The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 Monthday, Month DD, YYYY by gharris and denis
   2   Summary for 5.0.0 tcpdump release (so far!)
   3     Refine protocol decoding for:
   4       OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of
   5           some lengths, and fix handling of snapend.
   6       RIP: Make a couple trivial protocol updates.
   7       NetFlow: Use tcp_flag_values[] for TCP flags.
   8       ZMTP: Replace custom code with bittok2str().
   9       BFD: Add support for S-BFD and spell LAG in uppercase.
  10       IEEE 802.11: include the Mesh ID field while printing management
  11         frames.
  12       DNS: sync resource types with IANA.
  13       MPTCP: print length before subtype inside MPTCP options, parse MPC
  14         data_len field, print flags from MP_CAPABLE option.
  15       ICMP: add dissector for ICMP Interface Identification Object
  16       BGP: Parse BGP extended message support capability
  17       BGP: Deprecate DPA, ADVERTISER and RCID_PATH path attributes
  18       BGP: Print Enhanced route refresh capability
  19       BGP: Print enhanced route refresh message subtype
  20       BGP: Parse rfc9072 (Extended Optional Parameters Length for BGP OPEN Message)
  21       BGP: Add support for BFD cease subcode
  22       BGP: Add support for Hard Reset notification and GR N flag
  23       BGP: Handle ORF in Route-Refresh messages
  24     User interface:
  25       Add optional unit suffix on -C file size.
  26       Add --print-sampling to print every Nth packet instead of all.
  27       Print the supported time stamp types (-J) to stdout instead of stderr.
  28       Print the list of data link types (-L) to stdout instead of stderr.
  29     Source code:
  30       Use %zu when printing a sizeof to squelch compiler warnings
  31       (FIXME: somebody please wrap the line below just before the release)
  32       AODV, AppleTalk, BOOTP, CHDLC, DCCP, EGP, EIGRP, ForCES, Geneve, GRE, Juniper, L2TP, NetFlow, NTP, OLSR, PGM, RIP, RSVP, SCTP, SNMP, TCP, UDP, vsock: Modernize packet parsing style
  33       DCCP, EGP: Replace custom code with tok2str()
  34       UDP: Clean up address and port printing.
  35       AppleTalk: Declutter appletalk.h.
  36       Introduce new ND_ICHECK*() macros to deduplicate more code.
  37       IEEE 802.11: Simplify handle_action().
  38       RPKI-Router: Refine length and bounds checks.
  39     Building and testing:
  40       Add a configure option to help debugging (--enable-instrument-functions)
  41
  42 TBD
  43   Summary for 4.99.2 tcpdump release (so far!)
  44     Updated printers:
  45       BGP: Update cease notification decoding to RFC 9003.
  46       BGP: decode BGP link-bandwidth extended community properly.
  47       BGP: Fix parsing the AIGP attribute
  48       BGP: make sure the path attributes don't go past the end of the packet.
  49       BGP: Shutdown message can be up to 255 bytes length according to rfc9003
  50       DSA: correctly determine VID.
  51       EAP: fix some length checks and output issues.
  52       802.15.4, BGP, LISP: fix some length checks, compiler warnings,
  53         and undefined behavior warnings.
  54       PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
  55         OSes.
  56       RRCP: support more Realtek protocols than just RRCP.
  57       MPLS: show the EXP field as TC, as per RFC 5462.
  58       ICMP: redo MPLS Extension code as general ICMP Extension code.
  59       VQP: Do not print unknown error codes twice.
  60       Juniper: Add some bounds checks.
  61       lwres: Fix a length check.
  62       EAP: Fix some undefined behaviors at runtime.
  63       Ethernet: Rework the length checks.
  64       ZEP: Add thren length checks.
  65       IPX: Add two length checks.
  66       Zephyr: Avoid printing non-ASCII characters.
  67       VRRP: Print the protocol name before any GET_().
  68       Use __func__ from C99 in some function calls.
  69       DCCP: Get rid of trailing commas in lists.
  70       Juniper: Report invalid packets as invalid, not truncated.
  71       IPv6: Remove an obsolete code in an always-false #if wrapper.
  72       Memory allocator: Update nd_add_alloc_list() to a static function.
  73       ISAKMP: Use GET_U_1() to replace a direct dereference.
  74       RADIUS: Use GET_U_1() to replace a direct dereference.
  75       TCP: Fix an invalid check.
  76       RESP: Remove an unnecessary test.
  77       Arista: Refine the output format and print HwInfo.
  78       addrtoname.c: Fix two invalid tests.
  79       EIGRP: Get the packet header fields right.
  80       sFlow: add support for IPv6 agent.
  81       VRRP: add support for IPv6.
  82       OSPF: Update to match the Router Properties registry.
  83       ICMPv6: Fix output for Router Renumbering messages.
  84       ICMPv6: Fix the Node Information flags.
  85       IPv6: Add some checks for the Hop-by-Hop Options header
  86     Building and testing:
  87       Update config.guess and config.sub.
  88       Use AS_HELP_STRING macro instead of AC_HELP_STRING.
  89       Handle some Autoconf/make errors better.
  90       Fix an error when corss-compiling.
  91       Fix "make releasetar" on AIX and Solaris.
  92       Mend "make check" on Solaris 9 with Autoconf.
  93       Address assorted compiler warnings.
  94       Fix auto-enabling of Capsicum on FreeBSD with Autoconf.
  95       Treat "msys" as Windows for test exit statuses.
  96       Clean up some help messages in configure.
  97       Use unified diff by default.
  98       Improve error detection in "make releasetar".
  99       Remove awk code from mkdep.
 100     Source code:
 101       Fix some snapend-changing routines to protect against pointer
 102         underflow.
 103     Documentation:
 104       Some man page cleanups.
 105       Note that we require compilers to support at least some of C99.
 106       Update AIX and Solaris-related specifics.
 107
 108 Wednesday, June 9, 2021 by gharris
 109   Summary for 4.99.1 tcpdump release
 110     Source code:
 111       Squelch some compiler warnings
 112       ICMP: Update the snapend for some nested IP packets.
 113       MACsec: Update the snapend thus the ICV field is not payload
 114         for the caller.
 115       EIGRP: Fix packet header fields
 116       SMB: Disable printer by default in CMake builds
 117       OLSR: Print the protocol name even if the packet is invalid
 118       MSDP: Print ": " before the protocol name
 119       ESP: Remove padding, padding length and next header from the buffer
 120       DHCPv6: Update the snapend for nested DHCPv6 packets
 121       OpenFlow 1.0: Get snapend right for nested frames.
 122       TCP: Update the snapend before decoding a MPTCP option
 123       Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks
 124       ForCES: Refine SPARSEDATA-TLV length check.
 125       ASCII/hex: Use nd_trunc_longjmp() in truncation cases
 126       GeoNet: Add a ND_TCHECK_LEN() call
 127       Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES().
 128       BGP: Fix overwrites of global 'astostr' temporary buffer
 129       ARP: fix overwrites of static buffer in q922_string().
 130       Frame Relay: have q922_string() handle errors better.
 131     Building and testing:
 132       Rebuild configure script when building release
 133       Fix "make clean" for out-of-tree autotools builds
 134       CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH.
 135     Documentation:
 136       man: Update a reference as www.cifs.org is gone. [skip ci]
 137       man: Update DNS sections
 138     Solaris:
 139       Fix a compile error with Sun C
 140
 141 Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
 142   Summary for 4.99.0 tcpdump release
 143     CVE-2018-16301: For the -F option handle large input files safely.
 144     Improve the contents, wording and formatting of the man page.
 145     Print unsupported link-layer protocol packets in hex.
 146     Add support for new network protocols and DLTs: Arista, Autosar SOME/IP,
 147       Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand
 148       (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch
 149       Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS,
 150       ZigBee Encapsulation Protocol (ZEP).
 151     Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP,
 152       ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS,
 153       NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD,
 154       VXLAN-GPE.
 155     User interface:
 156       Make SLL2 the default for Linux "any" pseudo-device.
 157       Add --micro and --nano shorthands.
 158       Add --count to print a counter only instead of decoding.
 159       Add --print, to cause packet printing even with -w.
 160       Add support for remote capture if libpcap supports it.
 161       Display the "wireless" flag and connection status.
 162       Flush the output packet buffer on a SIGUSR2.
 163       Add the snapshot length to the "reading from file ..." message.
 164       Fix local time printing (DST offset in timestamps).
 165       Allow -C arguments > 2^31-1 GB if they can fit into a long.
 166       Handle very large -f files by rejecting them.
 167       Report periodic stats only when safe to do so.
 168       Print the number of packets captured only as often as necessary.
 169       With no -s, or with -s 0, don't specify the snapshot length with newer
 170         versions of libpcap.
 171       Improve version and usage message printing.
 172     Building and testing:
 173       Install into bindir, not sbindir.
 174       autoconf: replace --with-system-libpcap with --disable-local-libpcap.
