[Jeff Morriss <morriss@xxxxxxxxx>]

I was updating the RawSS7 dissector to have just the embedded 
protocol/LINKTYPE_ (e.g., removing the length) when I came across 
WTAP_ENCAP_PER_PACKET--which is exactly what the RawSS7 dissector looks 
like now.  The 'mergecap' man page says PCAP files don't support 
WTAP_ENCAP_PER_PACKET, but I looked into extending wiretap's libpcap 
routines to deal with it and it didn't seem too hard.

Attached is a patch that adds read-only support for 
WTAP_ENCAP_PER_PACKET to PCAP files.  (It's not ready for inclusion, 
this is just to give you a feeling for what it looks like.)

I like this a lot more than RawSS7 because, well, it's not a misnomer 
(as "RawSS7" has become).  It also allows MTP2, MTP3, and possibly SCCP 
to have their own DLT_ values (as Guy rightly suggested they should) 
while allowing what I could really use--multiple protocols in one file 
(today).

Is this worth pursuing (does it have a chance of inclusion?) or should I 
go back to RawSS7?

Attachment: WTAP_ENCAP_PER_PACKET.patch.gz
Description: GNU Zip compressed data