The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
   2   Summary for 5.0.0 tcpdump release (so far!)
   3     Refine protocol decoding for:
   4       OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of
   5           some lengths, and fix handling of snapend.
   6       RIP: Make a couple trivial protocol updates.
   7       NetFlow: Use tcp_flag_values[] for TCP flags.
   8       ZMTP: Replace custom code with bittok2str().
   9       BFD: Add support for S-BFD and spell LAG in uppercase.
  10       IEEE 802.11: include the Mesh ID field while printing management
  11         frames.
  12       DNS: sync resource types with IANA.
  13       MPTCP: parse MPC data_len field, print flags from MP_CAPABLE option.
  14       ICMP: add dissector for ICMP Interface Identification Object
  15       BGP: Parse BGP extended message support capability
  16       BGP: Deprecate DPA, ADVERTISER and RCID_PATH path attributes
  17       BGP: Print Enhanced route refresh capability
  18       BGP: Print enhanced route refresh message subtype
  19       BGP: Parse rfc9072 (Extended Optional Parameters Length for BGP OPEN Message)
  20       BGP: Add support for BFD cease subcode
  21       BGP: Add support for Hard Reset notification and GR N flag
  22       BGP: Handle ORF in Route-Refresh messages
  23       BGP: add dissector for BGPsec capability and path
  24       BGP: Add Origin Validation State extended community
  25       BGP: Add support for BGP Role capability and OTC attribute
  26       Arista: Use the test .pcap file from pull request #955 (HwInfo).
  27     User interface:
  28       Add optional unit suffix on -C file size.
  29       Add --print-sampling to print every Nth packet instead of all.
  30       Print the supported time stamp types (-J) to stdout instead of stderr.
  31       Print the list of data link types (-L) to stdout instead of stderr.
  32     Source code:
  33       Use %zu when printing a sizeof to squelch compiler warnings
  34       Remove unused missing/snprintf.c.
  35       (FIXME: somebody please wrap the line below just before the release)
  36       AODV, AppleTalk, BOOTP, CHDLC, DCCP, EGP, EIGRP, ForCES, Geneve, GRE, Juniper, L2TP, NetFlow, NTP, OLSR, PGM, RIP, RSVP, SCTP, SNMP, TCP, UDP, vsock: Modernize packet parsing style
  37       DCCP, EGP: Replace custom code with tok2str()
  38       UDP: Clean up address and port printing.
  39       AppleTalk: Declutter appletalk.h.
  40       Introduce new ND_ICHECK*() macros to deduplicate more code.
  41       IEEE 802.11: Simplify handle_action().
  42       RPKI-Router: Refine length and bounds checks.
  43     Building and testing:
  44       Add a configure option to help debugging (--enable-instrument-functions)
  45
  46 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
  47   Summary for 4.99.4 tcpdump release (so far!)
  48     Updated printers:
  49       LSP ping: Fix "Unused value" warnings from Coverity.
  50       smbutil.c: Fix the strftime buffer size
  51     Building and testing:
  52       Require at least autoconf 2.69.
  53       Don't check for strftime(), as it's in C90 and beyond.
  54
  55 Thursday, January 12, 2023 / The Tcpdump Group
  56   Summary for 4.99.3 tcpdump release
  57     Updated printers:
  58       PTP: Use the proper values for the control field and print un-allocated
  59         values for the message field as "Reserved" instead of "none".
  60     Source code:
  61       smbutil.c: Replace obsolete function call (asctime)
  62     Building and testing:
  63       cmake: Update the minimum required version to 2.8.12 (except Windows).
  64       CI: Introduce and use TCPDUMP_CMAKE_TAINTED.
  65       Makefile.in: Add the releasecheck target.
  66       Makefile.in: Add "make -s install" in the releasecheck target.
  67       Cirrus CI: Run the "make releasecheck" command in the Linux task.
  68       Makefile.in: Add the whitespacecheck target.
  69       Cirrus CI: Run the "make whitespacecheck" command in the Linux task.
  70       Address all shellcheck warnings in update-test.sh.
  71       Makefile.in: Get rid of a remain of gnuc.h.
  72     Documentation:
  73       Reformat the installation notes (INSTALL.txt) in Markdown.
  74       Convert CONTRIBUTING to Markdown.
  75       CONTRIBUTING.md: Document the use of "protocol: " in a commit summary.
  76       Add a README file for NetBSD.
  77       Fix CMake build to set man page section numbers in tcpdump.1
  78
  79 Saturday, December 31, 2022 / The Tcpdump Group
  80   Summary for 4.99.2 tcpdump release
  81     Updated printers:
  82       BGP: Update cease notification decoding to RFC 9003.
  83       BGP: decode BGP link-bandwidth extended community properly.
  84       BGP: Fix parsing the AIGP attribute
  85       BGP: make sure the path attributes don't go past the end of the packet.
  86       BGP: Shutdown message can be up to 255 bytes length according to rfc9003
  87       DSA: correctly determine VID.
  88       EAP: fix some length checks and output issues.
  89       802.11: Fix the misleading comment regarding "From DS", "To DS" Frame
  90         Control Flags.
  91       802.11: Fetch the CF and TIM IEs a field at a time.