 175       Require the compiler to support C99.
 176       Better detect and use various C compilers and their features.
 177       Add CMake as the second build system.
 178       Make out-of-tree builds more reliable.
 179       Use pkg-config to detect libpcap if available.
 180       Improve Windows support.
 181       Add more tests and improve the scripts that run them.
 182       Test both with "normal" and "x87" floating-point.
 183       Eliminate dependency on libdnet.
 184     FreeBSD:
 185       Print a proper error message about monitor mode VAP.
 186       Use libcasper if available.
 187       Fix failure to capture on RDMA device.
 188       Include the correct capsicum header.
 189     Source code:
 190       Start the transition to longjmp() for packet truncation handling.
 191       Introduce new helper functions, including GET_*(), nd_print_protocol(),
 192         nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others.
 193       Put integer signedness right in many cases.
 194       Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix
 195         alignment issues, especially on SPARC.
 196       Fix many C compiler, Coverity, UBSan and cppcheck warnings.
 197       Fix issues detected with AddressSanitizer.
 198       Remove many workarounds for older compilers and OSes.
 199       Add a sanity check on packet header length.
 200       Add and remove plenty of bounds checks.
 201       Clean up pcap_findalldevs() call to find the first interface.
 202       Use a short timeout, rather than immediate mode, for text output.
 203       Handle DLT_ENC files *not* written on the same OS and byte-order host.
 204       Add, and use, macros to do locale-independent case mapping.
 205       Use a table instead of getprotobynumber().
 206       Get rid of ND_UNALIGNED and ND_TCHECK().
 207       Make roundup2() generally available.
 208       Resync SMI list against Wireshark.
 209       Fix many typos.
 210
 211 Friday, September 20, 2019, by mcr@sandelman.ca
 212   A huge thank you to Denis, Francois-Xavier and Guy who did much of the heavy lifting.
 213   Summary for 4.9.3 tcpdump release
 214     Fix buffer overflow/overread vulnerabilities:
 215       CVE-2017-16808 (AoE)
 216       CVE-2018-14468 (FrameRelay)
 217       CVE-2018-14469 (IKEv1)
 218       CVE-2018-14470 (BABEL)
 219       CVE-2018-14466 (AFS/RX)
 220       CVE-2018-14461 (LDP)
 221       CVE-2018-14462 (ICMP)
 222       CVE-2018-14465 (RSVP)
 223       CVE-2018-14881 (BGP)
 224       CVE-2018-14464 (LMP)
 225       CVE-2018-14463 (VRRP)
 226       CVE-2018-14467 (BGP)
 227       CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
 228       CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)
 229       CVE-2018-14880 (OSPF6)
 230       CVE-2018-16451 (SMB)
 231       CVE-2018-14882 (RPL)
 232       CVE-2018-16227 (802.11)
 233       CVE-2018-16229 (DCCP)
 234       CVE-2018-16230 (BGP)
 235       CVE-2018-16452 (SMB)
 236       CVE-2018-16300 (BGP)
 237       CVE-2018-16228 (HNCP)
 238       CVE-2019-15166 (LMP)
 239       CVE-2019-15167 (VRRP)
 240     Fix for cmdline argument/local issues:
 241       CVE-2018-14879 (tcpdump -V)
 242
 243 Sunday September 3, 2017 denis@ovsienko.info
 244   Summary for 4.9.2 tcpdump release
 245     Do not use getprotobynumber() for protocol name resolution.  Do not do
 246       any protocol name resolution if -n is specified.
