Changes in / [5e5b6ca:b9af56e]

Files:

• AUTHORS (modified) (1 diff)
• lib/Makefile.am (modified) (1 diff)
• lib/dagformat.h (modified) (1 diff)
• lib/format_atmhdr.c (modified) (1 diff)
• lib/format_bpf.c (modified) (2 diffs)
• lib/format_dag24.c (modified) (1 diff)
• lib/format_dag25.c (modified) (1 diff)
• lib/format_dpdk.c (modified) (1 diff)
• lib/format_dpdkndag.c (modified) (1 diff)
• lib/format_duck.c (modified) (1 diff)
• lib/format_erf.c (modified) (11 diffs)
• lib/format_erf.h (modified) (2 diffs)
• lib/format_etsilive.c (modified) (1 diff)
• lib/format_legacy.c (modified) (4 diffs)
• lib/format_linux_common.c (modified) (1 diff)
• lib/format_linux_int.c (modified) (2 diffs)
• lib/format_linux_ring.c (modified) (2 diffs)
• lib/format_ndag.c (modified) (1 diff)
• lib/format_pcap.c (modified) (2 diffs)
• lib/format_pcapfile.c (modified) (2 diffs)
• lib/format_pcapng.c (modified) (18 diffs)
• lib/format_pcapng.h (added)
• lib/format_pktmeta.c (added)
• lib/format_rt.c (modified) (1 diff)
• lib/format_tsh.c (modified) (2 diffs)
• lib/libtrace.h.in (modified) (5 diffs)
• lib/libtrace_int.h (modified) (3 diffs)
• lib/libtrace_parallel.h (modified) (3 diffs)
• lib/trace.c (modified) (1 diff)
• lib/trace_parallel.c (modified) (4 diffs)
• libpacketdump/Makefile.am (modified) (2 diffs)
• libpacketdump/libpacketdump.cc (modified) (7 diffs)
• libpacketdump/libpacketdump.h (modified) (1 diff)
• libpacketdump/link_21.c (added)
• libpacketdump/link_23.c (added)
• tools/tracepktdump/tracepktdump.cc (modified) (1 diff)

AUTHORS

@@ -39 +39 @@
  * Hendrik Leppelsack for reporting and fixing some errors in the tool manpages
  * Jacob van Walraven for spending a summer doing various coding odd-jobs
+ * Mark Weiman for fixing an uninitialised memory bug that was upsetting
+   Valgrind.
  * Jamie Curtis for fixing a couple of bugs many many years ago
  * Brendon Jones for creating the original Windows DLLs and writing bits of

lib/Makefile.am

@@ -63 +63 @@
 
 libtrace_la_SOURCES = trace.c trace_parallel.c common.h \
-                format_erf.c format_pcap.c format_legacy.c \
+                format_pktmeta.c format_erf.c format_pcap.c format_legacy.c \
                 format_rt.c format_helper.c format_helper.h format_pcapfile.c \
                 format_duck.c format_tsh.c $(NATIVEFORMATS) $(BPFFORMATS) \

lib/dagformat.h

@@ -104 +104 @@
 } PACKED dag_record_t;
 
+typedef struct dag_section_header {
+        uint16_t type;
+        uint16_t len;
+} PACKED dag_sec_t;
+
+struct dag_opthdr {
+        uint16_t optcode;
+        uint16_t optlen;
+} PACKED;
+
 #ifdef WIN32
 #pragma pack(pop)

lib/format_atmhdr.c

@@ -209 +209 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_bpf.c

@@ -632 +632 @@
         NULL,                   /* get_timespec */
         NULL,                   /* get_seconds */
+        NULL,                   /* get_meta_section */
         NULL,                   /* seek_erf */
         NULL,                   /* seek_timeval */
@@ -683 +684 @@
         NULL,                   /* get_timespec */
         NULL,                   /* get_seconds */
+        NULL,                   /* get_meta_section */
         NULL,                   /* seek_erf */
         NULL,                   /* seek_timeval */

lib/format_dag24.c

@@ -542 +542 @@
         NULL,                           /* seek_timeval */
         NULL,                           /* seek_seconds */
+        NULL,                           /* get_meta_section */
         erf_get_capture_length,         /* get_capture_length */
         erf_get_wire_length,            /* get_wire_length */

lib/format_dag25.c

@@ -1631 +1631 @@
         NULL,                           /* get_seconds */
         NULL,                           /* get_timespec */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_dpdk.c

@@ -2268 +2268 @@
         NULL,                               /* seek_timeval */
         NULL,                               /* seek_seconds */
+        NULL,                               /* get_meta_section */
         dpdk_get_capture_length,            /* get_capture_length */
         dpdk_get_wire_length,               /* get_wire_length */

lib/format_dpdkndag.c

@@ -749 +749 @@
         NULL,                   /* seek_timeval */
         NULL,                   /* seek_seconds */
+        NULL,                   /* get_meta_section */
         erf_get_capture_length, /* get_capture_length */
         erf_get_wire_length,    /* get_wire_length */

lib/format_duck.c

@@ -363 +363 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_erf.c

@@ -61 +61 @@
  */
 
+#define ERF_META_TYPE 27
 
 static struct libtrace_format_t erfformat;
@@ -86 +87 @@
         /* Number of packets that were dropped during the capture */
         uint64_t drops;
+
+        bool discard_meta;
 
         /* Config options for the input trace */
@@ -260 +263 @@
         DATA(libtrace)->drops = 0;
 
+        DATA(libtrace)->discard_meta = 0;
+
         return 0; /* success */
 }
@@ -281 +286 @@
                                         "Unsupported option");
                         return -1;
+                case TRACE_OPTION_DISCARD_META:
+                        if (*(int *)value > 0) {
+                                DATA(libtrace)->discard_meta = true;
+                        } else {
+                                DATA(libtrace)->discard_meta = false;
+                        }
+                        return 0;
                 default:
                         /* Unknown option */
@@ -539 +551 @@
         unsigned int rlen;
         uint32_t flags = 0;
-        
-        
+        libtrace_rt_types_t linktype;
+        int gotpacket = 0;
+
         if (!packet->buffer || packet->buf_control == TRACE_CTRL_EXTERNAL) {
                 packet->buffer = malloc((size_t)LIBTRACE_PACKET_BUFSIZE);
                 if (!packet->buffer) {
-                        trace_set_err(libtrace, errno, 
-                                        "Cannot allocate memory");
+                        trace_set_err(libtrace, errno, "Cannot allocate memory");
                         return -1;
                 }
         }
 
-        flags |= TRACE_PREP_OWN_BUFFER; 
-        
-        if ((numbytes=wandio_read(libtrace->io,
-                                        packet->buffer,
-                                        (size_t)dag_record_size)) == -1) {
-                trace_set_err(libtrace,errno,"reading ERF file");
-                return -1;
-        }
-        /* EOF */
-        if (numbytes == 0) {
-                return 0;
-        }
-
-        if (numbytes < (int)dag_record_size) {
-                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, "Incomplete ERF header");
-                return -1;
-        }
-
-        rlen = ntohs(((dag_record_t *)packet->buffer)->rlen);
-        buffer2 = (char*)packet->buffer + dag_record_size;
-        size = rlen - dag_record_size;
-
-        if (size >= LIBTRACE_PACKET_BUFSIZE) {
-                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, 
+        flags |= TRACE_PREP_OWN_BUFFER;
+
+        while (!gotpacket) {
+
+                if ((numbytes=wandio_read(libtrace->io, packet->buffer,
+                        (size_t)dag_record_size)) == -1) {
+
+                        trace_set_err(libtrace,errno,"reading ERF file");
+                        return -1;
+                }
+
+                /* EOF */
+                if (numbytes == 0) {
+                        return 0;
+                }
+
+                if (numbytes < (int)dag_record_size) {
+                        trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, "Incomplete ERF header");
+                        return -1;
+                }
+
+                rlen = ntohs(((dag_record_t *)packet->buffer)->rlen);
+                buffer2 = (char*)packet->buffer + dag_record_size;
+                size = rlen - dag_record_size;
+
+                if (size >= LIBTRACE_PACKET_BUFSIZE) {
+                        trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, 
                                 "Packet size %u larger than supported by libtrace - packet is probably corrupt", 
                                 size);
-                return -1;
-        }
-
-        /* Unknown/corrupt */
-        if ((((dag_record_t *)packet->buffer)->type & 0x7f) > ERF_TYPE_MAX) {
-                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, 
+                        return -1;
+                }
+
+                /* Unknown/corrupt */
+                if ((((dag_record_t *)packet->buffer)->type & 0x7f) > ERF_TYPE_MAX) {
+                        trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, 
                                 "Corrupt or Unknown ERF type");
-                return -1;
-        }
-        
-        /* read in the rest of the packet */
-        if ((numbytes=wandio_read(libtrace->io,
-                                        buffer2,
-                                        (size_t)size)) != (int)size) {
-                if (numbytes==-1) {
-                        trace_set_err(libtrace,errno, "read(%s)", 
+                        return -1;
+                }
+
+                /* read in the rest of the packet */
+                if ((numbytes=wandio_read(libtrace->io, buffer2,
+                        (size_t)size)) != (int)size) {
+
+                        if (numbytes==-1) {
+                                trace_set_err(libtrace,errno, "read(%s)", 
                                         libtrace->uridata);
+                                return -1;
+                        }
+
+                        trace_set_err(libtrace,EIO,
+                                "Truncated packet (wanted %d, got %d)", size, numbytes);
+
+                        /* Failed to read the full packet?  must be EOF */
                         return -1;
                 }
-                trace_set_err(libtrace,EIO,
-                                "Truncated packet (wanted %d, got %d)", 
-                                size, numbytes);
-                /* Failed to read the full packet?  must be EOF */
-                return -1;
-        }
-
-        if (numbytes < (int)size) {
-                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, "Incomplete ERF record");
-                return -1;
-        }
-        
-        if (erf_prepare_packet(libtrace, packet, packet->buffer, 
-                                TRACE_RT_DATA_ERF, flags))
-                return -1;
-        
+
+                if (numbytes < (int)size) {
+                        trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, "Incomplete ERF record");
+                        return -1;
+                }
+
+                /* If a provenance packet make sure correct rt linktype is set.
+                 * Only bits 0-6 are used for the type */
+                if ((((dag_record_t *)packet->buffer)->type & 127) == ERF_META_TYPE) {
+                        linktype = TRACE_RT_ERF_META;
+                } else { linktype = TRACE_RT_DATA_ERF; }
+
+                /* If this is a meta packet and TRACE_OPTION_DISCARD_META is set
+                 * ignore this packet and get another */
+                if ((linktype == TRACE_RT_ERF_META && !DATA(libtrace)->discard_meta) ||
+                        linktype == TRACE_RT_DATA_ERF) {
+                        gotpacket = 1;
+
+                        if (erf_prepare_packet(libtrace, packet, packet->buffer, linktype, flags)) {
+                                return -1;
+                        }
+                }
+        }
+
         return rlen;
 }
@@ -940 +970 @@
 }
 
