From James Menzies: if the per-packet encapsulation hint is 14, the

packets are always PPP, otherwise they're of an unknown type and we use
a heuristic to guess the type.


git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@23573 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 19 insertions, 3 deletions

diff --git a/wiretap/visual.c b/wiretap/visual.c
index e885903750..ae214d07c1 100644
--- a/wiretap/visual.c
+++ b/wiretap/visual.c
@@ -429,9 +429,25 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info,
     /* Fill in the encapsulation.  Visual files have a media type in the
        file header and an encapsulation type in each packet header.  Files
        with a media type of HDLC can be either Cisco EtherType or PPP. */
-    if ((wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR) && (vpkt_hdr.encap_hint == 14))
-        wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
-
+    if (wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR)
+    {
+        /* If PPP is specified in the encap hint, then use that */
+        if (vpkt_hdr.encap_hint == 14)
+        {
+            wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
+        }
+        else
+        {
+            /* Otherwise, we need to evaluate the first two
+            /* examine first two octets to verify encapsulation */
+            guint8 *buf = buffer_start_ptr(wth->frame_buffer);
+            if ((0xff == buf[0]) && (0x03 == buf[1]))
+            {
+                /* It is actually PPP */
+                wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
+            }
+        }
+    }
     return TRUE;
 }