 247     Improve errors detection in the test scripts.
 248     Fix a segfault with OpenSSL 1.1 and improve OpenSSL usage.
 249     Clean up IS-IS printing.
 250     Fix buffer overflow vulnerabilities:
 251       CVE-2017-11543 (SLIP)
 252       CVE-2017-13011 (bittok2str_internal)
 253     Fix infinite loop vulnerabilities:
 254       CVE-2017-12989 (RESP)
 255       CVE-2017-12990 (ISAKMP)
 256       CVE-2017-12995 (DNS)
 257       CVE-2017-12997 (LLDP)
 258     Fix buffer over-read vulnerabilities:
 259       CVE-2017-11541 (safeputs)
 260       CVE-2017-11542 (PIMv1)
 261       CVE-2017-12893 (SMB/CIFS)
 262       CVE-2017-12894 (lookup_bytestring)
 263       CVE-2017-12895 (ICMP)
 264       CVE-2017-12896 (ISAKMP)
 265       CVE-2017-12897 (ISO CLNS)
 266       CVE-2017-12898 (NFS)
 267       CVE-2017-12899 (DECnet)
 268       CVE-2017-12900 (tok2strbuf)
 269       CVE-2017-12901 (EIGRP)
 270       CVE-2017-12902 (Zephyr)
 271       CVE-2017-12985 (IPv6)
 272       CVE-2017-12986 (IPv6 routing headers)
 273       CVE-2017-12987 (IEEE 802.11)
 274       CVE-2017-12988 (telnet)
 275       CVE-2017-12991 (BGP)
 276       CVE-2017-12992 (RIPng)
 277       CVE-2017-12993 (Juniper)
 278       CVE-2017-12994 (BGP)
 279       CVE-2017-12996 (PIMv2)
 280       CVE-2017-12998 (ISO IS-IS)
 281       CVE-2017-12999 (ISO IS-IS)
 282       CVE-2017-13000 (IEEE 802.15.4)
 283       CVE-2017-13001 (NFS)
 284       CVE-2017-13002 (AODV)
 285       CVE-2017-13003 (LMP)
 286       CVE-2017-13004 (Juniper)
 287       CVE-2017-13005 (NFS)
 288       CVE-2017-13006 (L2TP)
 289       CVE-2017-13007 (Apple PKTAP)
 290       CVE-2017-13008 (IEEE 802.11)
 291       CVE-2017-13009 (IPv6 mobility)
 292       CVE-2017-13010 (BEEP)
 293       CVE-2017-13012 (ICMP)
 294       CVE-2017-13013 (ARP)
 295       CVE-2017-13014 (White Board)
 296       CVE-2017-13015 (EAP)
 297       CVE-2017-11543 (SLIP)
 298       CVE-2017-13016 (ISO ES-IS)
 299       CVE-2017-13017 (DHCPv6)
 300       CVE-2017-13018 (PGM)
 301       CVE-2017-13019 (PGM)
 302       CVE-2017-13020 (VTP)
 303       CVE-2017-13021 (ICMPv6)
 304       CVE-2017-13022 (IP)
 305       CVE-2017-13023 (IPv6 mobility)
 306       CVE-2017-13024 (IPv6 mobility)
 307       CVE-2017-13025 (IPv6 mobility)
 308       CVE-2017-13026 (ISO IS-IS)
 309       CVE-2017-13027 (LLDP)
 310       CVE-2017-13028 (BOOTP)
 311       CVE-2017-13029 (PPP)
 312       CVE-2017-13030 (PIM)
 313       CVE-2017-13031 (IPv6 fragmentation header)
 314       CVE-2017-13032 (RADIUS)
 315       CVE-2017-13033 (VTP)
 316       CVE-2017-13034 (PGM)
 317       CVE-2017-13035 (ISO IS-IS)
 318       CVE-2017-13036 (OSPFv3)
 319       CVE-2017-13037 (IP)
 320       CVE-2017-13038 (PPP)
 321       CVE-2017-13039 (ISAKMP)
 322       CVE-2017-13040 (MPTCP)
 323       CVE-2017-13041 (ICMPv6)
 324       CVE-2017-13042 (HNCP)
 325       CVE-2017-13043 (BGP)
 326       CVE-2017-13044 (HNCP)
 327       CVE-2017-13045 (VQP)
 328       CVE-2017-13046 (BGP)
 329       CVE-2017-13047 (ISO ES-IS)
 330       CVE-2017-13048 (RSVP)
 331       CVE-2017-13049 (Rx)
 332       CVE-2017-13050 (RPKI-Router)
 333       CVE-2017-13051 (RSVP)
 334       CVE-2017-13052 (CFM)
 335       CVE-2017-13053 (BGP)
 336       CVE-2017-13054 (LLDP)
 337       CVE-2017-13055 (ISO IS-IS)
 338       CVE-2017-13687 (Cisco HDLC)
 339       CVE-2017-13688 (OLSR)
 340       CVE-2017-13689 (IKEv1)
 341       CVE-2017-13690 (IKEv2)
 342       CVE-2017-13725 (IPv6 routing headers)
 343
 344 Sunday July 23, 2017 denis@ovsienko.info
 345   Summary for 4.9.1 tcpdump release
 346     CVE-2017-11108/Fix bounds checking for STP.
 347     Make assorted documentation updates and fix a few typos in tcpdump output.
 348     Fixup -C for file size >2GB (GH #488).
 349     Show AddressSanitizer presence in version output.
 350     Fix a bug in test scripts (exposed in GH #613).
 351     On FreeBSD adjust Capsicum capabilities for netmap.
 352     On Linux fix a use-after-free when the requested interface does not exist.
 353
 354 Wednesday January 18, 2017 devel.fx.lebail@orange.fr
 355   Summary for 4.9.0 tcpdump release
 356     General updates:
 357     Fix some heap overflows found with American Fuzzy Lop by Hanno Boeck and others
 358         (More information in the log with CVE-2016-* and CVE-2017-*)
 359     Change the way protocols print link-layer addresses (Fix heap overflows
 360         in CALM-FAST and GeoNetworking printers)
 361     Pass correct caplen value to ether_print() and some other functions
 362     Fix lookup_nsap() to match what isonsap_string() expects
 363     Clean up relative time stamp printing (Fix an array overflow)
 364     Fix some alignment issues with GCC on Solaris 10 SPARC
 365     Add some ND_TTEST_/ND_TCHECK_ macros to simplify writing bounds checks
 366     Add a fn_printztn() which returns the number of bytes processed
 367     Add nd_init() and nd_cleanup() functions. Improve libsmi support
 368     Add CONTRIBUTING file
 369     Add a summary comment in all printers
 370     Compile with more warning options in devel mode if supported (-Wcast-qual, ...)
 371     Fix some leaks found by Valgrind/Memcheck
 372     Fix a bunch of de-constifications
 373     Squelch some Coverity warnings and some compiler warnings
 374     Update Coverity and Travis-CI setup
 375     Update Visual Studio files
 376
 377     Frontend:
 378     Fix capsicum support to work with zerocopy buffers in bpf
 379     Try opening interfaces by name first, then by name-as-index
 380     Work around pcap_create() failures fetching time stamp type lists
 381     Fix a segmentation fault with 'tcpdump -J'
 382     Improve addrtostr6() bounds checking
 383     Add exit_tcpdump() function
 384     Don't drop CAP_SYS_CHROOT before chrooting
 385     Fixes issue where statistics not reported when -G and -W options used
 386
 387     Updated printers:
 388     802.11: Beginnings of 11ac radiotap support
 389     802.11: Check the Protected bit for management frames
 390     802.11: Do bounds checking on last_presentp before dereferencing it (Fix a heap overflow)
 391     802.11: Fix the radiotap printer to handle the special bits correctly
 392     802.11: If we have the MCS field, it's 11n
 393     802.11: Only print unknown frame type or subtype messages once
 394     802.11: Radiotap dBm values get printed as dB; Update a test output accordingly
 395     802.11: Source and destination addresses were backwards
 396     AH: Add a bounds check
 397     AH: Report to our caller that dissection failed if a bounds check fails
 398     AP1394: Print src > dst, not dst > src
 399     ARP: Don't assume the target hardware address is <= 6 octets long (Fix a heap overflow)
 400     ATALK: Add bounds and length checks (Fix heap overflows)
 401     ATM: Add some bounds checks (Fix a heap overflow)
 402     ATM: Fix an incorrect bounds check
 403     BFD: Update specification from draft to RFC 5880
 404     BFD: Update to print optional authentication field
 405     BGP: Add support for the AIGP attribute (RFC7311)
 406     BGP: Print LARGE_COMMUNITY Path Attribute
 407     BGP: Update BGP numbers from IANA; Print minor values for FSM notification
 408     BOOTP: Add a bounds check
 409     Babel: Add decoder for source-specific extension
 410     CDP: Filter out non-printable characters
 411     CFM: Fixes to match the IEEE standard, additional bounds and length checks
 412     CSLIP: Add more bounds checks (Fix a heap overflow)
 413     ClassicalIPoATM: Add a bounds check on LLC+SNAP header (Fix a heap overflow)
 414     DHCP: Fix MUDURL and TZ options
 415     DHCPv6: Process MUDURL and TZ options
 416     DHCPv6: Update Status Codes with RFCs/IANA names
 417     DNS: Represent the "DNSSEC OK" bit as "DO" instead of "OK". Add a test case
 418     DTP: Improve packet integrity checks
 419     EGP: Fix bounds checks
 420     ESP: Don't use OpenSSL_add_all_algorithms() in OpenSSL 1.1.0 or later
 421     Ethernet: Add some bounds checking before calling isoclns_print (Fix a heap overflow)
 422     Ethernet: Print the Length/Type field as length when needed
 423     FDDI: Fix -e output for FDDI
 424     FR: Add some packet-length checks and improve Q.933 printing (Fix heap overflows)
 425     GRE: Add some bounds checks (Fix heap overflows)
 426     Geneve: Fix error message with invalid option length; Update list option classes
 427     HNCP: Fix incorrect time interval format. Fix handling of IPv4 prefixes
 428     ICMP6: Fetch a 32-bit big-endian quantity with EXTRACT_32BITS()
 429     IGMP: Add a length check
 430     IP: Add a bounds check (Fix a heap overflow)
 431     IP: Check before fetching the protocol version (Fix a heap overflow)
 432     IP: Don't try to dissect if IP version != 4 (Fix a heap overflow)
 433     IP: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 434     IPComp: Check whether we have the CPI before we fetch it (Fix a heap overflow)
 435     IPoFC: Fix -e output (IP-over-Fibre Channel)
 436     IPv6: Don't overwrite the destination IPv6 address for routing headers
 437     IPv6: Fix header printing
 438     IPv6: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 439     ISAKMP: Clean up parsing of IKEv2 Security Associations
