_dataSize = nspr_getv20recordsize(hdp);\
+    rec_size = nst_dataSize - nstrace_tmpbuff_off;\
+    nsg_nextPageOffset = ((nstrace_buf_offset + rec_size) >= NSPR_PAGESIZE_TRACE) ?\
+    ((nstrace_buf_offset + rec_size) - (NSPR_PAGESIZE_TRACE - 1)) : 0;\
+    while (nsg_nextPageOffset) {\
+        while (nstrace_buf_offset < NSPR_PAGESIZE_TRACE) {\
+            nstrace_tmpbuff[nstrace_tmpbuff_off++] = nstrace_buf[nstrace_buf_offset++];\
+        }\
+        nstrace_buflen = NSPR_PAGESIZE_TRACE;\
+        nstrace->xxx_offset += nstrace_buflen;\
+        bytes_read = file_read(nstrace_buf, NSPR_PAGESIZE_TRACE, wth->fh);\
+        if (bytes_read != NSPR_PAGESIZE_TRACE) {\
+            return FALSE;\
+        } else {\
+            nstrace_buf_offset = 0;\
+        }\
+        rec_size = nst_dataSize - nstrace_tmpbuff_off;\
+        nsg_nextPageOffset = ((nstrace_buf_offset + rec_size) >= NSPR_PAGESIZE_TRACE) ?\
+        ((nstrace_buf_offset + rec_size) - (NSPR_PAGESIZE_TRACE- 1)): 0;\
+    } \
+    while (nstrace_tmpbuff_off < nst_dataSize) {\
+        nstrace_tmpbuff[nstrace_tmpbuff_off++] = nstrace_buf[nstrace_buf_offset++];\
+    }\
+    memcpy(buffer_start_ptr(wth->frame_buffer), nstrace_tmpbuff, (phdr)->caplen);\
+    nstrace->nstrace_buf_offset = nstrace_buf_offset;\
+    nstrace->nstrace_buflen = nstrace_buflen = NSPR_PAGESIZE_TRACE;\
+    nstrace->nsg_creltime = nsg_creltime;\
+    return TRUE;\
+} while(0)
+
+static gboolean nstrace_read_v30(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
+{
+    nstrace_t *nstrace = (nstrace_t *)wth->priv;
+    guint64 nsg_creltime = nstrace->nsg_creltime;
+    gchar *nstrace_buf = nstrace->pnstrace_buf;
+    gint32 nstrace_buf_offset = nstrace->nstrace_buf_offset;
+    gint32 nstrace_buflen = nstrace->nstrace_buflen;
+    guint8 nstrace_tmpbuff[65536];
+    guint32 nstrace_tmpbuff_off=0,nst_dataSize=0,rec_size=0,nsg_nextPageOffset=0;
+    nspr_hd_v20_t *hdp;
+    int bytes_read;
+    *err = 0;
+    *err_info = NULL;
+
+    do
+    {
+        while ((nstrace_buf_offset < NSPR_PAGESIZE_TRACE) &&
+            nstrace_buf[nstrace_buf_offset])
+        {
+            hdp = (nspr_hd_v20_t *) &nstrace_buf[nstrace_buf_offset];
+            switch (hdp->phd_RecordType)
+            {
+            #define GENERATE_CASE_V30(phdr,type,acttype) \
+        case NSPR_PDPKTRACEFULLTX_V##type:\
+        case NSPR_PDPKTRACEFULLTXB_V##type:\
+        case NSPR_PDPKTRACEFULLRX_V##type:\
+        case NSPR_PDPKTRACEFULLNEWRX_V##type:\
+        PACKET_DESCRIBE(phdr, TIMEDEF, FPSIZEDEFV,type,v##type##_full,fp,pktracefull_v##type,acttype);
+
+            GENERATE_CASE_V30(&wth->phdr,30, 300);
+            #undef GENERATE_CASE_V30
+
+
+                case NSPR_ABSTIME_V20:
+                {
+                    nstrace_buf_offset += nspr_getv20recordsize(hdp);
+                    ns_setabstime(nstrace, pletohl(&((nspr_abstime_v20_t *) &nstrace_buf[nstrace_buf_offset])->abs_Time), pletohs(&((nspr_abstime_v20_t *) &nstrace_buf[nstrace_buf_offset])->abs_RelTime));
+                    break;
+                }
+
+                case NSPR_RELTIME_V20:
+                {
+                    ns_setrelativetime(nstrace, pletohs(&((nspr_abstime_v20_t *) &nstrace_buf[nstrace_buf_offset])->abs_RelTime));
+                    nstrace_buf_offset += nspr_getv20recordsize(hdp);
+                    break;
+                }
+
+                default:
+                {
+                    nstrace_buf_offset += nspr_getv20recordsize(hdp);
+                    break;
+                }
+            }
+        }
+        nstrace_buf_offset = 0;
+        nstrace->xxx_offset += nstrace_buflen;
+        nstrace_buflen = NSPR_PAGESIZE_TRACE;
+    } while((nstrace_buflen > 0) && (bytes_read = file_read(nstrace_buf, nstrace_buflen, wth->fh)) && (bytes_read == nstrace_buflen));
+
+    return FALSE;
+}
+
+#undef PACKET_DESCRIBE
+
 static gboolean nstrace_seek_read_v10(wtap *wth, gint64 seek_off,
     struct wtap_pkthdr *phdr, Buffer *buf, int length,
     int *err, gchar **err_info)
@@ -1285,6 +1470,50 @@ static gboolean nstrace_seek_read_v20(wtap *wth, gint64 seek_off,
     return TRUE;
 }
 