  92       802.15.4, BGP, LISP: fix some length checks, compiler warnings,
  93         and undefined behavior warnings.
  94       PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
  95         OSes.
  96       RRCP: support more Realtek protocols than just RRCP.
  97       MPLS: show the EXP field as TC, as per RFC 5462.
  98       ICMP: redo MPLS Extension code as general ICMP Extension code.
  99       VQP: Do not print unknown error codes twice.
 100       Juniper: Add some bounds checks.
 101       Juniper: Don't treat known DLT_ types as "Unknown".
 102       lwres: Fix a length check, update a variable type.
 103       EAP: Fix some undefined behaviors at runtime.
 104       Ethernet: Rework the length checks, add a length check.
 105       IPX: Add two length checks.
 106       Zephyr: Avoid printing non-ASCII characters.
 107       VRRP: Print the protocol name before any GET_().
 108       DCCP: Get rid of trailing commas in lists.
 109       Juniper: Report invalid packets as invalid, not truncated.
 110       IPv6: Remove an obsolete code in an always-false #if wrapper.
 111       ISAKMP: Use GET_U_1() to replace a direct dereference.
 112       RADIUS: Use GET_U_1() to replace a direct dereference.
 113       TCP: Fix an invalid check.
 114       RESP: Fix an invalid check.
 115       RESP: Remove an unnecessary test.
 116       Arista: Refine the output format and print HwInfo.
 117       sFlow: add support for IPv6 agent, add a length check.
 118       VRRP: add support for IPv6.
 119       OSPF: Update to match the Router Properties registry.
 120       OSPF: Remove two unnecessary dereferences.
 121       OSPF: Add support bit Nt RFC3101.
 122       OSPFv3: Remove two unnecessary dereferences.
 123       ICMPv6: Fix output for Router Renumbering messages.
 124       ICMPv6: Fix the Node Information flags.
 125       ICMPv6: Remove an unused macro and extra blank lines.
 126       ICMPv6: Add a length check in the rpl_dio_print() function.
 127       ICMPv6: Use GET_IP6ADDR_STRING() in the rpl_dio_print() function.
 128       IPv6: Add some checks for the Hop-by-Hop Options header
 129       IPv6: Add a check for the Jumbo Payload Hop-by-Hop option.
 130       NFS: Fix the format for printing an unsigned int
 131       PTP: fix printing of the correction fields
 132       PTP: Use ND_LCHECK_U for checking invalid length.
 133       WHOIS: Add its own printer source file and printer function
 134       MPTCP: print length before subtype inside MPTCP options
 135       ESP: Add a workaround to a "use-of-uninitialized-value".
 136       PPP: Add tests to avoid incorrectly re-entering ppp_hdlc().
 137       PPP: Don't process further if protocol is unknown (-e option).
 138       PPP: Change the pointer to packet data.
 139       ZEP: Add three length checks.
 140       Add some const qualifiers.
 141     Building and testing:
 142       Update config.guess and config.sub.
 143       Use AS_HELP_STRING macro instead of AC_HELP_STRING.
 144       Handle some Autoconf/make errors better.
 145       Fix an error when cross-compiling.
 146       Use "git archive" for the "make releasetar" process.
 147       Remove the release candidate rcX targets.
 148       Mend "make check" on Solaris 9 with Autoconf.
 149       Address assorted compiler warnings.
 150       Fix auto-enabling of Capsicum on FreeBSD with Autoconf.
 151       Treat "msys" as Windows for test exit statuses.
 152       Clean up some help messages in configure.
 153       Use unified diff by default.
 154       Remove awk code from mkdep.
 155       Fix configure test errors with Clang 15
 156       CMake: Prevent stripping of the RPATH on installation.
 157       AppVeyor CI: update Npcap site, update to 1.12 SDK.
 158       Cirrus CI: Use the same configuration as for the main branch.
 159       CI: Add back running tcpdump -J/-L and capture, now with Cirrus VMs.
 160       Remove four test files (They are now in the libpcap tests directory).
 161       On Solaris, for 64-bit builds, use the 64-bit pcap-config.
 162       Tell CMake not to check for a C++ compiler.
 163       CMake: Add a way to request -Werror and equivalents.
 164       configure: Special-case macOS /usr/bin/pcap-config as we do in CMake.