 440     ISOCLNS/IS-IS: Add support for Purge Originator Identifier (RFC6232) and test cases
 441     ISOCLNS/IS-IS: Don't overwrite packet data when checking the signature
 442     ISOCLNS/IS-IS: Filter out non-printable characters
 443     ISOCLNS/IS-IS: Fix segmentation faults
 444     ISOCLNS/IS-IS: Have signature_verify() do the copying and clearing
 445     ISOCLNS: Add some bounds checks
 446     Juniper: Make sure a Juniper header TLV isn't bigger than what's left in the packet (Fix a heap overflow)
 447     LLC/SNAP: With -e, print the LLC header before the SNAP header; without it, cut the SNAP header
 448     LLC: Add a bounds check (Fix a heap overflow)
 449     LLC: Clean up printing of LLC packets
 450     LLC: Fix the printing of RFC 948-style IP packets
 451     LLC: Skip the LLC and SNAP headers with -x for 802.11 and some other protocols
 452     LLDP: Implement IANA OUI and LLDP MUD option
 453     MPLS LSP ping: Update printing for RFC 4379, bug fixes, more bounds checks
 454     MPLS: "length" is now the *remaining* packet length
 455     MPLS: Add bounds and length checks (Fix a heap overflow)
 456     NFS: Don't assume the ONC RPC header is nicely aligned
 457     NFS: Don't overflow the Opaque_Handle buffer (Fix a segmentation fault)
 458     NFS: Don't run past the end of an NFSv3 file handle
 459     OLSR: Add a test to cover a HNA sgw case
 460     OLSR: Fix 'Advertised networks' count
 461     OLSR: Fix printing of smart-gateway HNAs in IPv4
 462     OSPF: Add a bounds check for the Hello packet options
 463     OSPF: Do more bounds checking
 464     OSPF: Fix a segmentation fault
 465     OSPF: Fix printing 'ospf_topology_values' default
 466     OTV: Add missing bounds checks
 467     PGM: Print the formatted IP address, not the raw binary address, as a string
 468     PIM: Add some bounds checking (Fix a heap overflow)
 469     PIMv2: Fix checksumming of Register messages
 470     PPP: Add some bounds checks (Fix a heap overflow)
 471     PPP: Report invalid PAP AACK/ANAK packets
 472     Q.933: Add a missing bounds check
 473     RADIUS: Add Value 13 "VLAN" to Tunnel-Type attribute
 474     RADIUS: Filter out non-printable characters
 475     RADIUS: Translate UDP/1700 as RADIUS
 476     RESP: Do better checking of RESP packets
 477     RPKI-RTR: Add a return value check for "fn_printn" call
 478     RPKI-RTR: Remove printing when truncated condition already detected
 479     RPL: Fix 'Consistency Check' control code
 480     RPL: Fix suboption print
 481     RSVP: An INTEGRITY object in a submessage covers only the submessage
 482     RSVP: Fix an infinite loop; Add bounds and length checks
 483     RSVP: Fix some if statements missing brackets
 484     RSVP: Have signature_verify() do the copying and clearing
 485     RTCP: Add some bounds checks
 486     RTP: Add some bounds checks, fix two segmentation faults
 487     SCTP: Do more bounds checking
 488     SFLOW: Fix bounds checking
 489     SLOW: Fix bugs, add checks
 490     SMB: Before fetching the flags2 field, make sure we have it
 491     SMB: Do bounds checks on NBNS resource types and resource data lengths
 492     SNMP: Clean up the "have libsmi but no modules loaded" case
 493     SNMP: Clean up the object abbreviation list and fix the code to match them
 494     SNMP: Do bounds checks when printing character and octet strings
 495     SNMP: Improve ASN.1 bounds checks
 496     SNMP: More bounds and length checks
 497     STP: Add a bunch of bounds checks, and fix some printing (Fix heap overflows)
 498     STP: Filter out non-printable characters
 499     TCP: Add bounds and length checks for packets with TCP option 20
 500     TCP: Correct TCP option Kind value for TCP Auth and add SCPS-TP
 501     TCP: Fix two bounds checks (Fix heap overflows)
 502     TCP: Make sure we have the data offset field before fetching it (Fix a heap overflow)
 503     TCP: Put TCP-AO option decoding right
 504     TFTP: Don't use strchr() to scan packet data (Fix a heap overflow)
 505     Telnet: Add some bounds checks
 506     TokenRing: Fix -e output
 507     UDLD: Fix an infinite loop
 508     UDP: Add a bounds check (Fix a heap overflow)
 509     UDP: Check against the packet length first
 510     VAT: Add some bounds checks
 511     VTP: Add a test on Mgmt Domain Name length
 512     VTP: Add bounds checks and filter out non-printable characters
 513     VXLAN: Add a bound check and a test case
 514     ZeroMQ: Fix an infinite loop
 515
 516 Tuesday October 25, 2016 mcr@sandelman.ca
 517   Summary for 4.8.1 tcpdump release
 518         Fix "-x" for Apple PKTAP and PPI packets
 519         Improve separation frontend/backend (tcpdump/libnetdissect)
 520         Fix display of timestamps with -tt, -ttt and -ttttt options
 521         Add support for the Marvell Extended Distributed Switch Architecture header
 522         Use PRIx64 to print a 64-bit number in hex.
 523         Printer for HNCP (RFCs 7787 and 7788).
 524         dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer.
 525         RSVP: Add bounds and length checks
 526         OSPF: Do more bounds checking
 527         Handle OpenSSL 1.1.x.
 528         Initial support for the REdis Serialization Protocol known as RESP.
 529         Add printing function for Generic Protocol Extension for VXLAN
 530             draft-ietf-nvo3-vxlan-gpe-01
 531         Network Service Header: draft-ietf-sfc-nsh-01
 532         Don't recompile the filter if the new file has the same DLT.
 533         Pass an adjusted struct pcap_pkthdr to the sub-printer.
 534         Add three test cases for already fixed CVEs
 535            CVE-2014-8767: OLSR
 536            CVE-2014-8768: Geonet
 537            CVE-2014-8769: AODV
 538         Don't do the DDP-over-UDP heuristic first: GitHub issue #499.
 539         Use the new debugging routines in libpcap.
 540         Harmonize TCP source or destination ports tests with UDP ones
 541         Introduce data types to use for integral values in packet structures.
 542         RSVP: Fix an infinite loop
 543         Support of Type 3 and Type 4 LISP packets.
 544         Don't require IPv6 library support in order to support IPv6 addresses.
 545         Many many changes to support libnetdissect usage.
 546         Add a test that makes unaligned accesses: GitHub issue #478.
 547         add a DNSSEC test case: GH #445 and GH #467.
 548         BGP: add decoding of ADD-PATH capability
 549         fixes to LLC header printing, and RFC948-style IP packets
 550
 551 Friday April 10, 2015 guy@alum.mit.edu
 552   Summary for 4.7.4 tcpdump release
 553         RPKI to Router Protocol: Fix Segmentation Faults and other problems
 554         RPKI to Router Protocol: print strings with fn_printn()
 555         wb: fix some bounds checks
 556
 557 Wednesday March 11, 2015 mcr@sandelman.ca
 558   Summary for 4.7.3 tcpdump release
 559         Capsicum fixes for FreeBSD 10
 560
 561 Tuesday March 10, 2015 mcr@sandelman.ca
 562   Summary for 4.7.2 tcpdump release
 563         DCCP: update Packet Types with RFC4340/IANA names
 564         fixes for CVE-2015-0261: IPv6 mobility header check issue
 565         fixes for CVE-2015-2153, 2154, 2155: kday packets
 566
 567 Friday Nov. 12, 2014 guy@alum.mit.edu
 568   Summary for 4.7.0 tcpdump release
 569         changes to hex printing of CDP packets
 570         Fix PPI printing
 571         Radius: update Packet Type Codes and Attribute Types with RFC/IANA names
 572         Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support.
 573         improvements to telnet printer, even if not -v
 574         omit length for bcp, print-tcp uses it
 575         formatting fixes for a bunch of protocols
 576         new bounds checks for a number of protocols
 577         split netflow 1,6, and 6 dissector up.
 578         added geneve dissector
 579         CVE-2014-9140 PPP dissector fixed.
 580
 581 Tuesday  Sep.  2, 2014 mcr@sandelman.ca
 582   Summary for 4.6.2 tcpdump release
 583         fix out-of-source-tree builds: find libpcap that is out of source
 584         better configure check for libsmi
 585
 586 Saturday Jul. 19, 2014 mcr@sandelman.ca
 587   Summary for 4.6.1 tcpdump release
 588         added FreeBSD capsicum
 589         add a short option '#', same as long option '--number'
 590
 591 Wednesday Jul. 2, 2014 mcr@sandelman.ca
 592   Summary for 4.6.0 tcpdump release
 593         all of tcpdump is now using the new "NDO" code base (Thanks Denis!)
 594         nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes
 595         M3UA decode added.
 596         many new test cases: 82 in 4.5.1 to 133 in 4.6.0
 597         many improvements to travis continuous integration system: OSX, and Coverity options
 598         cleaned up some unnecessary header files
 599         Added bittok2str().
 600         a number of unaligned access faults fixed
 601         -A flag does not consider CR to be printable anymore
 602         fx.lebail took over coverity baby sitting
 603         default snapshot size increased to 256K for accommodate USB captures
 604         WARNING: this release contains a lot of very worthwhile code churn.
 605
 606 Wednesday Jan. 15, 2014 guy@alum.mit.edu
 607   Summary for 4.5.2 tcpdump release
 608         Man page fix
 609         Fix crashes on SPARC
 610
 611 Monday Nov. 11, 2013 mcr@sandelman.ca
 612   Summary for 4.5.1 tcpdump release
 613         CREDITS file fixes
 614
 615 Thursday Nov. 7, 2013  mcr@sandelman.ca and guy@alum.mit.edu.
 616   Summary for 4.5.0 tcpdump release
 617         some NFSv4 fixes for printing
 618         fix printing of unknown TCP options, and tcp fast-open
 619         fixes for syslog parser
 620         some gcc-version-specific flag tuning
 621         adopt MacOS deprecation workarounds for openssl
 622         improvements to babel printing
 623         add OpenFlow 1.0 (no SSL) and test cases
 624         GeoNet printer.
 625         added STBC Rx support
 626         improvements to DHCPv6 decoder
 627         clarify which autoconf is needed
 628         Point users to the the-tcpdump-group repository on GitHub rather
 629             than the mcr repository
 630         Add MSDP printer.
 631         Fixed IPv6 check on Solaris and other OSes requiring extra
 632             networking libraries.
 633         Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03),
 634             and add "vxlan" as an option for -T.
 635         Add support for OTV (draft-hasmit-otv-04).
 636         fixes for DLT_IEEE802_11_RADIO datalink types
 637         added MPTCP decoder
 638
 639 Saturday April 6, 2013 guy@alum.mit.edu.
 640   Summary for 4.4.0 tcpdump release
 641         RPKI-RTR (RFC6810) is now official (TCP Port 323)
 642         Fix detection of OpenSSL libcrypto.
 643         Add DNSSL (RFC6106) support.
 644         Add "radius" as an option for -T.
 645         Update Action codes for handle_action function according to
 646             802.11s amendment.
 647         Decode DHCPv6 AFTR-Name option (RFC6334).
 648         Updates for Babel.
 649         Fix printing of infinite lifetime in ICMPv6.
 650         Added support for SPB, SPBM Service Identifier, and Unicast
 651             Address sub-TLV in ISIS.
 652         Decode RIPv2 authentication up to RFC4822.
 653         Fix RIP Request/full table decoding issues.
 654         On Linux systems with cap-ng.h, drop root privileges
 655             using Linux Capabilities.
 656         Add support for reading multiple files.
 657         Add MS NLB heartbeat printer.
 658         Separate multiple nexthops in BGP.
 659
 660 Wednesday  November 28, 2012 guy@alum.mit.edu.
 661   Summary for 4.3.1 tcpdump release
 662         Print "LLDP, length N" for LLDP packets even when not in verbose
 663             mode, so something is printed even if only the timestamp is
 664             present
 665         Document "-T carp"
 666         Print NTP poll interval correctly (it's an exponent, so print
 667             both its raw value and 2^value)
 668         Document that "-e" is used to get MAC addresses
 669         More clearly document that you need to escape or quote
 670             backslashes in filter expressions on the command line
 671         Fix some "the the" in the man page
 672         Use the right maximum path length
 673         Don't treat 192_1_2, when passed to -i, as an interface number
 674
 675 Friday  April 3, 2012.  mcr@sandelman.ca.
 676   Summary for 4.3.0 tcpdump release
 677         fixes for forces: SPARSE data (per RFC 5810)
 678         some more test cases added
 679         updates to documentation on -l, -U and -w flags.