+static char *erf_get_option_name(uint32_t option) {
+        switch(option) {
+                case (ERF_PROV_COMMENT): return "Comment";
+                case (ERF_PROV_FCS_LEN): return "FCS Length";
+                case (ERF_PROV_MASK_CIDR): return "Subnet CIDR";
+                case (ERF_PROV_NAME): return "Interface Name";
+                case (ERF_PROV_DESCR): return "Interface Description";
+                case (ERF_PROV_APP_NAME): return "Application Name";
+                case (ERF_PROV_HOSTNAME): return "Hostname";
+                case (ERF_PROV_OS): return "Operating System";
+                case (ERF_PROV_MODEL): return "Model";
+                case (ERF_PROV_FW_VERSION): return "Firmware Version";
+                case (ERF_PROV_SERIAL_NO): return "Serial Number";
+                case (ERF_PROV_ORG_NAME): return "Organisation Name";
+                case (ERF_PROV_SNAPLEN): return "Snap length";
+                case (ERF_PROV_CARD_NUM): return "DAG Card Number";
+                case (ERF_PROV_MODULE_NUM): return "DAG Module Number";
+                case (ERF_PROV_LOC_NAME): return "Capture Location";
+                case (ERF_PROV_FLOW_HASH_MODE): return "Flow Hash Mode";
+                case (ERF_PROV_FILTER): return "Filter";
+                case (ERF_PROV_TUNNELING_MODE): return "Tunneling Mode";
+                case (ERF_PROV_ROTFILE_NAME): return "Rotfile Name";
+                case (ERF_PROV_LOC_DESCR): return "Location Description";
+                case (ERF_PROV_MEM): return "Stream Buffer Memory";
+                case (ERF_PROV_DEV_NAME): return "DAG Device Name";
+                case (ERF_PROV_DEV_PATH): return "DAG Device Path";
+                case (ERF_PROV_APP_VERSION): return "Capture Application Version";
+                case (ERF_PROV_CPU): return "CPU";
+                case (ERF_PROV_CPU_PHYS_CORES): return "CPU Cores";
+                case (ERF_PROV_CPU_NUMA_NODES): return "CPU NUMA Nodes";
+                case (ERF_PROV_DAG_VERSION): return "DAG Software Version";
+                case (ERF_PROV_IF_NUM): return "Interface Number";
+                case (ERF_PROV_IF_SPEED): return "Interface Speed";
+                case (ERF_PROV_IF_IPV4): return "Interface IPv4";
+                case (ERF_PROV_IF_IPV6): return "Interface IPv6";
+                case (ERF_PROV_IF_MAC): return "Interface MAC";
+                case (ERF_PROV_IF_SFP_TYPE): return "Transceiver Type";
+                case (ERF_PROV_IF_LINK_STATUS): return "Link Status";
+                case (ERF_PROV_IF_PHY_MODE): return "PHY Mode";
+                case (ERF_PROV_IF_PORT_TYPE): return "Port Type";
+                case (ERF_PROV_IF_RX_LATENCY): return "Latency";
+                case (ERF_PROV_IF_RX_POWER): return "Optical RX Power";
+                case (ERF_PROV_IF_TX_POWER): return "Optical TX Power";
+                case (ERF_PROV_CLK_SOURCE): return "CLK Source";
+                case (ERF_PROV_CLK_STATE): return "CLK State";
+                case (ERF_PROV_CLK_THRESHOLD): return "CLK Threshold";
+                case (ERF_PROV_CLK_CORRECTION): return "CLK Correction";
+                case (ERF_PROV_CLK_FAILURES): return "CLK Failures";
+                case (ERF_PROV_CLK_RESYNCS): return "CLK Resyncs";
+                case (ERF_PROV_CLK_PHASE_ERROR): return "CLK Phase Errors";
+                case (ERF_PROV_CLK_INPUT_PULSES): return "CLK Input Pulses";
+                case (ERF_PROV_CLK_REJECTED_PULSES): return "CLK Rejected Pulses";
+                case (ERF_PROV_CLK_PHC_INDEX): return "CLK PHC Index";
+                case (ERF_PROV_CLK_PHC_OFFSET): return "CLK PHC Offset";
+                case (ERF_PROV_CLK_TIMEBASE): return "CLK Timebase";
+                case (ERF_PROV_CLK_DESCR): return "CLK Description";
+                case (ERF_PROV_CLK_OUT_SOURCE): return "CLK Output Source" ;
+                case (ERF_PROV_CLK_LINK_MODE): return "CLK Link Mode";
+                case (ERF_PROV_PTP_DOMAIN_NUM): return "PTP Domain Number";
+                case (ERF_PROV_PTP_STEPS_REMOVED): return "PTP Steps removed";
+                case (ERF_PROV_CLK_PORT_PROTO): return "CLK Port Protocol";
+                default:
+                        return "Unknown";
+        }
+        return "duno";
+}
+
+static libtrace_meta_datatype_t erf_get_datatype(uint32_t option) {
+        switch(option) {
+                case (ERF_PROV_COMMENT): return TRACE_META_STRING;
+                case (ERF_PROV_FCS_LEN): return TRACE_META_UINT32;
+                case (ERF_PROV_MASK_CIDR): return TRACE_META_UINT32;
+                case (ERF_PROV_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_DESCR): return TRACE_META_STRING;
+                case (ERF_PROV_APP_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_HOSTNAME): return TRACE_META_STRING;
+                case (ERF_PROV_OS): return TRACE_META_STRING;
+                case (ERF_PROV_MODEL): return TRACE_META_STRING;
+                case (ERF_PROV_FW_VERSION): return TRACE_META_STRING;
+                case (ERF_PROV_SERIAL_NO): return TRACE_META_STRING;
+                case (ERF_PROV_ORG_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_SNAPLEN): return TRACE_META_UINT32;
+                case (ERF_PROV_CARD_NUM): return TRACE_META_UINT32;
+                case (ERF_PROV_MODULE_NUM): return TRACE_META_UINT32;
+                case (ERF_PROV_LOC_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_FILTER): return TRACE_META_STRING;
+                case (ERF_PROV_FLOW_HASH_MODE): return TRACE_META_UINT32;
+                case (ERF_PROV_TUNNELING_MODE): return TRACE_META_UINT32;
+                case (ERF_PROV_ROTFILE_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_LOC_DESCR): return TRACE_META_STRING;
+                case (ERF_PROV_MEM): return TRACE_META_UINT64;
+                case (ERF_PROV_DEV_NAME): return TRACE_META_STRING;
+                case (ERF_PROV_DEV_PATH): return TRACE_META_STRING;
+                case (ERF_PROV_APP_VERSION): return TRACE_META_STRING;
+                case (ERF_PROV_CPU): return TRACE_META_STRING;
+                case (ERF_PROV_CPU_PHYS_CORES): return TRACE_META_UINT32;
+                case (ERF_PROV_CPU_NUMA_NODES): return TRACE_META_UINT32;
+                case (ERF_PROV_DAG_VERSION): return TRACE_META_STRING;
+                case (ERF_PROV_IF_NUM): return TRACE_META_UINT32;
+                case (ERF_PROV_IF_SPEED): return TRACE_META_UINT64;
+                case (ERF_PROV_IF_IPV4): return TRACE_META_IPV4;
+                case (ERF_PROV_IF_IPV6): return TRACE_META_IPV6;
+                case (ERF_PROV_IF_MAC): return TRACE_META_MAC;
+                case (ERF_PROV_IF_SFP_TYPE): return TRACE_META_STRING;
+                case (ERF_PROV_IF_LINK_STATUS): return TRACE_META_UINT32;
+                case (ERF_PROV_IF_PHY_MODE): return TRACE_META_STRING;
+                case (ERF_PROV_IF_PORT_TYPE): return TRACE_META_UINT32;
+                /* this is a ts_rel, need to double check */
+                case (ERF_PROV_IF_RX_LATENCY): return TRACE_META_UINT64;
+                case (ERF_PROV_IF_RX_POWER): return TRACE_META_UINT32;
+                case (ERF_PROV_IF_TX_POWER): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_SOURCE): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_STATE): return TRACE_META_UINT32;
+                /* this is a ts_rel, need to double check */
+                case (ERF_PROV_CLK_THRESHOLD): return TRACE_META_UINT64;
+                /* this is a ts_rel, need to double check */
+                case (ERF_PROV_CLK_CORRECTION): return TRACE_META_UINT64;
+                case (ERF_PROV_CLK_FAILURES): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_RESYNCS): return TRACE_META_UINT32;
+                /* this is a ts_rel, need to double check */
+                case (ERF_PROV_CLK_PHASE_ERROR): return TRACE_META_UINT64;
+                case (ERF_PROV_CLK_INPUT_PULSES): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_REJECTED_PULSES): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_PHC_INDEX): return TRACE_META_UINT32;
+                /* this is a ts_rel, need to double check */
+                case (ERF_PROV_CLK_PHC_OFFSET): return TRACE_META_UINT64;
+                case (ERF_PROV_CLK_TIMEBASE): return TRACE_META_STRING;
+                case (ERF_PROV_CLK_DESCR): return TRACE_META_STRING;
+                case (ERF_PROV_CLK_OUT_SOURCE): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_LINK_MODE): return TRACE_META_UINT32;
+                case (ERF_PROV_PTP_DOMAIN_NUM): return TRACE_META_UINT32;
+                case (ERF_PROV_PTP_STEPS_REMOVED): return TRACE_META_UINT32;
+                case (ERF_PROV_CLK_PORT_PROTO): return TRACE_META_UINT32;
+                default:
+                        return TRACE_META_UNKNOWN;
+        }
+}
+
+/* An ERF provenance packet can contain multiple sections of the same type per packet */
+void *erf_get_meta_section(libtrace_packet_t *packet, uint32_t section) {
+
+        void *ptr;
+        dag_record_t *hdr;
+        dag_sec_t *sec;
+        uint16_t tmp;
+        uint16_t remaining;
+        uint16_t curr_sec = 0;
+
+        if (packet == NULL) {
+                fprintf(stderr, "NULL packet passed into erf_get_meta_section()\n");
+                return NULL;
+        }
+        if (packet->buffer == NULL) { return NULL; }
+
+        hdr = (dag_record_t *)packet->buffer;
+        ptr = packet->payload;
+
+        /* ensure this packet is a meta packet */
+        if ((hdr->type & 127) != ERF_META_TYPE) { return NULL; }
+        /* set remaining to size of packet minus header length */
+        remaining = ntohs(hdr->rlen) - 24;
+
+        /* setup structure to hold the result */
+        libtrace_meta_t *result = malloc(sizeof(libtrace_meta_t));
+        result->section = section;
+        result->num = 0;
+
+        while (remaining > sizeof(dag_sec_t)) {
+
+                /* Get the current section/option header */
+                sec = (dag_sec_t *)ptr;
+
+                if (ntohs(sec->type) == ERF_PROV_SECTION_CAPTURE
+                        || ntohs(sec->type) == ERF_PROV_SECTION_HOST
+                        || ntohs(sec->type) == ERF_PROV_SECTION_MODULE
+                        || ntohs(sec->type) == ERF_PROV_SECTION_INTERFACE) {
+
+                        curr_sec = ntohs(sec->type);
+                }
+
+                /* If the current section the requested one and this is not
+                 * a section header */
+                if (section == curr_sec &&
+                        ntohs(sec->type) != ERF_PROV_SECTION_CAPTURE
+                        && ntohs(sec->type) != ERF_PROV_SECTION_HOST
+                        && ntohs(sec->type) != ERF_PROV_SECTION_MODULE
+                        && ntohs(sec->type) != ERF_PROV_SECTION_INTERFACE) {
+
+                        result->num += 1;
+                        if (result->num == 1) {
+                                result->items = malloc(sizeof(libtrace_meta_item_t));
+                        } else {
+                                result->items = realloc(result->items,
+                                        result->num*sizeof(libtrace_meta_item_t));
+                        }
+                        result->items[result->num-1].option = ntohs(sec->type);
+                        result->items[result->num-1].option_name =
+                                erf_get_option_name(ntohs(sec->type));
+
+                        result->items[result->num-1].len = ntohs(sec->len);
+                        result->items[result->num-1].datatype =
+                                erf_get_datatype(ntohs(sec->type));
+
+                        /* If the datatype is a string allow for a null terminator */
+                        if (result->items[result->num-1].datatype == TRACE_META_STRING) {
+                                result->items[result->num-1].data =
+                                        calloc(1, ntohs(sec->len)+1);
+                                ((char *)result->items[result->num-1].data)[ntohs(sec->len)] = '\0';
+                                /* and copy the utf8 string */
+                                memcpy(result->items[result->num-1].data,
+                                        ptr+sizeof(struct dag_opthdr), ntohs(sec->len));
+                        } else {
+                                result->items[result->num-1].data =
+                                        calloc(1, ntohs(sec->len));
+                                /* depending on the datatype we need to ensure the data is
+                                 * in host byte ordering */
+                                if (result->items[result->num-1].datatype == TRACE_META_UINT32) {
+                                        uint32_t t = *(uint32_t *)(ptr+sizeof(struct dag_opthdr));
+                                        t = ntohl(t);
+                                        memcpy(result->items[result->num-1].data,
+                                                &t, sizeof(uint32_t));
+                                } else if(result->items[result->num-1].datatype == TRACE_META_UINT64) {
+                                        uint64_t t = *(uint64_t *)(ptr+sizeof(struct dag_opthdr));
+                                        t = bswap_be_to_host64(t);
+                                        memcpy(result->items[result->num-1].data,
+                                                &t, sizeof(uint64_t));
+                                } else {
+                                        memcpy(result->items[result->num-1].data,
+                                                ptr+sizeof(struct dag_opthdr), ntohs(sec->len));
+                                }
+                        }
+                }
+
+                /* Update remaining and ptr. Also account for any padding */
+                if ((ntohs(sec->len) % 4) != 0) {
+                        tmp = ntohs(sec->len) + (4 - (ntohs(sec->len) % 4)) + sizeof(dag_sec_t);
+                } else {
+                        tmp = ntohs(sec->len) + sizeof(dag_sec_t);
+                }
+                remaining -= tmp;
+                ptr += tmp;
+        }
+
+        /* If the result num > 0 matches were found */
+        if (result->num > 0) {
+                return (void *)result;
+        } else {
+                free(result);
+                return NULL;
+        }
+}
+
 static void erf_help(void) {
         printf("erf format module: $Revision: 1752 $\n");
@@ -958 +1240 @@
         printf("\n");
 