+
+static gboolean nstrace_seek_read_v30(wtap *wth, gint64 seek_off,
+    struct wtap_pkthdr *phdr, Buffer *buf, int length,
+    int *err, gchar **err_info)
+{
+    guint8 *pd;
+    int bytes_read;
+
+    *err = 0;
+
+    if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+        return FALSE;
+
+    /*
+    ** Read the packet data.
+    */
+    buffer_assure_space(buf, length);
+    pd = buffer_start_ptr(buf);
+    bytes_read = file_read(pd, length, wth->random_fh);
+    if (bytes_read != length) {
+        *err = file_error(wth->random_fh, err_info);
+        if (*err == 0)
+            *err = WTAP_ERR_SHORT_READ;
+        return FALSE;
+    }
+
+#define GENERATE_CASE_V30(phdr,type,acttype) \
+    case NSPR_PDPKTRACEFULLTX_V##type:\
+    case NSPR_PDPKTRACEFULLTXB_V##type:\
+    case NSPR_PDPKTRACEFULLRX_V##type:\
+    case NSPR_PDPKTRACEFULLNEWRX_V##type:\
+    TRACE_V##type##_REC_LEN_OFF((phdr),v##type##_full,fp,pktracefull_v##type);\
+        (phdr)->pseudo_header.nstr.rec_type = NSPR_HEADER_VERSION##acttype;\
+        break;
+
+        switch ((( nspr_hd_v20_t*)pd)->phd_RecordType)
+        {
+            GENERATE_CASE_V30(phdr,30, 300);
+        }
+
+    return TRUE;
+}
+
+
 /*
 ** Netscaler trace format close routines.
 */
@@ -1323,6 +1552,15 @@ int nstrace_20_dump_can_write_encap(int encap)
     return WTAP_ERR_UNSUPPORTED_ENCAP;
 }
 
+/* Returns 0 if we could write the specified encapsulation type,
+** an error indication otherwise. */
+int nstrace_30_dump_can_write_encap(int encap)
+{
+    if (encap == WTAP_ENCAP_NSTRACE_3_0)
+        return 0;
+
+    return WTAP_ERR_UNSUPPORTED_ENCAP;
+}
 
 /* Returns TRUE on success, FALSE on failure; sets "*err" to an error code on
 ** failure */