 680         Fix printing of BGP optional headers.
 681         Tried to include DLT_PFSYNC support, failed due to headers required.
 682         added TIPC support.
 683         Fix LLDP Network Policy bit definitions.
 684         fixes for IGMPv3's Max Response Time: it is in units of 0.1 second.
 685         SIGUSR1 can be used rather than SIGINFO for stats
 686         permit -n flag to affect print-ip for protocol numbers
 687         ND_OPT_ADVINTERVAL is in milliseconds, not seconds
 688         Teach PPPoE parser about RFC 4638
 689
 690
 691 Friday  December 9, 2011.  guy@alum.mit.edu.
 692   Summary for 4.2.1 tcpdump release
 693         Only build the Babel printer if IPv6 is enabled.
 694         Support Babel on port 6696 as well as 6697.
 695         Include ppi.h in release tarball.
 696         Include all the test files in the release tarball, and don't
 697          "include" test files that no longer exist.
 698         Don't assume we have <rpc/rpc.h> - check for it.
 699         Support "-T carp" as a way of dissecting IP protocol 112 as CARP
 700          rather than VRRP.
 701         Support Hilscher NetAnalyzer link-layer header format.
 702         Constify some pointers and fix compiler warnings.
 703         Get rid of never-true test.
 704         Fix an unintended fall-through in a case statement in the ARP
 705          printer.
 706         Fix several cases where sizeof(sizeof(XXX)) was used when just
 707          sizeof(XXX) was intended.
 708         Make stricter sanity checks in the ES-IS printer.
 709         Get rid of some GCCisms that caused builds to fai with compilers
 710          that don't support them.
 711         Fix typo in man page.
 712         Added length checks to Babel printer.
 713
 714 Sunday  July 24, 2011.  mcr@sandelman.ca.
 715   Summary for 4.2.+
 716         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
 717           at gmail dot com>
 718         updates to forces for new port numbers
 719         Use "-H", not "-h", for the 802.11s option. (-h always help)
 720         Better ICMPv6 checksum handling.
 721         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
 722         get rid of uuencoded pcap test files, git can do binary.
 723         sFlow changes for 64-bit counters.
 724         fixes for PPI packet header handling and printing.
 725         Add DCB Exchange protocol (DCBX) version 1.01.
 726         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
 727         improvements to radiotap for rate values > 127.
 728         Many improvements to ForCES decode, including fix SCTP TML port
 729         updated RPL type code to RPL-17 draft
 730         Improve printout of DHCPv6 options.
 731         added support and test case for QinQ (802.1q VLAN) packets
 732         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
 733         Build fixes for Sparc and other machines with alignment restrictions.
 734         Merged changes from Debian package.
 735         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
 736         Build fixes for OSX (Snow Leopard and others)
 737         Add support for IEEE 802.15.4 packets
 738
 739 Tue.    July 20, 2010.  guy@alum.mit.edu.
 740   Summary for 4.1.2 tcpdump release
 741         If -U is specified, flush the file after creating it, so it's
 742           not zero-length
 743         Fix TCP flags output description, and some typos, in the man
 744           page
 745         Add a -h flag, and only attempt to recognize 802.11s mesh
 746           headers if it's set
 747         When printing the link-layer type list, send *all* output to
 748           stderr
 749         Include the CFLAGS setting when configure was run in the
 750           compiler flags
 751
 752 Thu.    April 1, 2010.  guy@alum.mit.edu.
 753   Summary for 4.1.1 tcpdump release
 754         Fix build on systems with PF, such as FreeBSD and OpenBSD.
 755         Don't blow up if a zero-length link-layer address is passed to
 756           linkaddr_string().
 757
 758 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
 759   Summary for 4.1.0 tcpdump release
 760         Fix printing of MAC addresses for VLAN frames with a length
 761           field
 762         Add some additional bounds checks and use the EXTRACT_ macros
 763           more
 764         Add a -b flag to print the AS number in BGP packets in ASDOT
 765           notation rather than ASPLAIN notation
 766         Add ICMPv6 RFC 5006 support
 767         Decode the access flags in NFS access requests
 768         Handle the new DLT_ for memory-mapped USB captures on Linux
 769         Make the default snapshot (-s) the maximum
 770         Print name of device (when -L is used)
 771         Support for OpenSolaris (and SXCE build 125 and later)
 772         Print new TCP flags
 773         Add support for RPL DIO
 774         Add support for TCP User Timeout (UTO)
 775         Add support for non-standard Ethertypes used by 3com PPPoE gear
 776         Add support for 802.11n and 802.11s
 777         Add support for Transparent Ethernet Bridge ethertype in GRE
 778         Add 4 byte AS support for BGP printer
 779         Add support for the MDT SAFI 66 BG printer
 780         Add basic IPv6 support to print-olsr
 781         Add USB printer
 782         Add printer for ForCES
 783         Handle frames with an FCS
 784         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
 785         Fix TCP sequence number printing
 786         Report 802.2 packets as 802.2 instead of 802.3
 787         Don't include -L/usr/lib in LDFLAGS
 788         On x86_64 Linux, look in lib64 directory too
 789         Lots of code clean ups
 790         Autoconf clean ups
 791         Update testcases to make output changes
 792         Fix compiling with/out smi (--with{,out}-smi)
 793         Fix compiling without IPv6 support (--disable-ipv6)
 794
 795 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
 796         Add support for Bluetooth Sniffing
 797         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
 798         Add support for 802.11 AVS
 799         Add support for SMB over TCP
 800         Add support for 4 byte BGP AS printing
 801         Add support for compiling on case-insensitive file systems
 802         Add support for ikev2 printing
 803         Update support for decoding AFS
 804         Update DHCPv6 printer
 805         Use newer libpcap API's (allows -B option on all platforms)
 806         Add -I to turn on monitor mode
 807         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
 808         Cleanup unused files and various cruft
 809
 810 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
 811         Rework ARP printer
 812         Rework OSPFv3 printer
 813         Add support for Frame-Relay ARP
 814         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
 815         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
 816         TLV: Add support for Juniper .pcap extensions
 817         Print EGP header in new-world-order style
 818         Converted print-isakmp.c to NETDISSECT
 819         Moved AF specific stuff into af.h
 820         Test subsystem now table driven, and saves outputs and diffs to one place
 821         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
 822          libpcap files on an OS other than where the file was generated
 823
 824
 825 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
 826
 827         NFS: Print unsigned values as such.
 828         RX: parse safely.
 829         BGP: fixes for IPv6-less builds.
 830         801.1ag: use standard codepoint.
 831         use /dev/bpf on systems with such a device.
 832         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
 833         smb: make sure that we haven't gone past the end of the captured data.
 834         smb: squelch an uninitialized complaint from coverity.
 835         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 836                 if it got MSG_DENIED.
 837         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 838         revised INSTALL.txt about libpcap dependency.
 839
 840 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 841         Update man page to reflect changes to libpcap
 842         Changes to both TCP and IP Printer Output
 843         Fix a potential buffer overflow in the 802.11 printer
 844         Print basic info about a few more Cisco LAN protocols.
 845         mDNS cleanup
 846         ICMP MPLS rework of the extension code
 847         bugfix: use the correct codepoint for the OSPF simple text auth token
 848          entry, and use safeputs to print the password.
 849         Add support in pflog for additional values
 850         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 851         Add support for the Message-id NACK c-type.
 852         Add support for 802.3ah loopback ctrl msg
 853         Add support for Multiple-STP as per 802.1s
 854         Add support for rapid-SPT as per 802.1w
 855         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 856          Sender-ID tlv, private tlv, port, interface status
 857         Add support for unidirectional link detection as per
 858          https://tools.ietf.org/id/draft-foschiano-udld-02.txt
 859         Add support for the olsr protocol as per RFC 3626 plus the LQ
 860          extensions from olsr.org
 861         Add support for variable-length checksum in DCCP, as per section 9 of
 862          RFC 4340.
 863         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 864         Add support for Multiple-STP as per 802.1s
 865         Add support for the cisco propriatry 'dynamic trunking protocol'
 866         Add support for the cisco proprietary VTP protocol
 867         Update dhcp6 options table as per IETF standardization activities
 868
 869
 870 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 871
 872         Fix compiling on AIX (, at end of ENUM)
 873         Updated list of DNS RR typecodes
 874         Use local Ethernet defs on WIN32
 875         Add support for Frame-Relay ARP
 876         Fixes for compiling under MSVC++
 877         Add support for parsing Juniper .pcap files
 878         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 879         Rework the OSPFv3 printer
 880         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 881         Add support for Cisco style NLPID encapsulation
 882         Add cisco prop. eigrp related, extended communities
 883         Add support for BGP signaled VPLS
 884         Cleanup the bootp printer
 885         Add support for PPP over Frame-Relay
 886         Add some bounds checking to the IP options code, and clean up
 887          the options output a bit.
 888         Add additional modp groups to ISAKMP printer
 889         Add support for Address-Withdraw and Label-Withdraw Msgs
 890         Add support for the BFD Discriminator TLV
 891         Fixes for 64bit compiling
 892         Add support for PIMv2 checksum verification
 893         Add support for further dissection of the IPCP Compression Option
 894         Add support for Cisco's proposed VQP protocol
 895         Add basic support for keyed authentication TCP option
 896         Lots of minor cosmetic changes to output printers
 897
 898
 899 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 900         Decoder support for more Juniper link-layer types
 901         Fix a potential buffer overflow (although it can't occur in
 902                 practice).
 903         Fix the handling of unknown management frame types in the 802.11
 904                 printer.
 905         Add FRF.16 support, fix various Frame Relay bugs.
 906         Add support for RSVP integrity objects, update fast-reroute
 907                 object printer to latest spec.
 908         Clean up documentation of vlan filter expression, document mpls
 909                 filter expression.
 910         Document new pppoed and pppoes filter expressions.
 911         Update diffserver-TE codepoints as per RFC 4124.
 912         Spelling fixes in ICMPv6.
 913         Don't require any fields other than flags to be present in IS-IS
 914                 restart signaling TLVs, and only print the system ID in
 915                 those TLVs as system IDs, not as node IDs.
 916         Support for DCCP.
 917
 918 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
 919
 920         Option to chroot() when dropping privs
 921         Fixes for compiling on nearly every platform,
 922                 including improved 64bit support
 923         Many new testcases
 924         Support for sending packets
 925         Many compilation fixes on most platforms
 926         Fixes for recent version of GCC to eliminate warnings
 927         Improved Unicode support
 928
 929         Decoders & DLT Changes, Updates and New:
 930                 AES ESP support
 931                 Juniper ATM, FRF.15, FRF.16, PPPoE,
 932                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
 933                         GGSN,ES,MONITOR,SERVICES
 934                 L2VPN
 935                 Axent Raptor/Symantec Firewall
 936                 TCP-MD5 (RFC 2385)
 937                 ESP-in-UDP (RFC 3948)
 938                 ATM OAM
 939                 LMP, LMP Service Discovery
 940                 IP over FC
 941                 IP over IEEE 1394
 942                 BACnet MS/TP
 943                 SS7
 944                 LDP over TCP
 945                 LACP, MARKER as per 802.3ad
 946                 PGM (RFC 3208)
 947                 LSP-PING
 948                 G.7041/Y.1303 Generic Framing Procedure
 949                 EIGRP-IP, EIGRP-IPX
 950                 ICMP6
 951                 Radio - via radiotap
 952                 DHCPv6
 953                 HDLC over PPP
 954
 955 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
 956
 957         No changes from 3.8.2. Version bumped only to maintain consistency
 958         with libpcap 0.8.3.
 959
 960 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
 961
 962         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
 963         https://web.archive.org/web/20160328035955/https://www.rapid7.com/resources/advisories/R7-0017.jsp
 964         IP-over-IEEE1394 printing.
 965         some MINGW32 changes.
 966         updates for autoconf 2.5
 967         fixes for print-aodv.c - check for too short packets
 968         formatting changes to print-ascii for hex output.
 969         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
 970                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
 971                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
 972                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
 973         print-ether.c - better handling of unknown types.
 974         print-isoclns.c - additional decoding of types.
 975         print-llc.c - strings for LLC names added.
 976         print-pfloc.c - various enhancements
 977         print-radius.c - better decoding to strings.
 978
 979 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
 980
 981         changed syntax of -E argument so that multiple SAs can be decrypted
 982         fixes for Digital Unix headers and Documentation
 983         __attribute__ fixes
 984         CDP changes from Terry Kennedy <terry@tmk.com>.
 985         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
 986         Fixes for ASN.1 decoder for 2.100.3 forms.
 987         Added a count of packets received and processed to clarify numbers.
 988         Incorporated WinDUMP patches for Win32 builds.
 989         PPPoE payload length headers.
 990         Fixes for HP C compiler builds.
 991         Use new pcap_breakloop() and pcap_findalldevs() if we can.
 992         BGP output split into multiple lines.
 993         Fixes to 802.11 decoding.
 994         Fixes to PIM decoder.
 995         SuperH is a CPU that can't handle unaligned access. Many fixes for
 996                 unaligned access work.
 997         Fixes to Frame-Relay decoder for Q.933/922 frames.
 998         Clarified when Solaris can do captures as non-root.
 999         Added tests/ subdir for examples/regression tests.
1000         New -U flag.    -flush stdout after every packet
1001         New -A flag     -print ascii only
1002         support for decoding IS-IS inside Cisco HDLC Frames
1003         more verbosity for tftp decoder
1004         mDNS decoder
1005         new BFD decoder
1006         cross compilation patches
1007         RFC 3561 AODV support.
1008         UDP/TCP pseudo-checksum properly for source-route options.
1009         sanitized all files to modified BSD license
1010         Add support for RFC 2625 IP-over-Fibre Channel.
1011         fixes for DECnet support.
1012         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
1013         RFC 2684 encapsulation of BPDUs.
1014
1015 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
1016
1017         Fixed infinite loop when parsing invalid isakmp packets.
1018          (reported by iDefense; already fixed in CVS)
1019         Fixed infinite loop when parsing invalid BGP packets.
1020         Fixed buffer overflow with certain invalid NFS packets.
1021         Pretty-print unprintable network names in 802.11 printer.
1022         Handle truncated nbp (appletalk) packets.
1023         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
1024         Print IP protocol name even if we don't have a printer for it.
1025         Print IP protocol name or number for fragments.
1026         Print the whole MPLS label stack, not just the top label.
1027         Print request header and file handle for NFS v3 FSINFO and PATHCONF
1028          requests.
1029         Fix NFS packet truncation checks.
1030         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
1031         Handle unknown RADIUS attributes properly.
1032         Fix an ASN.1 parsing error that would cause e.g. the OID
1033          2.100.3 to be misrepresented as 4.20.3 .
1034
1035 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
1036         keyword "ipx" added.
1037         Better OSI/802.2 support on Linux.
1038         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
1039         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
1040         BXXP protocol was replaced by the BEEP protocol;
1041         improvements to SNAP demux.
1042         Changes to "any" interface documentation.
1043         Documentation on pcap_stats() counters.
1044         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
1045         Added MPLS encapsulation decoding per RFC3032.
1046         DNS dissector handles TKEY, TSIG and IXFR.
1047         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
1048         SMB printing has much improved bounds checks
1049         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
1050         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
1051         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
1052         IPX socket 0x85be is for Cisco EIGRP over IPX.
1053         Improvements to fragmented ESP handling.
1054         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
1055         Linux ARPHDR_ATM support fixed.
1056         Added a "netbeui" keyword, which selects NetBEUI packets.
1057         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
1058         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
1059         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
1060         Better Linux libc5 compat.
1061         BIND9 lwres dissector added.
1062         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
1063         Apple LocalTalk LINKTYPE_ reserved.
1064         New time stamp formats documented.
1065         DHCP6 updated to draft-22.txt spec.
1066         ICMP types/codes now accept symbolic names.
1067         Add SIGINFO handler from LBL
1068         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
1069         now we are -Wstrict-prototype clean.
1070         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
1071         PPPoE dissector cleaned up.
1072         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
1073         In dissector, now the caller prints the IP addresses rather than proto.
1074         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
1075         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
1076         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
1077         captures on the "any" device won't be done in promiscuous mode
1078         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
1079         ARCNet support, from NetBSD.
1080         HSRP dissector, from Julian Cowley <julian@lava.net>.
1081         Handle (GRE-encapsulated) PPTP
1082         added -C option to rotate save file every optarg * 1,000,000 bytes.
1083         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
1084         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
1085         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
1086         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
1087         ESP printing updated to RFC2406.
1088         HP-UX can now handle large number of PPAs.
1089         MSDP printer added.
1090         L2TP dissector improvements from Motonori Shindo.
1091
1092 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
1093         Cleaned up documentation.
1094         Promisc mode fixes for Linux
1095         IPsec changes/cleanups.
1096         Alignment fixes for picky architectures
1097
1098         Removed dependency on native headers for packet dissectors.
1099         Removed Linux specific headers that were shipped
1100
1101         libpcap changes provide for exchanging capture files between
1102           systems. Save files now have well known PACKET_ values instead of
1103           depending upon system dependent mappings of DLT_* types.
1104
1105         Support for computing/checking IP and UDP/TCP checksums.
1106
1107         Updated autoconf stock files.
1108
1109         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
1110
1111         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
1112                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
1113
1114         Added filtering support for: VLANs, ESIS, ISIS
1115
1116         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
1117                 L2TP, PPPoE
1118
1119         HP-UX 11.0 -- find the right dlpi device.
1120         Solaris 8 - IPv6 works
1121         Linux - Added support for an "any" device to capture on all interfaces
1122
1123         Security fixes: buffer overrun audit done. Strcpy replaced with
1124                 strlcpy, sprintf replaced with snprintf.
1125         Look for lex problems, and warn about them.
1126
1127
1128 v3.5 Fri Jan 28 18:00:00 PST 2000
1129
1130 Bill Fenner <fenner@research.att.com>
1131 - switch to config.h for autoconf
1132 - unify RCSID strings
1133 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
1134 - Really fix the RIP printer
1135 - Fix MAC address -> name translation.
1136 - some -Wall -Wformat fixes
1137 - update makemib to parse much of SMIv2
1138 - Print TCP sequence # with -vv even if you normally wouldn't
1139 - Print as much of IP/TCP/UDP headers as possible even if truncated.
1140
1141 itojun@iijlab.net
1142 - -X will make a ascii dump.  from netbsd.
1143 - telnet command sequence decoder (ff xx xx).  from netbsd.
1144 - print-bgp.c: improve options printing.  ugly code exists for
1145   unaligned option parsing (need some fix).
1146 - const poisoning in SMB decoder.
1147 - -Wall -Werror clean checks.
1148 - bring in KAME IPv6/IPsec decoding code.
1149
1150 Assar Westerlund  <assar@sics.se>
1151 - SNMPv2 and SNMPv3 printer
1152 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
1153   SNMP packets.
1154 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
1155 - portability fixes
1156 - permit building in different directories.
1157
1158 Ken Hornstein <kenh@cmf.nrl.navy.mil>
1159 - bring in code at
1160   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
1161   AFS3 packets
1162
1163 Andrew Tridgell <tridge@linuxcare.com>
1164 - SMB printing code
1165
1166 Love <lha@stacken.kth.se>
1167 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
1168   change date format to the right one.
1169
1170 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
1171 - Created tcpdump.org repository
1172
1173 v3.4 Sat Jul 25 12:40:55 PDT 1998
1174
1175 - Hardwire Linux slip support since it's too hard to detect.
1176
1177 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
1178   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
1179
1180 - Added -a which tries to translate network and broadcast addresses to
1181   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
1182
1183 - Added a configure option to disable gcc.
1184
1185 - Added a "raw" packet printer.
1186
1187 - Not having an interface address is no longer fatal. Requested by John
1188   Hawkinson.
1189
1190 - Rework signal setup to accommodate Linux.
1191
1192 - OSPF truncation check fix. Also display the type of OSPF packets
1193   using MD5 authentication. Thanks to Brian Wellington
1194   (bwelling@tis.com)
1195
1196 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
1197   Peisach (epeisach@mit.edu)
1198
1199 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
1200   (plonka@mfa.com)
1201
1202 - Specify full install target as a way of detecting if install
1203   directory does not exist. Thanks to Dave Plonka.
1204
1205 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
1206   (paul@vix.com)
1207
1208 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
1209   Marty Leisner (leisner@sdsp.mc.xerox.com)
1210
1211 - Add a local autoconf macro to check for routines in libraries; the
1212   autoconf version is broken (it only puts the library name in the
1213   cache variable name). Thanks to John Hawkinson.
1214
1215 - Add a local autoconf macro to check for types; the autoconf version
1216   is broken (it uses grep instead of actually compiling a code fragment).
1217
1218 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
1219   formats.
1220
1221 - Extend OSF ip header workaround to versions 1 and 2.
1222
1223 - Fix some signed problems in the nfs printer. As reported by David
1224   Sacerdote (davids@silence.secnet.com)
1225
1226 - Detect group wheel and use it as the default since BSD/OS' install
1227   can't hack numeric groups. Reported by David Sacerdote.
1228
1229 - AIX needs special loader options. Thanks to Jonathan I. Kamens
1230   (jik@cam.ov.com)
1231
1232 - Fixed the nfs printer to print port numbers in decimal. Thanks to
1233   Kent Vander Velden (graphix@iastate.edu)
1234
1235 - Find installed libpcap in /usr/local/lib when not using gcc.
1236
1237 - Disallow network masks with non-network bits set.
1238
1239 - Attempt to detect "egcs" versions of gcc.
1240
1241 - Add missing closing double quotes when displaying bootp strings.
1242   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
1243
1244 v3.3 Sat Nov 30 20:56:27 PST 1996
1245
1246 - Added Linux support.
1247
1248 - GRE encapsulated packet printer thanks to John Hawkinson
1249   (jhawk@mit.edu)
1250
1251 - Rewrite gmt2local() to avoid problematic os dependencies.
1252
1253 - Suppress nfs truncation message on errors.
1254
1255 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
1256   Reported by Joachim Ott (ott@ardala.han.de)
1257
1258 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
1259
1260 - Print arp hardware type in host order. Thanks to Onno van der Linden
1261   (onno@simplex.nl)
1262
1263 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
1264   (barnett@grymoire.crd.ge.com)
1265
1266 - Fix rip printer to not print one more route than is actually in the
1267   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
1268   Bill Fenner (fenner@parc.xerox.com)
1269
1270 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
1271
1272 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
1273   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
1274
1275 - Rewrite ospf printer to improve truncation checks.
1276
1277 - Don't parse tcp options past the EOL. As noted by David Sacerdote
1278   (davids@secnet.com). Also, check tcp options to make sure they ar
1279   actually in the tcp header (in addition to the normal truncation
1280   checks). Fix the SACK code to print the N blocks (instead of the
1281   first block N times).
1282
1283 - Don't say really small UDP packets are truncated just because they
1284   aren't big enough to be a RPC. As noted by David Sacerdote.
1285
1286 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
1287
1288 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
1289   (martin@msp.se)
1290
1291 - Print mtu for icmp unreach need frag packets. Thanks to John
1292   Hawkinson (jhawk@mit.edu)
1293
1294 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
1295   (jch@bsdi.com)
1296
1297 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
1298   (kushida@trl.ibm.co.jp)
1299
1300 - Check igmp checksum if possible. Thanks to John Hawkinson.
1301
1302 - Made changes for SINIX. Thanks to Andrej Borsenkow
1303   (borsenkow.msk@sni.de)
1304
1305 - Use autoconf's idea of the top level directory in install targets.
1306   Thanks to John Hawkinson.
1307
1308 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
1309   Mogul (mogul@pa.dec.com)
1310
1311 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
1312   Thanks to John Hawkinson.
1313
1314 - Added some more packet truncation checks.
1315
1316 - On systems that have it, use sigset() instead of signal() since
1317   signal() has different semantics on these systems.
1318
1319 - Fixed some more alignment problems on the alpha.
1320
1321 - Add code to massage unprintable characters in the domain and ipx
1322   printers. Thanks to John Hawkinson.
1323
1324 - Added explicit netmask support. Thanks to Steve Nuchia
1325   (steve@research.oknet.com)
1326
1327 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
1328   Kennedy (terry@spcvxa.spc.edu)
1329
1330 - Add "atalk" keyword as suggested by John Hawkinson.
1331
1332 - Added an igrp printer. Thanks to Francis Dupont
1333   (francis.dupont@inria.fr)
1334
1335 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
1336   Kennedy (terry@spcvxa.spc.edu)
1337
1338 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
1339   (pascal.hennequin@hugo.int-evry.fr)
1340
1341 - Added some ETHERTYPEs missing on some systems.
1342
1343 - Added truncated packet macros and various checks.
1344
1345 - Fixed endian problems with the DECnet printer.
1346
1347 - Use $CC when checking gcc version. Thanks to Carl Lindberg
1348   (carl_lindberg@blacksmith.com)
1349
1350 - Fixes for AIX (although this system is not yet supported). Thanks to
1351   John Hawkinson.
1352
1353 - Fix bugs in the autoconf misaligned accesses code fragment.
1354
1355 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
1356   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
1357
1358 v3.2 Sun Jun 23 02:28:10 PDT 1996
1359
1360 - Print new icmp unreachable codes as suggested by Martin Fredriksson
1361   (martin@msp.se). Also print code value when unknown for icmp redirect
1362   and time exceeded.
1363
1364 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
1365
1366 - Define "new" domain record types if not found in arpa/nameserv.h.
1367   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
1368   fixed an endian bug when printing mx record and added some new record
1369   types.
1370
1371 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
1372
1373 - Added T/TCP options printing. As suggested by Richard Stevens
1374   (rstevens@noao.edu)
1375
1376 - Use autoconf to detect architectures that can't handle misaligned
1377   accesses.
1378
1379 v3.1 Thu Jun 13 20:59:32 PDT 1996
1380
1381 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
1382   and bind (as suggested by Charles Hannum).
1383
1384 - Port to GNU autoconf.
1385
1386 - Add support for printing DVMRP and PIM traffic thanks to
1387   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
1388
1389 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
1390   define being referenced. Reported by Terry Kennedy.
1391
1392 - Minor fixes to the man page thanks to Mark Andrews.
1393
1394 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
1395   (bmah@cs.berkeley.edu).
1396
1397 - Added support for new dns types, thanks to Rainer Orth.
1398
1399 - Fixed tftp_print() to print the block number for ACKs.
1400
1401 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
1402   (cslater@imatek.com).
1403
1404 - Check return status from malloc/calloc/etc.
1405
1406 - Check return status from pcap_loop() so we can print an error and
1407   exit with a bad status if there were problems.
1408
1409 - Bail if ip option length is <= 0. Resulted from a bug report from
1410   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
1411
1412 - Print out a little more information for sun rpc packets.
