--- old-packet-eth.c	2003-10-03 23:42:34.000000000 -0400
+++ new-packet-eth.c	2004-02-03 15:49:07.000000000 -0500
@@ -56,6 +56,7 @@
 
 static dissector_handle_t isl_handle;
 static dissector_handle_t fw1_handle;
+static heur_dissector_list_t heur_subdissector_list;
 
 static int eth_tap = -1;
 
@@ -156,6 +157,9 @@
   }
 }
 
+
+static gboolean try_heuristic = FALSE;
+
 static void
 dissect_eth_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 	int fcs_len)
@@ -190,6 +194,18 @@
   ehdr->type = tvb_get_ntohs(tvb, 12);
 
   /*
+   * In case the packet is a non-Ethernet packet inside
+   * Ethernet framing, allow heuristic dissectors to take
+   * a first look before we assume that it's actually an
+   * Ethernet packet.
+   */
+  if (try_heuristic) {
+    /* do lookup with the heuristic subdissector table */
+    if (dissector_try_heuristic(heur_subdissector_list, tvb, pinfo, tree))
+      goto end_of_eth;
+  }
+
+  /*
    * If the type/length field is <= the maximum 802.3 length,
    * and is not zero, this is an 802.3 frame, and it's a length
    * field; it might be an Novell "raw 802.3" frame, with no
@@ -425,12 +441,19 @@
 	proto_register_field_array(proto_eth, hf, array_length(hf));
 	proto_register_subtree_array(ett, array_length(ett));
 
+	/* subdissector code */
+	register_heur_dissector_list("eth", &heur_subdissector_list);
+
 	/* Register configuration preferences */
 	eth_module = prefs_register_protocol(proto_eth, NULL);
 	prefs_register_bool_preference(eth_module, "interpret_as_fw1_monitor",
             "Interpret as FireWall-1 monitor file",
 "Whether the capture file should be interpreted as a CheckPoint FireWall-1 monitor file",
             &eth_interpret_as_fw1_monitor);
+	prefs_register_bool_preference(eth_module, "try_heuristic",
+	    "Try heuristic sub-dissectors",
+	    "Try to detect non-Ethernet packets inside Ethernet framing using an heuristic sub-dissector",
+	    &try_heuristic);
 
 	register_dissector("eth", dissect_eth, proto_eth);
 	eth_tap = register_tap("eth");