If your "open" routine needs to allocate any memory that persists while the file is open, you will need to save a reference to the allocated memory in the priv member of the wtap structure. The data referenced directly from this pointer will be automatically freed by wiretap (using g_free()) when the capture file is closed. However, if this data contains pointers to other memory structures you’ve allocated separately, you’ll need to explicitly free those structures. To do this, you’ll need to create a "close" routine, and set the wtap 's subtype_close member to point at the routine.

The "read" routine should set the variable data_offset to the byte offset within the capture file from which the "seek and read" routine will read. If the capture records consist of:

capture record header
pseudo-header (e.g., for ATM)
frame data

then data_offset should point to the pseudo-header. The first sequential read pass will process and store the capture record header data, but it will not store the pseudo-header. Note that the seek_and_read routine should work with the "random_fh" file handle of the passed in wtap struct, instead of the "fh" file handle used in the normal read routine.