1413
1414 - Add support for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
1415
1416 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
1417   wrong on little endian machines).
1418
1419 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
1420   (crawdad@fnal.gov).
1421
1422 - Fix ntp_print() to not print garbage when the stratum is
1423   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
1424
1425 - Rewrote tcp options printer code to check for truncation. Added
1426   selective acknowledgment case.
1427
1428 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
1429   (jch@bsdi.com)
1430
1431 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
1432   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
1433   (toku@dit.co.jp)
1434
1435 - Don't checksum ip header if we don't have all of it. Thanks to John
1436   Hawkinson (jhawk@mit.edu).
1437
1438 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
1439   Honig (jhc@bsdi.com)
1440
1441
1442 v3.1a1 Wed May  3 19:21:11 PDT 1995
1443
1444 - Include time.h when SVR4 is defined to avoid problems under Solaris
1445   2.3.
1446
1447 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
1448   strings, not the local buffer. Thanks to Stefan Petri
1449   (petri@ibr.cs.tu-bs.de).
1450
1451 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
1452   that the selected value was not used. Thanks to Pascal Hennequin
1453   (Pascal.Hennequin@hugo.int-evry.fr).
1454
1455 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
1456
1457 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
1458
1459 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
1460
1461 - Although there never was a 3.0.3 release, the linux boys cleverly
1462   "released" one in late 1995.
1463
1464 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
1465
1466 - Change configuration to not use gcc v2 flags with gcc v1.
1467
1468 - Redo gmt2local() so that it works under BSDI (which seems to return
1469   an empty timezone struct from gettimeofday()). Based on report from
1470   Terry Kennedy (terry@spcvxa.spc.edu).
1471
1472 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
1473   on report from Mark Andrews (mandrews@alias.com).
1474
1475 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
1476   Orth (ro@techfak.uni-bielefeld.de).
1477
1478 - Fixed printout of connection id for uncompressed tcp slip packets.
1479   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
1480
1481 - Hack around deficiency in Ultrix's make.
1482
1483 - Add ETHERTYPE_TRAIL define which is missing from irix5.
1484
1485 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
1486
1487 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
1488
1489 v3.0 Mon Jun 20 19:23:27 PDT 1994
1490
1491 - Added support for printing tcp option timestamps thanks to
1492   Mark Andrews (mandrews@alias.com).
1493
1494 - Reorganize protocol dumpers to take const pointers to packets so they
1495   never change the contents (i.e., they used to do endian conversions
1496   in place).  Previously, whenever more than one pass was taken over
1497   the packet, the packet contents would be dumped incorrectly (i.e.,
1498   the output form -x would be wrong on little endian machines because
1499   the protocol dumpers would modify the data).  Thanks to Charles Hannum
1500   (mycroft@gnu.ai.mit.edu) for reporting this problem.
1501
1502 - Added support for decnet protocol dumping thanks to Jeff Mogul
1503   (mogul@pa.dec.com).
1504
1505 - Fix bug that caused length of packet to be incorrectly printed
1506   (off by ether header size) for unknown ethernet types thanks
1507   to Greg Miller (gmiller@kayak.mitre.org).
1508
1509 - Added support for IPX protocol dumping thanks to Brad Parker
1510   (brad@fcr.com).
1511
1512 - Added check to verify IP header checksum under -v thanks to
1513   Brad Parker (brad@fcr.com).
1514
1515 - Move packet capture code to new libpcap library (which is
1516   packaged separately).
1517
1518 - Prototype everything and assume an ansi compiler.
1519
1520 - print-arp.c: Print hardware ethernet addresses if they're not
1521   what we expect.
1522
1523 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
1524   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
1525
1526 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
1527   (mogul@pa.dec.com).
1528
1529 - print-icmp.c: Byte swap netmask before printing. Thanks to
1530   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
1531
1532 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
1533   By default, only the inner packet is dumped, appended with the token
1534   "(encap)".  Under -v, both the inner and output packets are dumped
1535   (on the same line).  Note that the filter applies to the original packet,
1536   not the encapsulated packet.  So if you run tcpdump on a net with an
1537   IP Multicast tunnel, you cannot filter out the datagrams using the
1538   conventional syntax.  (You can filter away all the ip-in-ip traffic
1539   with "not ip proto 4".)
1540
1541 - print-nfs.c: Keep pending rpc's in circular table. Add generic
1542   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
1543
1544 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
1545
1546 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
1547   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
1548   Add && and || operators
1549
1550 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
1551
1552 - Fix bug with -c flag.
1553
1554 v2.2 Fri May 22 17:19:41 PDT 1992
1555
1556 - savefile.c: Remove hack that shouldn't have been exported. Add
1557   truncate checks.
1558
1559 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
1560   matches non-echo/reply ICMP packets.
1561
1562 - Many improvements to filter code optimizer.
1563
1564 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
1565   so that protocol qualifications are allowed. For example, "ip broadcast"
1566   and "ether multicast" are valid filters.
1567
1568 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
1569   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
1570   patches to netinet/if_loop.c.
1571
1572 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
1573   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
1574
1575 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
1576
1577 v2.1 Tue Jan 28 11:00:14 PST 1992
1578
1579 - Internal release (never publicly exported).
1580
1581 v2.0.1 Sun Jan 26 21:10:10 PDT
1582
1583 - Various byte ordering fixes.
1584
1585 - Add truncation checks.
1586
1587 - inet.c: Support BSD style SIOCGIFCONF.
1588
1589 - nametoaddr.c: Handle multi addresses for single host.
1590
1591 - optimize.c: Rewritten.
1592
1593 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
1594   for broadcast nets.
1595
1596 - print-atal.c: Fix an alignment bug (thanks to
1597   stanonik@nprdc.navy.mil) Add missing printf() argument.
1598
1599 - print-bootp.c: First attempt at decoding the vendor buffer.
1600
1601 - print-domain.c: Fix truncation checks.
1602
1603 - print-icmp.c: Calculate length of packets from the ip header.
1604
1605 - print-ip.c: Print frag id in decimal (so it's easier to match up
1606   with non-frags). Add support for ospf, egp and igmp.
1607
1608 - print-nfs.c: Lots of changes.
1609
1610 - print-ntp.c: Make some verbose output depend on -v.
1611
1612 - print-snmp.c: New version from John LoVerso.
1613
1614 - print-tcp.c: Print rfc1072 tcp options.
1615
1616 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
1617   (microseconds) worth of precision. Fix uid bugs.
1618
1619 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
1620   With this option, you can create an architecture independent binary
1621   trace file in real time, without the overhead of the packet printer.
1622   At a later time, the packets can be filtered (again) and printed.
1623
1624 - BSD is supported.  You must have BPF in your kernel.
1625   Since the filtering is now done in the kernel, fewer packets are
1626   dropped.  In fact, with BPF and the packet dumper option, a measly
1627   Sun 3/50 can keep up with a busy network.
1628
1629 - Compressed SLIP packets can now be dumped, provided you use our
1630   SLIP software and BPF.  These packets are dumped as any other IP
1631   packet; the compressed headers are dumped with the '-e' option.
1632
1633 - Machines with little-endian byte ordering are supported (thanks to
1634   Jeff Mogul).
1635
1636 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
1637
1638 - IBM RT and Stanford Enetfilter support has been added by
1639   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
1640   both the vanilla Enetfilter interface, and the extended interface
1641   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
1642
1643 - TFTP packets are now printed (requests only).
1644
1645 - BOOTP packets are now printed.
1646
1647 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
1648
1649 - Sparc architectures, including the Sparcstation-1, are now
1650   supported thanks to Steve McCanne and Craig Leres.
1651
1652 - SunOS 4 is now supported thanks to Micky Liu of Columbia
1653   University (micky@cunixc.cc.columbia.edu).
1654
1655 - IP options are now printed.
1656
1657 - RIP packets are now printed.
1658
1659 - There's a -v flag that prints out more information than the
1660   default (e.g., it will enable printing of IP ttl, tos and id)
1661   and -q flag that prints out less (e.g., it will disable
1662   interpretation of AppleTalk-in-UDP).
1663
1664 - The grammar has undergone substantial changes (if you have an
1665   earlier version of tcpdump, you should re-read the manual
1666   entry).
1667
1668   The most useful change is the addition of an expression
1669   syntax that lets you filter on arbitrary fields or values in the
1670   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
1671   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
1672   packets.
1673
1674   The most painful change is that concatenation no longer means
1675   "and" -- e.g., you have to say "host foo and port bar" instead
1676   of "host foo port bar".  The up side to this down is that
1677   repeated qualifiers can be omitted, making most filter
1678   expressions shorter.  E.g., you can now say "ip host foo and
1679   (bar or baz)" to look at ip traffic between hosts foo and bar or
1680   between hosts foo and baz.  [The old way of saying this was "ip
1681   host foo and (ip host bar or ip host baz)".]
1682
1683 v2.0 Sun Jan 13 12:20:40 PST 1991
1684
1685 - Initial public release.