Wireshark-dev: [Wireshark-dev] Re: Review request — MR !26753: wiretap/netscaler: add 0x9C poli

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jamil Ahmad <ahmadjamil09335@xxxxxxxxx>
Date: Sat, 17 Oct 2026 12:52:01 +0530
I didn't get it right, what all these means ? Appreciate if can explain it to me,
Regards,
JA

HRA

On Fri, 16 Oct 2026, 9:20 pm Aman Agrawal via Wireshark-dev, <wireshark-dev@xxxxxxxxxxxxx> wrote:
Hi All,

Thanks for reviewing the initial changes to MR !26753 (adding the NetScaler 0x9C policy-trace record to the nstrace reader) and sharing your feedback.

I've pushed a revised version addressing the comments:
  • No more WTAP_ENCAP_USER15. A policy-trace record is a synthetic,
    • non-packet summary emitted once at flow end (not a captured frame), so
      the reader now surfaces it as REC_TYPE_FT_SPECIFIC_EVENT — which removes
      the USER0-15 private-linktype concern entirely. I went with EVENT rather
      than REPORT because the record carries a meaningful flow-end timestamp,
      but I'm happy to switch to REPORT if you feel that fits better.
  • Dissection is now routed the standard way for file-type-specific records,
    • via the wtap_fts_rec table keyed by the nstrace file type — no
      WTAP_ENCAP_* or LINKTYPE involved. This adds a small recognition hook in
      epan/dissectors/packet-nstrace.c alongside the wiretap change; the
      detailed field decode still lives in an out-of-tree Lua dissector, as

Please review the revised version whenever someone has a moment. 

Thanks,
Aman Agrawal

From: Aman Agrawal <aman.agrawal@xxxxxxxxxx>
Sent: Wednesday, October 7, 2026 9:54 PM
To: wireshark-dev@xxxxxxxxxxxxx <wireshark-dev@xxxxxxxxxxxxx>
Cc: Goutham Shetlur Mohan <Goutham.ShetlurMohan@xxxxxxxxxx>; Ashwin Jagadish <ashwin.jagadish@xxxxxxxxxx>
Subject: Review request — MR !26753: wiretap/netscaler: add 0x9C policy-trace record support
 
Hi all,

I've opened a small merge request adding one new record type to the existing NetScaler capture-file reader, and would appreciate a core-developer review when someone has a moment.


What it does

NetScaler nstrace policy tracing emits a synthetic, non-packet record (type 0x9C, NSPR_PDPKTRACEPOLICY_V35) alongside the normal packet-trace records in a V30/V35 capture. The current reader doesn't recognize this type, so these records are not surfaced. The change:
    • adds the NSPR_PDPKTRACEPOLICY_V35 0x9C #define in wiretap/netscaler.h
    • handles it in nstrace_read_v30() and nstrace_seek_read_v30(), surfacing the record verbatim as its own frame carrying its embedded nanosecond timestamp.
It's self-contained (touching only wiretap/netscaler.c and netscaler.h); no existing record handling is modified.

A design point I'd like feedback on

The reader is intentionally scoped to just identifying and surfacing the record; decoding of the record body is handled by a Lua dissector (not part of this MR). The record is surfaced with encapsulation WTAP_ENCAP_USER15, which the Lua dissector registers on to decode it.

Process note

The fork pipeline couldn't run (free-tier CI identity verification), so the pipeline on the MR may need to be run in the Wireshark project.

Thanks for taking a look.

Aman Agrawal
_______________________________________________
Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx