we found a bug that segfaults bro. If you try to open a pcap file with a data link type that is unknown to libpcap (e.g. data link type 0x32), then it immediately crashes. The reason is in PktSrc.cc:
1.) In the constructor of PktFileSrc you first do an pcap_open_offline() and get a the pcap handle in pd.
2.) The you call SetHdrSize(), which calls Close() if no link type is found.
3.) Close closes pd, sets pd=0 and returns.
4.) back in PktFileSrc immediatly after SetHdrSize() you call pcap_file(pd) with the nulled pd, which leads to the Segfault in pcap.
I have added the relevant code fragments and a backtrace of gdb: