+ ndo->ndo_protocol = "enc";
+ ND_TCHECK_LEN(p, ENC_HDRLEN);
+ ndo->ndo_ll_hdr_len += ENC_HDRLEN;
+
+ hdr = (const struct enchdr *)p;
+ /*
+ * The address family and flags fields are in the byte order
+ * of the host that originally captured the traffic.
+ *
+ * To determine that, look at the address family. It's 32-bit,
+ * it is not likely ever to be > 65535 (I doubt there will
+ * ever be > 65535 address families and, so far, AF_ values have
+ * not been allocated very sparsely) so it should not have the
+ * upper 16 bits set, and it is not likely ever to be AF_UNSPEC,
+ * i.e. it's not likely ever to be 0, so if it's byte-swapped,
+ * it should have at least one of the upper 16 bits set.
+ *
+ * So if any of the upper 16 bits are set, we assume it, and
+ * the flags field, are byte-swapped.
+ *
+ * The SPI field is always in network byte order, i.e. big-
+ * endian.
+ */
+ UNALIGNED_MEMCPY(&af, &hdr->af, sizeof (af));
+ UNALIGNED_MEMCPY(&flags, &hdr->flags, sizeof (flags));
+ if ((af & 0xFFFF0000) != 0) {
+ af = SWAPLONG(af);
+ flags = SWAPLONG(flags);