[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:
> let's suppose I need to add SSCOP as an "encapsulation" to wiretap/ethereal 

"Encapsulation" as in "a WTAP_ENCAP_ value for captures where the 
outermost protocol layer is SSCOP"?  I.e., not SSCOP over, say, ATM AAL5 
frames?

> What do I need to do to add SSCOP to wiretap / packet-frame ?

First, add the new WTAP_ENCAP_ value to wiretap/wtap.h and add an entry 
for it to "encap_table[]" in wiretap/wtap.c, and then either

	1) use libpcap format for the capture, and get a DLT_ value from 
tcpdump-workers@xxxxxxxxxxx (DLT_SSCOP, or something such as that)

or

	2) add support to Wiretap for whatever capture file format is used for 
the SSCOP traces.

Then have "proto_reg_handoff_sscop()" in packet-sscop.c register 
"dissect_sscop()" in the "wtap_encap" dissector table with the new 
WTAP_ENCAP value.

> And most of it, how should I hanlde the fact that the data elements of
> sscop are a trailer of the transported packet and not a header as it
> normally happens.

By using "dissect_sscop()", which already knows about that.