-        
+
 }
 
@@ -967 +1249 @@
         NULL,                           /* probe filename */
         erf_probe_magic,                /* probe magic */
-        erf_init_input,                 /* init_input */        
+        erf_init_input,                 /* init_input */
         erf_config_input,               /* config_input */
         erf_start_input,                /* start_input */
@@ -988 +1270 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        erf_get_meta_section,           /* get_meta_section */
         erf_seek_erf,                   /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -1012 +1295 @@
         NULL,                           /* probe filename */
         NULL,           /* probe magic */
-        erf_init_input,                 /* init_input */        
+        erf_init_input,                 /* init_input */
         erf_config_input,               /* config_input */
         rawerf_start_input,             /* start_input */
@@ -1033 +1316 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        erf_get_meta_section,           /* get_meta_section */
         erf_seek_erf,                   /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_erf.h

@@ -29 +29 @@
 #include "libtrace.h"
 
+/* ERF Section codes */
+#define ERF_PROV_SECTION_CAPTURE 0xFF00
+#define ERF_PROV_SECTION_HOST 0xFF01
+#define ERF_PROV_SECTION_MODULE 0xFF02
+#define ERF_PROV_SECTION_INTERFACE 0xFF03
+
+/* ERF Provenance record tag type codes */
+#define ERF_PROV_COMMENT 1
+#define ERF_PROV_FCS_LEN 8
+#define ERF_PROV_MASK_CIDR 10
+#define ERF_PROV_NAME 12
+#define ERF_PROV_DESCR 13
+#define ERF_PROV_APP_NAME 16
+#define ERF_PROV_HOSTNAME 18
+#define ERF_PROV_OS 17
+#define ERF_PROV_MODEL 20
+#define ERF_PROV_FW_VERSION 21
+#define ERF_PROV_SERIAL_NO 22
+#define ERF_PROV_ORG_NAME 11
+#define ERF_PROV_SNAPLEN 29
+#define ERF_PROV_CARD_NUM 30
+#define ERF_PROV_MODULE_NUM 31
+#define ERF_PROV_LOC_NAME 34
+#define ERF_PROV_FILTER 36
+#define ERF_PROV_FLOW_HASH_MODE 37
+#define ERF_PROV_TUNNELING_MODE 38
+#define ERF_PROV_ROTFILE_NAME 43
+#define ERF_PROV_LOC_DESCR 46
+#define ERF_PROV_APP_VERSION 47
+#define ERF_PROV_MEM 40
+#define ERF_PROV_DEV_NAME 44
+#define ERF_PROV_DEV_PATH 45
+#define ERF_PROV_CPU 49
+#define ERF_PROV_CPU_PHYS_CORES 50
+#define ERF_PROV_CPU_NUMA_NODES 51
+#define ERF_PROV_DAG_VERSION 53
+#define ERF_PROV_IF_NUM 64
+#define ERF_PROV_IF_SPEED 66
+#define ERF_PROV_IF_IPV4 67
+#define ERF_PROV_IF_IPV6 68
+#define ERF_PROV_IF_MAC 69
+#define ERF_PROV_IF_SFP_TYPE 78
+#define ERF_PROV_IF_LINK_STATUS 81
+#define ERF_PROV_IF_PHY_MODE 82
+#define ERF_PROV_IF_PORT_TYPE 83
+#define ERF_PROV_IF_RX_LATENCY 84
+#define ERF_PROV_IF_RX_POWER 79
+#define ERF_PROV_IF_TX_POWER 80
+#define ERF_PROV_CLK_SOURCE 384
+#define ERF_PROV_CLK_STATE 385
+#define ERF_PROV_CLK_THRESHOLD 386
+#define ERF_PROV_CLK_CORRECTION 387
+#define ERF_PROV_CLK_FAILURES 388
+#define ERF_PROV_CLK_RESYNCS 389
+#define ERF_PROV_CLK_PHASE_ERROR 390
+#define ERF_PROV_CLK_INPUT_PULSES 391
+#define ERF_PROV_CLK_REJECTED_PULSES 392
+#define ERF_PROV_CLK_PHC_INDEX 393
+#define ERF_PROV_CLK_PHC_OFFSET 394
+#define ERF_PROV_CLK_TIMEBASE 395
+#define ERF_PROV_CLK_DESCR 396
+#define ERF_PROV_CLK_OUT_SOURCE 397
+#define ERF_PROV_CLK_LINK_MODE 398
+#define ERF_PROV_PTP_DOMAIN_NUM 399
+#define ERF_PROV_PTP_STEPS_REMOVED 400
+#define ERF_PROV_CLK_PORT_PROTO 414
+
 /** @file
  *
@@ -55 +122 @@
 int erf_is_color_type(uint8_t erf_type);
 
+void *erf_get_meta_section(libtrace_packet_t *packet, uint32_t section);
+void *erf_get_meta_section_option(libtrace_packet_t *packet, uint32_t section,
+        uint16_t option);
+
 #endif

lib/format_etsilive.c

@@ -691 +691 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_legacy.c

@@ -536 +536 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -581 +582 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -626 +628 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -671 +674 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_linux_common.c

