10.3. Additional notes on adding support for reading new capture formats
Prev | Chapter 10. Wiretap | Next

## 10.3. Additional notes on adding support for reading new capture formats

If your "open" routine needs to allocate any memory that persists while the file is open, you will need to save a reference to the allocated memory in the `priv` member of the `wtap` structure. The data referenced directly from this pointer will be automatically freed by wiretap (using `g_free()`) when the capture file is closed. However, if this data contains pointers to other memory structures you’ve allocated separately, you’ll need to explicitly free those structures. To do this, you’ll need to create a "close" routine, and set the `wtap` 's `subtype_close` member to point at the routine.

The "read" routine should set the variable `data_offset` to the byte offset within the capture file from which the "seek and read" routine will read. If the capture records consist of:

    capture record header
    pseudo-header (e.g., for ATM)
    frame data

then `data_offset` should point to the pseudo-header. The first sequential read pass will process and store the capture record header data, but it will not store the pseudo-header. Note that the seek_and_read routine should work with the "random_fh" file handle of the passed in wtap struct, instead of the "fh" file handle used in the normal read routine.

Prev | Up | Next
10.2. Creating a new wiretap module | Home | 10.4. Adding support for writing capture formats