[Aman Agrawal <aman.agrawal@xxxxxxxxxx>]

Hi All,

Thanks for reviewing the initial changes to MR !26753 (adding the NetScaler 0x9C policy-trace record to the nstrace reader) and sharing your feedback.

I've pushed a revised version addressing the comments:

• No more WTAP_ENCAP_USER15. A policy-trace record is a synthetic,
• non-packet summary emitted once at flow end (not a captured frame), so
  the reader now surfaces it as REC_TYPE_FT_SPECIFIC_EVENT — which removes
  the USER0-15 private-linktype concern entirely. I went with EVENT rather
  than REPORT because the record carries a meaningful flow-end timestamp,
  but I'm happy to switch to REPORT if you feel that fits better.
• Dissection is now routed the standard way for file-type-specific records,
• via the wtap_fts_rec table keyed by the nstrace file type — no
  WTAP_ENCAP_* or LINKTYPE involved. This adds a small recognition hook in
  epan/dissectors/packet-nstrace.c alongside the wiretap change; the
  detailed field decode still lives in an out-of-tree Lua dissector, as
• 
  

Please review the revised version whenever someone has a moment. 

Thanks,

Aman Agrawal

---

From: Aman Agrawal <aman.agrawal@xxxxxxxxxx>
Sent: Wednesday, October 7, 2026 9:54 PM
To: wireshark-dev@xxxxxxxxxxxxx <wireshark-dev@xxxxxxxxxxxxx>
Cc: Goutham Shetlur Mohan <Goutham.ShetlurMohan@xxxxxxxxxx>; Ashwin Jagadish <ashwin.jagadish@xxxxxxxxxx>
Subject: Review request — MR !26753: wiretap/netscaler: add 0x9C policy-trace record support

 

Hi all,

I've opened a small merge request adding one new record type to the existing NetScaler capture-file reader, and would appreciate a core-developer review when someone has a moment.

MR: https://gitlab.com/wireshark/wireshark/-/merge_requests/26753

What it does

NetScaler nstrace policy tracing emits a synthetic, non-packet record (type 0x9C, NSPR_PDPKTRACEPOLICY_V35) alongside the normal packet-trace records in a V30/V35 capture. The current reader doesn't recognize this type, so these records are not surfaced. The change:

• adds the NSPR_PDPKTRACEPOLICY_V35 0x9C #define in wiretap/netscaler.h
• handles it in nstrace_read_v30() and nstrace_seek_read_v30(), surfacing the record verbatim as its own frame carrying its embedded nanosecond timestamp.

It's self-contained (touching only wiretap/netscaler.c and netscaler.h); no existing record handling is modified.

A design point I'd like feedback on

The reader is intentionally scoped to just identifying and surfacing the record; decoding of the record body is handled by a Lua dissector (not part of this MR). The record is surfaced with encapsulation WTAP_ENCAP_USER15, which the Lua dissector registers on to decode it.

Process note

The fork pipeline couldn't run (free-tier CI identity verification), so the pipeline on the MR may need to be run in the Wireshark project.

Thanks for taking a look.

Aman Agrawal