@@ -172 +172 @@
                 case TRACE_OPTION_CONSTANT_ERF_FRAMING:
                         break;
+                case TRACE_OPTION_DISCARD_META:
+                        break;
                 /* Avoid default: so that future options will cause a warning
                  * here to remind us to implement it, or flag it as

lib/format_linux_int.c

@@ -529 +529 @@
         linuxnative_get_timespec,       /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -590 +591 @@
         linuxnative_get_timespec,       /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_linux_ring.c

@@ -849 +849 @@
         linuxring_get_timespec,         /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -912 +913 @@
         linuxring_get_timespec,         /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_ndag.c

@@ -1524 +1524 @@
         NULL,                   /* get_seconds */
         NULL,                   /* get_timespec */
+        NULL,                   /* get_meta_section */
         NULL,                   /* seek_erf */
         NULL,                   /* seek_timeval */

lib/format_pcap.c

@@ -869 +869 @@
         NULL,                           /* get_seconds */
         NULL,                           /* get_timespec */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -914 +915 @@
         NULL,                           /* get_seconds */
         NULL,                           /* get_timespec */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_pcapfile.c

@@ -286 +286 @@
                         /* All these are either unsupported or handled
                          * by trace_config */
+                        break;
+                case TRACE_OPTION_DISCARD_META:
                         break;
         }
@@ -799 +801 @@
         pcapfile_get_timespec,          /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_pcapng.c

@@ -29 +29 @@
 #include "libtrace_int.h"
 #include "format_helper.h"
+#include "format_pcapng.h"
 
 #include <sys/stat.h>
@@ -38 +39 @@
 #include <stdbool.h>
 #include <math.h>
-
-#define PCAPNG_SECTION_TYPE 0x0A0D0D0A
-#define PCAPNG_INTERFACE_TYPE 0x00000001
-#define PCAPNG_OLD_PACKET_TYPE 0x00000002
-#define PCAPNG_SIMPLE_PACKET_TYPE 0x00000003
-#define PCAPNG_NAME_RESOLUTION_TYPE 0x00000004
-#define PCAPNG_INTERFACE_STATS_TYPE 0x00000005
-#define PCAPNG_ENHANCED_PACKET_TYPE 0x00000006
-#define PCAPNG_CUSTOM_TYPE 0x00000BAD
-#define PCAPNG_CUSTOM_NONCOPY_TYPE 0x40000BAD
-#define PCAPNG_DECRYPTION_SECRETS_TYPE 0x0000000A
-
-#define PCAPNG_NRB_RECORD_END 0x0000
-#define PCAPNG_NRB_RECORD_IP4 0x0001
-#define PCAPNG_NRB_RECORD_IP6 0x0002
-
-#define PCAPNG_CUSTOM_OPTION_UTF8 0xBAC
-#define PCAPNG_CUSTOM_OPTION_BIN 0xBAD
-#define PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY 0x4BAC
-#define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD
-
-#define PCAPNG_OPTION_END 0x0000
-
-#define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE)
-
-#define PACKET_IS_SIMPLE (pcapng_get_record_type(packet) == PCAPNG_SIMPLE_PACKET_TYPE)
-
-#define PACKET_IS_OLD (pcapng_get_record_type(packet) == PCAPNG_OLD_PACKET_TYPE)
-
-#define PCAPNG_IFOPT_TSRESOL 9
-
-#define PCAPNG_PKTOPT_DROPCOUNT 4
-
-#define PCAPNG_STATOPT_START 2
-#define PCAPNG_STATOPT_END 3
-#define PCAPNG_STATOPT_IFRECV 4
-#define PCAPNG_STATOPT_IFDROP 5
-#define PCAPNG_STATOPT_FILTERACCEPT 6
-#define PCAPNG_STATOPT_OSDROP 7
-#define PCAPNG_STATOPT_USRDELIV 8
-
-typedef struct pcagng_section_header_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint32_t ordering;
-        uint16_t majorversion;
-        uint16_t minorversion;
-        uint64_t sectionlen;
-} pcapng_sec_t;
-
-typedef struct pcapng_interface_header_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint16_t linktype;
-        uint16_t reserved;
-        uint32_t snaplen;
-} pcapng_int_t;
-
-typedef struct pcapng_nrb_header_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-} pcapng_nrb_t;
-
-typedef struct pcapng_enhanced_packet_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint32_t interfaceid;
-        uint32_t timestamp_high;
-        uint32_t timestamp_low;
-        uint32_t caplen;
-        uint32_t wlen;
-} pcapng_epkt_t;
-
-typedef struct pcapng_simple_packet_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint32_t wlen;
-} pcapng_spkt_t;
-
-typedef struct pcapng_old_packet_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint16_t interfaceid;
-        uint16_t drops;
-        uint32_t timestamp_high;
-        uint32_t timestamp_low;
-        uint32_t caplen;
-        uint32_t wlen;
-} pcapng_opkt_t;
-
-typedef struct pcapng_stats_header_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint32_t interfaceid;
-        uint32_t timestamp_high;
-        uint32_t timestamp_low;
-} pcapng_stats_t;
-
-typedef struct pcapng_custom_header_t {
-        uint32_t blocktype;
-        uint32_t blocklen;
-        uint32_t pen;
-} pcapng_custom_t;
-
-typedef struct pcapng_interface_t pcapng_interface_t;
-
-struct pcapng_timestamp {
-        uint32_t timehigh;
-        uint32_t timelow;
-};
-
-struct pcapng_interface_t {
-
-        uint16_t id;
-        libtrace_dlt_t linktype;
-        uint32_t snaplen;
-        uint32_t tsresol;
-
-        uint64_t received;
-        uint64_t dropped;       /* as reported by interface stats */
-        uint64_t dropcounter;   /* as reported by packet records */
-        uint64_t accepted;
-        uint64_t osdropped;
-        uint64_t laststats;
-
-};
-
-struct pcapng_format_data_t {
-        bool started;
-        bool realtime;
-
-        /* Section data */
-        bool byteswapped;
-
-        /* Interface data */
-        pcapng_interface_t **interfaces;
-        uint16_t allocatedinterfaces;
-        uint16_t nextintid;
-
-};
-
-struct pcapng_format_data_out_t {
-        iow_t *file;
-        int compress_level;
-        int compress_type;
-        int flag;
-
-        /* Section data */
-        uint16_t sechdr_count;
-        bool byteswapped;
-
-        /* Interface data */
-        uint16_t nextintid;
-        libtrace_linktype_t lastdlt;
-};
-
-struct pcapng_optheader {
-        uint16_t optcode;
-        uint16_t optlen;
-};
-
-struct pcapng_custom_optheader {
-        uint16_t optcode;
-        uint16_t optlen;
-        uint32_t pen;
-};
-struct pcapng_nrb_record {
-        uint16_t recordtype;
-        uint16_t recordlen;
-};
-struct pcapng_peeker {
-        uint32_t blocktype;
-        uint32_t blocklen;
-};
-
-typedef struct pcapng_peeker pcapng_hdr_t;
-
-#define DATA(x) ((struct pcapng_format_data_t *)((x)->format_data))
-#define DATAOUT(x) ((struct pcapng_format_data_out_t*)((x)->format_data))
 
 static char *pcapng_parse_next_option(libtrace_t *libtrace, char **pktbuf,
@@ -656 +478 @@
 }
 
+static void pcapng_create_output_sectionheader_packet(libtrace_out_t *libtrace) {
+        /* Create section block */
+        pcapng_sec_t sechdr;
+        sechdr.blocktype = pcapng_swap32(libtrace, PCAPNG_SECTION_TYPE);
+        sechdr.blocklen = pcapng_swap32(libtrace, 28);
+        sechdr.ordering = pcapng_swap32(libtrace, 0x1A2B3C4D);
+        sechdr.majorversion = pcapng_swap16(libtrace, 1);
+        sechdr.minorversion = 0;
+        sechdr.sectionlen = 0xFFFFFFFFFFFFFFFF;
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &sechdr, sizeof(sechdr));
+        wandio_wwrite(DATAOUT(libtrace)->file, &sechdr.blocklen, sizeof(sechdr.blocklen));
+
+        DATAOUT(libtrace)->sechdr_count += 1;
+}
+
+static void pcapng_create_output_interface_packet(libtrace_out_t *libtrace, libtrace_linktype_t linktype) {
+        /* Create interface block*/
+        pcapng_int_t inthdr;
+        inthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_INTERFACE_TYPE);
+        inthdr.blocklen = pcapng_swap32(libtrace, 20);
+        inthdr.linktype = pcapng_swap16(libtrace, libtrace_to_pcap_dlt(linktype));
+        inthdr.reserved = 0;
+        inthdr.snaplen = 0;
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &inthdr, sizeof(inthdr));
+        wandio_wwrite(DATAOUT(libtrace)->file, &inthdr.blocklen, sizeof(inthdr.blocklen));
+
+        /* increment the interface counter */
+        DATAOUT(libtrace)->nextintid += 1;
+        /* update the last linktype */
+        DATAOUT(libtrace)->lastdlt = linktype;
+}
+
 static int pcapng_probe_magic(io_t *io) {
 
@@ -694 +550 @@
         DATA(libtrace)->started = false;
         DATA(libtrace)->realtime = false;
+        DATA(libtrace)->discard_meta = false;
         DATA(libtrace)->byteswapped = true;
         DATA(libtrace)->interfaces = (pcapng_interface_t **)calloc(10, \
@@ -754 +611 @@
                 case TRACE_OPTION_CONSTANT_ERF_FRAMING:
                         break;
+                case TRACE_OPTION_DISCARD_META:
+                        if (*(int *)data > 0) {
+                                DATA(libtrace)->discard_meta = true;
+                        } else {
+                                DATA(libtrace)->discard_meta = false;
+                        }
+                        return 0;
         }
 
@@ -886 +750 @@
 static int pcapng_get_framing_length(const libtrace_packet_t *packet) {
 
-        switch(pcapng_get_record_type(packet)) {
+        switch(pcapng_get_record_type(packet)) {
                 case PCAPNG_SECTION_TYPE:
                         return sizeof(pcapng_sec_t);
@@ -902 +766 @@
                         return sizeof(pcapng_nrb_t);
                 case PCAPNG_CUSTOM_TYPE:
+                        return sizeof(pcapng_custom_t);
                 case PCAPNG_CUSTOM_NONCOPY_TYPE:
                         return sizeof(pcapng_custom_t);
-        }
+                case PCAPNG_DECRYPTION_SECRETS_TYPE:
+                        return sizeof(pcapng_secrets_t);
+        }
 
