[Aman Agrawal <aman.agrawal@xxxxxxxxxx>]

Hi all,

I've opened a small merge request adding one new record type to the existing NetScaler capture-file reader, and would appreciate a core-developer review when someone has a moment.

MR: https://gitlab.com/wireshark/wireshark/-/merge_requests/26753

What it does

NetScaler nstrace policy tracing emits a synthetic, non-packet record (type 0x9C, NSPR_PDPKTRACEPOLICY_V35) alongside the normal packet-trace records in a V30/V35 capture. The current reader doesn't recognize this type, so these records are not surfaced. The change:

• adds the NSPR_PDPKTRACEPOLICY_V35 0x9C #define in wiretap/netscaler.h
• handles it in nstrace_read_v30() and nstrace_seek_read_v30(), surfacing the record verbatim as its own frame carrying its embedded nanosecond timestamp.

It's self-contained (touching only wiretap/netscaler.c and netscaler.h); no existing record handling is modified.

A design point I'd like feedback on

The reader is intentionally scoped to just identifying and surfacing the record; decoding of the record body is handled by a Lua dissector (not part of this MR). The record is surfaced with encapsulation WTAP_ENCAP_USER15, which the Lua dissector registers on to decode it.

Process note

The fork pipeline couldn't run (free-tier CI identity verification), so the pipeline on the MR may need to be run in the Wireshark project.

Thanks for taking a look.

Aman Agrawal