         /* If we get here, we aren't a valid pcapng packet */
@@ -1003 +870 @@
                 }
                 case PCAPNG_SIMPLE_PACKET_TYPE: {
+                        /* If no section header or interface packets have been received create and
+                         * output them. This can occur when discard meta is enabled and the input
+                         * format is also pcapng */
+                        if (DATAOUT(libtrace)->sechdr_count == 0) {
+                                pcapng_create_output_sectionheader_packet(libtrace);
+                        }
                         if (DATAOUT(libtrace)->nextintid == 0) {
-                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
-                                        "Cannot output simple packet before a interface "
-                                        "block has been output in pcapng_write_packet()\n");
-                                return -1;
+                                pcapng_create_output_interface_packet(libtrace, linktype);
                         }
                         return pcapng_output_simple_packet(libtrace, packet);
@@ -1015 +885 @@
                 }
                 case PCAPNG_INTERFACE_STATS_TYPE: {
-                        if (DATAOUT(libtrace)->nextintid == 0) {
-                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
-                                        "Cannot output a interface statistics block before a "
-                                        "interface block has been output in pcapng_write_packet()\n");
-                                return -1;
-                        }
+                        /* If no section header or interface packets have been received create and
+                         * output them. This can occur when discard meta is enabled and the input
+                         * format is also pcapng */
+                        if (DATAOUT(libtrace)->sechdr_count == 0) {
+                                pcapng_create_output_sectionheader_packet(libtrace);
+                        }
+                        if (DATAOUT(libtrace)->nextintid == 0) {
+                                pcapng_create_output_interface_packet(libtrace, linktype);
+                        }
                         return pcapng_output_interfacestats_packet(libtrace, packet);
                 }
                 case PCAPNG_ENHANCED_PACKET_TYPE: {
-                        if (DATAOUT(libtrace)->nextintid == 0) {
-                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
-                                        "Cannot output enhanced packet before a interface "
-                                        "block has been output in pcapng_write_packet()\n");
-                                return -1;
-                        }
+                        /* If no section header or interface packets have been received create and
+                         * output them. This can occur when discard meta is enabled and the input
+                         * format is also pcapng */
+                        if (DATAOUT(libtrace)->sechdr_count == 0) {
+                                pcapng_create_output_sectionheader_packet(libtrace);
+                        }
+                        if (DATAOUT(libtrace)->nextintid == 0) {
+                                pcapng_create_output_interface_packet(libtrace, linktype);
+                        }
                         return pcapng_output_enhanced_packet(libtrace, packet);
                 }
@@ -1044 +920 @@
                 default: {
 
-                        /* create section header if not already */
+                        /* create and output section header if none have occured yet */
                         if (DATAOUT(libtrace)->sechdr_count == 0) {
-                                /* Create section block */
-                                pcapng_sec_t sechdr;
-                                sechdr.blocktype = pcapng_swap32(libtrace, PCAPNG_SECTION_TYPE);
-                                sechdr.blocklen = pcapng_swap32(libtrace, 28);
-                                sechdr.ordering = pcapng_swap32(libtrace, 0x1A2B3C4D);
-                                sechdr.majorversion = pcapng_swap16(libtrace, 1);
-                                sechdr.minorversion = 0;
-                                sechdr.sectionlen = 0xFFFFFFFFFFFFFFFF;
-
-                                wandio_wwrite(DATAOUT(libtrace)->file, &sechdr, sizeof(sechdr));
-                                wandio_wwrite(DATAOUT(libtrace)->file, &sechdr.blocklen, sizeof(sechdr.blocklen));
-
-                                DATAOUT(libtrace)->sechdr_count += 1;
+                                pcapng_create_output_sectionheader_packet(libtrace);
                         }
 
-                        /* create interface header if not already or if the linktype has changed */
+                        /* create and output interface header if not already or if the
+                         * linktype has changed */
                         if (DATAOUT(libtrace)->nextintid == 0
                                 || DATAOUT(libtrace)->lastdlt != linktype) {
-                                /* Create interface block*/
-                                pcapng_int_t inthdr;
-                                inthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_INTERFACE_TYPE);
-                                inthdr.blocklen = pcapng_swap32(libtrace, 20);
-                                inthdr.linktype = pcapng_swap16(libtrace, libtrace_to_pcap_dlt(linktype));
-                                inthdr.reserved = 0;
-                                inthdr.snaplen = 0;
-
-                                wandio_wwrite(DATAOUT(libtrace)->file, &inthdr, sizeof(inthdr));
-                                wandio_wwrite(DATAOUT(libtrace)->file, &inthdr.blocklen, sizeof(inthdr.blocklen));
-
-                                /* increment the interface counter */
-                                DATAOUT(libtrace)->nextintid += 1;
-                                /* update the last linktype */
-                                DATAOUT(libtrace)->lastdlt = linktype;
+
+                                pcapng_create_output_interface_packet(libtrace, linktype);
                         }
 
@@ -1769 +1621 @@
                         /* Section Header */
                         case PCAPNG_SECTION_TYPE:
-                                err = pcapng_read_section(libtrace, packet, flags);
-                                gotpacket = 1;
+                                /* Section header packets are required for PCAPNG so even if discard_meta
+                                 * option is set it still needs to be processed. Not setting gotpacket will
+                                 * prevent triggering the meta callback */
+                                err = pcapng_read_section(libtrace, packet, flags);
+                                if (!DATA(libtrace)->discard_meta) {
+                                        gotpacket = 1;
+                                }
+
                                 break;
 
                         /* Interface Header */
                         case PCAPNG_INTERFACE_TYPE:
+                                /* Same applies here for Interface packets */
                                 err = pcapng_read_interface(libtrace, packet, to_read, flags);
-                                gotpacket = 1;
+                                if (!DATA(libtrace)->discard_meta) {
+                                        gotpacket = 1;
+                                }
                                 break;
 
@@ -1792 +1653 @@
 
                         case PCAPNG_INTERFACE_STATS_TYPE:
-                                err = pcapng_read_stats(libtrace, packet, to_read, flags);
-                                gotpacket = 1;
+                                /* If discard_meta is set ignore this packet type */
+                                if (!DATA(libtrace)->discard_meta) {
+                                        err = pcapng_read_stats(libtrace, packet, to_read, flags);
+                                        gotpacket = 1;
+                                }
                                 break;
 
                         case PCAPNG_NAME_RESOLUTION_TYPE:
-                                err = pcapng_read_nrb(libtrace, packet, to_read, flags);
-                                gotpacket = 1;
+                                /* If discard meta is set ignore this packet type */
+                                if (!DATA(libtrace)->discard_meta) {
+                                        err = pcapng_read_nrb(libtrace, packet, to_read, flags);
+                                        gotpacket = 1;
+                                }
                                 break;
 
                         case PCAPNG_CUSTOM_TYPE:
                         case PCAPNG_CUSTOM_NONCOPY_TYPE:
-                                err = pcapng_read_custom(libtrace, packet, to_read, flags);
-                                gotpacket = 1;
+                                /* If discard meta is set ignore this packet type */
+                                if (!DATA(libtrace)->discard_meta) {
+                                        err = pcapng_read_custom(libtrace, packet, to_read, flags);
+                                        gotpacket = 1;
+                                }
                                 break;
 
@@ -1838 +1708 @@
 static libtrace_direction_t pcapng_get_direction(const libtrace_packet_t
                 *packet) {
+        libtrace_direction_t direction = -1;
 
         /* Defined in format_helper.c */
-        return pcap_get_direction(packet);
+        if (PACKET_IS_ENHANCED || PACKET_IS_SIMPLE || PACKET_IS_OLD) {
+                direction = pcap_get_direction(packet);
+        }
+
+        return direction;
 }
 
@@ -1942 +1817 @@
                         return ohdr->wlen;
                 }
-        }
+        } else if (PACKET_IS_SECTION || PACKET_IS_INTERFACE || PACKET_IS_NAME_RESOLUTION
+                || PACKET_IS_INTERFACE_STATS || PACKET_IS_CUSTOM ||
+                PACKET_IS_CUSTOM_NONCOPY || PACKET_IS_DECRYPTION_SECRETS) {
+                /* meta packet are not transmitted on the wire hence the 0 wirelen */
+                return 0;
+        }
 
         /* If we get here, we aren't a valid pcapng packet */
@@ -1958 +1838 @@
         if (baselen == -1)
                 return -1;
+
+        /* if packet was a meta packet baselen should be zero so return it */
+        if (baselen == 0) {
+                return 0;
+        }
 
         /* Then, account for the vagaries of different DLTs */
@@ -2023 +1908 @@
                         return ohdr->caplen;
                 }
-        }
+        } else if (PACKET_IS_SECTION || PACKET_IS_INTERFACE || PACKET_IS_NAME_RESOLUTION
+                || PACKET_IS_INTERFACE_STATS || PACKET_IS_CUSTOM ||
+                PACKET_IS_CUSTOM_NONCOPY || PACKET_IS_DECRYPTION_SECRETS) {
+
+                struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->header;
+                if (DATA(packet->trace)->byteswapped) {
+                        return byteswap32(hdr->blocklen) - trace_get_framing_length(packet);
+                } else {
+                        return hdr->blocklen - trace_get_framing_length(packet);
+                }
+        }
 
         /* If we get here, we aren't a valid pcapng packet */
@@ -2152 +2047 @@
         stat->captured_valid = 1;
 
+
+}
+
+static libtrace_meta_datatype_t pcapng_get_datatype(uint32_t section, uint32_t option) {
+        switch(section) {
+                case(PCAPNG_SECTION_TYPE):
+                        return TRACE_META_STRING;
+                case(PCAPNG_INTERFACE_TYPE):
+                        switch(option) {
+                                case(PCAPNG_META_IF_NAME): return TRACE_META_STRING;
+                                case(PCAPNG_META_IF_DESCR): return TRACE_META_STRING;
+                                case(PCAPNG_META_IF_IP4): return TRACE_META_IPV4;
+                                case(PCAPNG_META_IF_IP6): return TRACE_META_IPV6;
+                                case(PCAPNG_META_IF_MAC): return TRACE_META_MAC;
+                                case(PCAPNG_META_IF_EUI): return TRACE_META_UINT64;
+                                case(PCAPNG_META_IF_SPEED): return PCAPNG_META_IF_SPEED;
+                                case(PCAPNG_META_IF_TSRESOL): return TRACE_META_UINT8;
+                                case(PCAPNG_META_IF_TZONE): return TRACE_META_UINT32;
+                                case(PCAPNG_META_IF_FILTER): return TRACE_META_STRING;
+                                case(PCAPNG_META_IF_OS): return TRACE_META_STRING;
+                                case(PCAPNG_META_IF_FCSLEN): return TRACE_META_UINT8;
+                                case(PCAPNG_META_IF_TSOFFSET): return TRACE_META_UINT64;
+                                case(PCAPNG_META_IF_HARDWARE): return TRACE_META_STRING;
+                        }
+                case(PCAPNG_OLD_PACKET_TYPE):
+                        switch(option) {
+                                case(PCAPNG_META_OLD_FLAGS): return TRACE_META_UINT32;
+                                case(PCAPNG_META_OLD_HASH): return TRACE_META_STRING;
+                        }
+                case(PCAPNG_SIMPLE_PACKET_TYPE):
+                        /* simple packets should not contain any options */
+                        return TRACE_META_UNKNOWN;
+                case(PCAPNG_NAME_RESOLUTION_TYPE):
+                        /* todo - needs to handle name resolution options along with
+                         * normal options */
+                        return TRACE_META_UNKNOWN;
+                case(PCAPNG_INTERFACE_STATS_TYPE):
+                        return TRACE_META_UINT64;
+                case(PCAPNG_ENHANCED_PACKET_TYPE):
+                        switch(option) {
+                                case(PCAPNG_META_EPB_FLAGS): return TRACE_META_UINT32;
+                                case(PCAPNG_META_EPB_HASH): return TRACE_META_STRING;
+                                case(PCAPNG_META_EPB_DROPCOUNT): return TRACE_META_UINT64;
+                        }
+                case(PCAPNG_DECRYPTION_SECRETS_TYPE):
+                        /* todo - needs to handle decryption secrets options along with
+                         * normal options */
+                        return TRACE_META_UNKNOWN;
+                default:
+                        return TRACE_META_UNKNOWN;
+        }
+}
+
+static void *pcapng_jump_to_options(libtrace_packet_t *packet) {
+
+        struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->buffer;
+        void *ptr = packet->buffer;
+        uint32_t blocktype;
+
+        if (DATA(packet->trace)->byteswapped) {
+                blocktype = byteswap32(hdr->blocktype);
+        } else {
+                blocktype = hdr->blocktype;
+        }
+
+        /* Skip x bytes to the options depending on what kind of packet this is */
+        if (blocktype == PCAPNG_SECTION_TYPE) { ptr += sizeof(pcapng_sec_t); }
+        else if (blocktype == PCAPNG_INTERFACE_TYPE) { ptr += sizeof(pcapng_int_t); }
+        else if (blocktype == PCAPNG_OLD_PACKET_TYPE) { ptr += sizeof(pcapng_opkt_t); }
+        else if (blocktype == PCAPNG_NAME_RESOLUTION_TYPE) { ptr += sizeof(pcapng_nrb_t); }
+        else if (blocktype == PCAPNG_INTERFACE_STATS_TYPE) { ptr += sizeof(pcapng_stats_t); }
+        else if (blocktype == PCAPNG_ENHANCED_PACKET_TYPE) {
+                /* jump over the the enchanced packet header and data to the options */
+                pcapng_epkt_t *epkthdr = (pcapng_epkt_t *)ptr;
+                uint32_t seclen;
+                if (DATA(packet->trace)->byteswapped) {
+                        seclen = byteswap32(epkthdr->caplen);
+                } else {
+                        seclen = epkthdr->caplen;
+                }
+                if ((seclen % 4) != 0) {
+                        ptr += seclen + (4 -(seclen % 4)) + sizeof(pcapng_secrets_t);
+                } else {
+                        ptr += seclen + sizeof(pcapng_secrets_t);
+                }
+        } 
+        else if (blocktype == PCAPNG_DECRYPTION_SECRETS_TYPE) {
+                /* jump over the decryption secrets header and data to the options */
+                pcapng_secrets_t *sechdr = (pcapng_secrets_t *)ptr;
+                uint32_t seclen;
+                if (DATA(packet->trace)->byteswapped) {
+                        seclen = byteswap32(sechdr->secrets_len);
+                } else {
+                        seclen = sechdr->secrets_len;
+                }
+                if ((seclen % 4) != 0) {
+                        ptr += seclen + (4 -(seclen % 4)) + sizeof(pcapng_secrets_t);
+                } else {
+                        ptr += seclen + sizeof(pcapng_secrets_t);
+                }
+        }
+        else { return NULL; }
+
+        return ptr;
+}
+
+void *pcapng_get_meta_section(libtrace_packet_t *packet, uint32_t section) {
+
+        struct pcapng_peeker *hdr;
+        uint32_t remaining;
+        void *ptr;
+        uint32_t blocktype;
+        uint16_t optcode;
+        uint16_t len;
+        uint16_t tmp;
+
+        if (packet == NULL) {
+                fprintf(stderr, "NULL packet passed into pcapng_get_meta_section()\n");
+                return NULL;
+        }
+        if (packet->buffer == NULL) { return NULL; }
+
+        hdr = (struct pcapng_peeker *)packet->buffer;
+        ptr = pcapng_jump_to_options(packet);
+
+        if (DATA(packet->trace)->byteswapped) {
+                blocktype = byteswap32(hdr->blocktype);
+                remaining = byteswap32(hdr->blocklen);
+        } else {
+                blocktype = hdr->blocktype;
+                remaining = hdr->blocklen;
+        }
+
+        /* If the data we want is not within this blocktype */
+        if (blocktype != section) {
+                return NULL;
+        }
+
+        /* update remaining to account for header and any payload */
+        remaining -= (ptr - packet->buffer);
+
+        struct pcapng_optheader *opthdr = ptr;
+        if (DATA(packet->trace)->byteswapped) {
+                optcode = byteswap16(opthdr->optcode);
+                len  = byteswap16(opthdr->optlen);
+        } else {
+                optcode = opthdr->optcode;
+                len = opthdr->optlen;
+        }
+
+        /* setup structure to hold the result */
+        libtrace_meta_t *result = malloc(sizeof(libtrace_meta_t));
+        result->section = section;
+        result->num = 0;
+
+        while (optcode != PCAPNG_OPTION_END && remaining > sizeof(struct pcapng_optheader)) {
+
+                result->num += 1;
+                if (result->num == 1) {
+                        result->items = malloc(sizeof(libtrace_meta_item_t));
+                } else {
+                        result->items = realloc(result->items,
+                                result->num*sizeof(libtrace_meta_item_t));
+                }
+                result->items[result->num-1].option = optcode;
+                result->items[result->num-1].len = len;
+                result->items[result->num-1].datatype =
+                        pcapng_get_datatype(section, optcode);
+
+                /* If the datatype is a string allow for a null terminator */
+                if (result->items[result->num-1].datatype == TRACE_META_STRING) {
+                        result->items[result->num-1].data =
+                                calloc(1, len+1);
+                        ((char *)result->items[result->num-1].data)[len] = '\0';
+                        /* and copy the utf8 string */
+                        memcpy(result->items[result->num-1].data,
+                                ptr+sizeof(struct pcapng_optheader), len);
+                } else {
+                        result->items[result->num-1].data =
+                                calloc(1, len);
+                        /* depending on the datatype we need to ensure the data is
+                         * in host byte ordering */
+                        if (result->items[result->num-1].datatype == TRACE_META_UINT32) {
+                                uint32_t t = *(uint32_t *)(ptr+sizeof(struct pcapng_optheader));
+                                t = ntohl(t);
+                                memcpy(result->items[result->num-1].data,
+                                        &t, sizeof(uint32_t));
+                        } else if(result->items[result->num-1].datatype == TRACE_META_UINT64) {
+                                uint64_t t = *(uint64_t *)(ptr+sizeof(struct pcapng_optheader));
+                                t = bswap_be_to_host64(t);
+                                memcpy(result->items[result->num-1].data,
+                                        &t, sizeof(uint64_t));
+                        } else {
+                                memcpy(result->items[result->num-1].data,
+                                        ptr+sizeof(struct pcapng_optheader), len);
+                        }
+
+                }
+
+                /* work out any padding */
+                if ((len % 4) != 0) {
+                        tmp = len + (4 - (len % 4)) + sizeof(struct pcapng_optheader);
+                } else {
+                        tmp = len + sizeof(struct pcapng_optheader);
+                }
+                ptr += tmp;
+                remaining -= tmp;
+
+                /* get the next option */
+                opthdr = (struct pcapng_optheader *)ptr;
+                if (DATA(packet->trace)->byteswapped) {
+                        optcode = byteswap16(opthdr->optcode);
+                        len = byteswap16(opthdr->optlen);
+                } else {
+                        optcode = opthdr->optcode;
+                        len = opthdr->optlen;
+                }
+        }
+
+        /* if any data was found result->num will be greater than 0 */
+        if (result->num > 0) {
+                return (void *)result;
+        } else {
+                free(result);
+                return NULL;
+        }
 
 }
@@ -2192 +2313 @@
         pcapng_get_timespec,            /* get_timespec */
         NULL,                           /* get_seconds */
+        pcapng_get_meta_section,        /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_rt.c

@@ -863 +863 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/format_tsh.c

@@ -252 +252 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */
@@ -302 +303 @@
         NULL,                           /* get_timespec */
         NULL,                           /* get_seconds */
+        NULL,                           /* get_meta_section */
         NULL,                           /* seek_erf */
         NULL,                           /* seek_timeval */

lib/libtrace.h.in

@@ -471 +471 @@
         TRACE_RT_DUCK_5_0       =19,/**< Dag 5.0 Duck */
         TRACE_RT_PCAPNG_META    =20,/**< Metadata for a PCAP NG input source */
+        TRACE_RT_ERF_META       =21,/**< Metadata for a ERF input source */
 
         /** Not actually used - all DATA types begin from this value */
@@ -613 +614 @@
 };
 
+/** Enumeration of datatype returned inside libtrace_meta_item_t structure */
+typedef enum {
+        TRACE_META_UINT8        = 1,
+        TRACE_META_UINT32       = 2,        
+        TRACE_META_UINT64       = 3,
+        TRACE_META_STRING       = 4,
+        TRACE_META_UNKNOWN      = 5,
+        TRACE_META_IPV4         = 6,
+        TRACE_META_IPV6         = 7,
+        TRACE_META_MAC          = 8, 
+} libtrace_meta_datatype_t;
+
+typedef struct libtrace_meta_item {
+        uint16_t option;
+        char *option_name;
+        uint16_t len;
+        libtrace_meta_datatype_t datatype;
+        void *data;
+} libtrace_meta_item_t;
+
+typedef struct libtrace_meta_section {
+        uint16_t section;
+        uint16_t num;
+        libtrace_meta_item_t *items;
+} libtrace_meta_t;
+
 typedef struct libtrace_packet_cache {
         int capture_length;             /**< Cached capture length */
@@ -649 +676 @@
         int refcount;                 /**< Reference counter */
         int which_trace_start;          /**< Used to match packet to a started instance of the parent trace */
-
 } libtrace_packet_t;
 
@@ -1410 +1436 @@
          *  trying to calculate it from the packet type. */
         TRACE_OPTION_CONSTANT_ERF_FRAMING,
+
+        /** If enabled all meta packet will be discarded */
+        TRACE_OPTION_DISCARD_META,
 } trace_option_t;
 
@@ -3775 +3804 @@
 /*@}*/
 
+/* Destroy libtrace_meta_t structure
+ *
+ * @params libtrace_meta_t structure
+ * returns 1 on success, -1 on failure
+ */
+DLLEXPORT int trace_destroy_meta(libtrace_meta_t *result);
+
+/* Get the interface name/s for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found interface names
+ * or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_name_meta(libtrace_packet_t *packet);
+
+/* Get the interface name for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the interface name from.
+ * @params A pointer to a character buffer to store the interface name in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the character buffer containing the interface name or NULL.
+ */
+DLLEXPORT char *trace_get_interface_name(libtrace_packet_t *packet, char *space, int spacelen,
+        int index);
+
+/* Get the interface MAC address/s for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found interface mac
+ * addresses or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_mac_meta(libtrace_packet_t *packet);
+
+/* Get the interface MAC address for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the MAC address from.
+ * @params A pointer to a character buffer to store the MAC address in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the character buffer containing the MAC address or NULL.
+ */
+DLLEXPORT char *trace_get_interface_mac(libtrace_packet_t *packet, char *space, int spacelen,
+        int index);
+
+/* Get the interface speed/s from a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found interface
+ * speeds or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_speed_meta(libtrace_packet_t *packet);
+
+/* Get the interface speed for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the interface speed from.
+ * @params The interface index within the meta packet.
+ * @returns uint64_t interface speed or NULL.
+ */
+DLLEXPORT uint64_t trace_get_interface_speed(libtrace_packet_t *packet, int index);
+
+/* Get the interface ipv4 address/s for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found ipv4 addresses
+ * or NULL
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_ipv4_meta(libtrace_packet_t *packet);
+
+/* Get the interface ipv4 address for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the ipv4 address from.
+ * @params The interface index within the meta packet.
+ * @returns uint32_t ipv4 address or 0.
+ */
+DLLEXPORT uint32_t trace_get_interface_ipv4(libtrace_packet_t *packet, int index);
+
+/* Get the interface ipv4 address string for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the ipv4 address from.
+ * @params A pointer to a character buffer to store the ipv4 address string in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the character buffer containing the ipv4 address string or NULL.
+ */
+DLLEXPORT char *trace_get_interface_ipv4_string(libtrace_packet_t *packet, char* space, int spacelen,
+        int index);
+
+/* Get the interface ipv6 address/s for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found ipv6 addresses
+ * or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_ipv6_meta(libtrace_packet_t *packet);
+
+/* Get the interface ipv6 address for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the ipv6 address from.
+ * @params A pointer to a character buffer to store the ipv6 address in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the buffer containing the ipv6 address or NULL.
+ */
+DLLEXPORT void *trace_get_interface_ipv6(libtrace_packet_t *packet, void *space, int spacelen,
+        int index);
+
+/* Get the interface ipv6 address string for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the ipv6 address from.
+ * @params A pointer to a character buffer to store the ipv6 address in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the character buffer containing the ipv6 address string or NULL.
+ */
+DLLEXPORT char *trace_get_interface_ipv6_string(libtrace_packet_t *packet, char *space, int spacelen,
+        int index);
+
+/* Get the interface description/s for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found interface
+ * descriptions or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_description_meta(libtrace_packet_t *packet);
+
+/* Get the interface description for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the interface description from.
+ * @params A pointer to a character buffer to store the interface description in.
+ * @params The size of the buffer passed in.
+ * @params The interface index within the meta packet.
+ * @returns Pointer to the character buffer containing the interface description or NULL.
+ */
+DLLEXPORT char *trace_get_interface_description(libtrace_packet_t *packet, char *space, int spacelen,
+        int index);
+
+/* Get the host OS for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing the host OS or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_host_os_meta(libtrace_packet_t *packet);
+
+/* Get the host OS for a meta packet.
+ *
+ * @params libtrace_packet_t meta packet to extract the host OS from.
+ * @params A pointer to a character buffer to store the host OS in.
+ * @params The size of the buffer passed in.
+ * @returns Pointer to the character buffer containing the host OS or NULL.
+ */
+DLLEXPORT char *trace_get_host_os(libtrace_packet_t *packet, char *space, int spacelen);
+
+/* Get the interface frame check sequence length for a meta packet.
+ * Must be destroyed with trace_destroy_meta().
+ *
+ * @params libtrace_packet_t meta packet.
+ * @returns Pointer to libtrace_meta_t structure containing all found frame check
+ * sequence lengths or NULL.
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_fcslen_meta(libtrace_packet_t *packet);
+
+/* Get the interface frame check sequence length for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface index.
+ *
+ * @params libtrace_packet_t meta packet to extract the interface fcslen from.
+ * @params The interface index within the meta packet.
+ * @returns uint32_t frame check sequence length or 0.
+ */
+DLLEXPORT uint32_t trace_get_interface_fcslen(libtrace_packet_t *packet, int index);
+
+/* Get any interface comments for a meta packet
+ * Must be destroyed with trace_destroy_meta()
+ *
+ * @params libtrace_packet_t packet
+ * @returns Pointer to libtrace_meta_t structure or NULL
+ */
+DLLEXPORT libtrace_meta_t *trace_get_interface_comment_meta(libtrace_packet_t *packet);
+
+/* Get the interface comment for a meta packet.
+ * Note: ERF packets can contain multiple interfaces per meta packet. Use index to
+ * specify the interface ID.
+ *
+ * @params libtrace_packet_t meta packet to extract the interface comment from.
+ * @params A pointer to a character buffer to store the interface description in.
+ * @params The size of the buffer passed in.
+ * @params The interface number within the meta packet.
+ * @returns Pointer to the character buffer containing the hardware description or NULL.
+ */
+DLLEXPORT char *trace_get_interface_comment(libtrace_packet_t *packet, char *space, int spacelen,
+        int index);
+
+/* Get the capture application for a meta packet
+ * Must be destroyed with trace_destroy_meta()
+ *
+ * @params libtrace_packet_t packet
+ * @returns Pointer to libtrace_meta_t structure or NULL
+ */
+DLLEXPORT libtrace_meta_t *trace_get_capture_application_meta(libtrace_packet_t *packet);
+
+/* Get the capture application for a meta packet.
+ *
+ * @params libtrace_packet_t meta packet to extract the application name from.
+ * @params A pointer to a character buffer to store the application name in.
+ * @params The size of the buffer passed in.
+ * @returns Pointer to the character buffer containing the application name or NULL.
+ */
+DLLEXPORT char *trace_get_capture_application(libtrace_packet_t *packet, char *space, int spacelen);
+
+/* Get a meta section option from a meta packet
+ * Must be destroyed with trace_destroy_meta()
+ *
+ * @params libtrace_packet_t packet
+ * @params Section code
+ * @params Option code
+ * @returns Pointer to libtrace_meta_t structure or NULL
+ */
+DLLEXPORT libtrace_meta_t *trace_get_section_option(libtrace_packet_t *packet, uint32_t section_code,
+        uint16_t option_code);
+
+/* Get a section from a meta packet
+ * Must be destroyed with trace_destroy_meta()
+ *
+ * @params libtrace_packet_t packet
+ * @params Section code
+ * @returns Pointer to libtrace_meta_t structure or NULL
+ */
+DLLEXPORT libtrace_meta_t *trace_get_section(libtrace_packet_t *packet, uint32_t section_code);
+
+/* Get the DAG card model from a meta packet.
+ *
+ * @params libtrace_packet_t meta packet to extract the DAG model from.
+ * @params A pointer to a character buffer to store the DAG model in.
+ * @params The size of the buffer passed in.
+ * @returns Pointer to the character buffer containing the DAG model or NULL.
+ */
+DLLEXPORT char *trace_get_erf_dag_card_model(libtrace_packet_t *packet, char *space,
+        int spacelen);
+
+/* Get the host DAG software version for a meta packet.
+ *
+ * @params libtrace_packet_t meta packet to extract the hosts DAG verion from.
+ * @params A pointer to a character buffer to store the DAG version in.
+ * @params The size of the buffer passed in.
+ * @returns Pointer to the character buffer containing the DAG version or NULL.
+ */
+DLLEXPORT char *trace_get_erf_dag_version(libtrace_packet_t *packet, char *space,
+        int spacelen);
+
+/* Get the firmware version for a DAG module from a meta packet.
+ *
+ * @params libtrace_packet_t meta packet to extract the FW version from.
+ * @params A pointer to a character buffer to store the FW version in.
+ * @params The size of the buffer passed in.
+ * @returns Pointer to the character buffer containing the FW version or NULL.
+ */
+DLLEXPORT char *trace_get_erf_dag_fw_version(libtrace_packet_t *packet, char *space,
+        int spacelen);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif /* #ifdef __cplusplus */
+
 #endif /* LIBTRACE_H_ */

lib/libtrace_int.h

@@ -294 +294 @@
         fn_cb_dataless message_pausing;
         fn_cb_packet message_packet;
+        fn_cb_packet message_meta_packet;
         fn_cb_result message_result;
         fn_cb_first_packet message_first_packet;
@@ -722 +723 @@
         double (*get_seconds)(const libtrace_packet_t *packet);
         
+        /**
+         */
+        void *(*get_meta_section)(libtrace_packet_t *packet, uint32_t section);
+
         /** Moves the read pointer to a certain ERF timestamp within an input 
          * trace file.
@@ -1200 +1205 @@
 DLLEXPORT void *trace_get_payload_from_atm(void *link, uint8_t *type, 
                 uint32_t *remaining);
-
 
 #ifdef HAVE_BPF

lib/libtrace_parallel.h

@@ -135 +135 @@
          */
         MESSAGE_PACKET,
+
+        /** A libtrace meta packet is ready, this will trigger the meta packet
+         *  callback for the processing threads.
+         */
+        MESSAGE_META_PACKET,
 
         /** A libtrace result is ready, this will trigger the result callback
@@ -519 +524 @@
 
 /**
+ * A callback function triggered when a processing thread receives a meta packet.
+ *
+ * @param libtrace The parallel trace.
+ * @param t The thread that is running
+ * @param global The global storage.
+ * @param tls The thread local storage.
+ * @param packet The packet to be processed.
+ *
+ * @return either the packet itself if it is not being published as a result
+ *   or NULL otherwise. If returning NULL, it is the user's responsibility
+ *   to ensure the packet is freed when the reporter thread is finished with it.
+ */
+typedef libtrace_packet_t* (*fn_cb_meta_packet)(libtrace_t *libtrace,
+                                           libtrace_thread_t *t,
+                                           void *global,
+                                           void *tls,
+                                           libtrace_packet_t *packet);
+
+/**
  * Callback for handling a result message. Should only be required by the
  * reporter thread.
@@ -599 +623 @@
 DLLEXPORT int trace_set_packet_cb(libtrace_callback_set_t *cbset,
                 fn_cb_packet handler);
+
+/**
+ * Registers a meta packet callback against a callback set.
+ *
+ * @param cbset The callback set.
+ * @param handler The meta packet callback funtion.
+ * @return 0 if successful, -1 otherwise.
+ */
+DLLEXPORT int trace_set_meta_packet_cb(libtrace_callback_set_t *cbset,
+                fn_cb_meta_packet handler);
 
 /**

lib/trace.c

@@ -685 +685 @@
                         return -1;
 
-
+                case TRACE_OPTION_DISCARD_META:
+                        if (!trace_is_err(libtrace)) {
+                                trace_set_err(libtrace, TRACE_ERR_OPTION_UNAVAIL,
+                                        "Libtrace does not support meta packets for this format");
+                        }
+                        return -1;
         }
         if (!trace_is_err(libtrace)) {

lib/trace_parallel.c

@@ -242 +242 @@
         case MESSAGE_PACKET:
                 return;
-        }
-
+        case MESSAGE_META_PACKET:
+                return;
+        }
         if (fn)
                 (*fn)(trace, thread, trace->global_blob, thread->user_data);
@@ -496 +497 @@
                         t->accepted_packets++;
                 }
-                if (trace->perpkt_cbs->message_packet)
-                        *packet = (*trace->perpkt_cbs->message_packet)(trace, t, trace->global_blob, t->user_data, *packet);
+
+                /* If packet is meta call the meta callback */
+                if (IS_LIBTRACE_META_PACKET((*packet))) {
+                        /* Pass to meta callback if defined else pass to packet callback */
+                        if (trace->perpkt_cbs->message_meta_packet) {
+                                *packet = (*trace->perpkt_cbs->message_meta_packet)(trace, t,
+                                        trace->global_blob, t->user_data, *packet);
+                        } else if (trace->perpkt_cbs->message_packet) {
+                                *packet = (*trace->perpkt_cbs->message_packet)(trace, t,
+                                        trace->global_blob, t->user_data, *packet);
+                        }
+                } else {
+                        if (trace->perpkt_cbs->message_packet) {
+                                *packet = (*trace->perpkt_cbs->message_packet)(trace, t,
+                                        trace->global_blob, t->user_data, *packet);
+                        }
+                }
                 trace_fin_packet(*packet);
         } else {
@@ -2038 +2054 @@
 }
 
+DLLEXPORT int trace_set_meta_packet_cb(libtrace_callback_set_t *cbset,
+                fn_cb_meta_packet handler) {
+        cbset->message_meta_packet = handler;
+        return 0;
+}
+
 DLLEXPORT int trace_set_first_packet_cb(libtrace_callback_set_t *cbset,
                 fn_cb_first_packet handler) {
@@ -2448 +2470 @@
 DLLEXPORT int trace_post_reporter(libtrace_t *libtrace)
 {
-        libtrace_message_t message = {0, {.uint64=0}, NULL};
-        message.code = MESSAGE_POST_REPORTER;
+        libtrace_message_t message;
+        memset(&message, 0, sizeof(libtrace_message_t));
+        message.code = MESSAGE_POST_REPORTER;
+        message.data.uint64 = 0;
+        message.sender = NULL;
         return trace_message_reporter(libtrace, (void *) &message);
 }

libpacketdump/Makefile.am

@@ -61 +61 @@
 TXT_PROTOCOLS+=link_17.protocol
 
+#22: ERF META
+BIN_PROTOCOLS+=link_21.la
+
 # 22: ETSI LI
 if HAVE_WANDDER
 BIN_PROTOCOLS+=link_22.la
 endif
+
+#23: PCAPNG
+BIN_PROTOCOLS+=link_23.la
 
 # Decoders for various ethertypes (in decimal)
@@ -140 +146 @@
 link_11_la_LDFLAGS=$(modflags)
 link_15_la_LDFLAGS=$(modflags) 
+link_21_la_LDFLAGS=$(modflags)
 if HAVE_WANDDER
 link_22_la_LDFLAGS=$(modflags) 
 endif
+link_23_la_LDFLAGS=$(modflags)
 eth_0_la_LDFLAGS=$(modflags)
 eth_2048_la_LDFLAGS=$(modflags)

libpacketdump/libpacketdump.cc

@@ -41 +41 @@
 #ifdef HAVE_NETINET_IF_ETHER_H
 #  include <netinet/if_ether.h>
-#endif 
+#endif
 #include <dlfcn.h>
 #include <map>
@@ -57 +57 @@
 
 typedef void (*decode_norm_t)(uint16_t type,const char *packet,int len);
+typedef void (*decode_norm_meta)(uint16_t type,const char *packet,int len,libtrace_packet_t *p);
 typedef void (*decode_parser_t)(uint16_t type,const char *packet,int len, element_t* el);
+
+libtrace_packet_t *p;
 
 typedef union decode_funcs {
     decode_norm_t decode_n;
+    decode_norm_meta decode_meta;
     decode_parser_t decode_p;
 } decode_funcs_t;
@@ -130 +134 @@
                         (int)trace_get_wire_length(packet),
                         (int)trace_get_direction(packet));
-        
 
         formatted_hexdump(pkt_ptr, (int)length);
@@ -138 +141 @@
 void trace_dump_packet(struct libtrace_packet_t *packet)
 {
+        p = packet;
+
         time_t sec = (time_t)trace_get_seconds(packet);
         libtrace_linktype_t linktype;
         uint32_t length;
         const char *link=(char *)trace_get_packet_buffer(packet,&linktype,NULL);
-        
+
         length = trace_get_capture_length(packet);
-
         printf("\n%s",ctime(&sec));
         printf(" Capture: Packet Length: %i/%i Direction Value: %i\n",
@@ -150 +154 @@
                         (int)trace_get_wire_length(packet),
                         (int)trace_get_direction(packet));
+
         if (!link) 
                 printf(" [No link layer available]\n");
         else
-                decode_next(link,length, "link",
-                        linktype);
+                decode_next(link,length, "link", linktype);
 }
 
@@ -223 +227 @@
                 hdl = open_so_decoder(sname.c_str(),type);
                 if (hdl) {
-                        void *s=dlsym(hdl,"decode");
+
+                        /* PCAPNG format requires the libtrace_packet_t structure in order
+                         * to determine the byte ordering */
+                        void *s;
+                        if (type == TRACE_TYPE_PCAPNG_META || type == TRACE_TYPE_ERF_META) {
+                                s=dlsym(hdl,"decode_meta");
+                                if (s) { func->decode_meta = (decode_norm_meta)s; }
+                        } else {
+                                s=dlsym(hdl,"decode");
+                                if (s) { func->decode_n = (decode_norm_t)s; }
+                        }
+
                         if (s) {
-                                // use the shared library
-                                func->decode_n = (decode_norm_t)s;
                                 dec.style = DECODE_NORMAL;
                                 dec.el = NULL; 
@@ -294 +307 @@
         {
                 case DECODE_NORMAL:
-                        decoders[sname][type].func->decode_n(type,packet,len);
+                        /* If this is a pcapng packet call the correct function and pass the
+                         * libtrace_packet_t structure. We need this to determine the byte ordering */
+                        if (type == TRACE_TYPE_PCAPNG_META || type == TRACE_TYPE_ERF_META) {
+                                decoders[sname][type].func->decode_meta(type,packet,len,p);
+                        } else {
+                                decoders[sname][type].func->decode_n(type,packet,len);
+                        }
                         break;
 

libpacketdump/libpacketdump.h

@@ -55 +55 @@
 
 void decode(int link_type, const char *pkt, unsigned len);
+void decode_meta(int link_type, const char *pkt, unsigned len, libtrace_packet_t *p);
 
 #ifdef __cplusplus 

tools/tracepktdump/tracepktdump.cc

@@ -110 +110 @@
                         if (filter && !trace_apply_filter(filter,packet))
                                 continue;
-                        if (packet->type < TRACE_RT_DATA_SIMPLE)
+                        if (packet->type < TRACE_RT_DATA_SIMPLE &&
+                                packet->type != TRACE_RT_PCAPNG_META &&
+                                packet->type != TRACE_RT_ERF_META)
                                 /* Ignore RT messages */
                                 continue;