 165       configure: Use pcap-config --static-pcap-only if available.
 166       configure: Use ac_c_werror_flag to force unknown compiler flags to fail.
 167       configure: Use AC_COMPILE_IFELSE() and AC_LANG_SOURCE() for testing
 168         flags.
 169       Run the test that fails on OpenBSD only if we're not on OpenBSD.
 170     Source code:
 171       Fix some snapend-changing routines to protect against pointer
 172         underflow.
 173       Use __func__ from C99 in some function calls.
 174       Memory allocator: Update nd_add_alloc_list() to a static function.
 175       addrtoname.c: Fix two invalid tests.
 176       Use more S_SUCCESS and S_ERR_HOST_PROGRAM in main().
 177       Add some comments about "don't use GET_IP6ADDR_STRING()".
 178       Assign ndo->ndo_packetp in pretty_print_packet().
 179       Add ND_LCHECKMSG_U, ND_LCHECK_U, ND_LCHECKMSG_ZU and ND_LCHECK_ZU macros.
 180       Update tok2strbuf() to a static function.
 181       netdissect.h: Keep the link-layer dissectors names sorted.
 182       setsignal(): Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP)
 183         to avoid corrupting binary pcap output.
 184       Use __builtin_unreachable().
 185       Fail if nd_push_buffer() or nd_push_snaplen() fails.
 186       Improve code style and fix many typos.
 187     Documentation:
 188       Some man page cleanups.
 189       Update the print interface for the packet count to stdout.
 190       Note that we require compilers to support at least some of C99.
 191       Update AIX and Solaris-related specifics.
 192       INSTALL.txt: Add doc/README.*, delete the deleted win32 directory.
 193       Update README.md and README.Win32.md.
 194       Update some comments with new RFC numbers.
 195
 196 Wednesday, June 9, 2021 by gharris
 197   Summary for 4.99.1 tcpdump release
 198     Source code:
 199       Squelch some compiler warnings
 200       ICMP: Update the snapend for some nested IP packets.
 201       MACsec: Update the snapend thus the ICV field is not payload
 202         for the caller.
 203       EIGRP: Fix packet header fields
 204       SMB: Disable printer by default in CMake builds
 205       OLSR: Print the protocol name even if the packet is invalid
 206       MSDP: Print ": " before the protocol name
 207       ESP: Remove padding, padding length and next header from the buffer
 208       DHCPv6: Update the snapend for nested DHCPv6 packets
 209       OpenFlow 1.0: Get snapend right for nested frames.
 210       TCP: Update the snapend before decoding a MPTCP option
 211       Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks
 212       ForCES: Refine SPARSEDATA-TLV length check.
 213       ASCII/hex: Use nd_trunc_longjmp() in truncation cases
 214       GeoNet: Add a ND_TCHECK_LEN() call
 215       Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES().
 216       BGP: Fix overwrites of global 'astostr' temporary buffer
 217       ARP: fix overwrites of static buffer in q922_string().
 218       Frame Relay: have q922_string() handle errors better.
 219     Building and testing:
 220       Rebuild configure script when building release
 221       Fix "make clean" for out-of-tree autotools builds
 222       CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH.
 223     Documentation:
 224       man: Update a reference as www.cifs.org is gone. [skip ci]
 225       man: Update DNS sections
 226     Solaris:
 227       Fix a compile error with Sun C
 228
 229 Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
 230   Summary for 4.99.0 tcpdump release
 231     CVE-2018-16301: For the -F option handle large input files safely.
 232     Improve the contents, wording and formatting of the man page.
 233     Print unsupported link-layer protocol packets in hex.
 234     Add support for new network protocols and DLTs: Arista, Autosar SOME/IP,
 235       Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand
 236       (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch
 237       Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS,
 238       ZigBee Encapsulation Protocol (ZEP).
 239     Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP,
 240       ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS,
 241       NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD,
 242       VXLAN-GPE.
 243     User interface:
 244       Make SLL2 the default for Linux "any" pseudo-device.
 245       Add --micro and --nano shorthands.
 246       Add --count to print a counter only instead of decoding.
 247       Add --print, to cause packet printing even with -w.
 248       Add support for remote capture if libpcap supports it.
 249       Display the "wireless" flag and connection status.
 250       Flush the output packet buffer on a SIGUSR2.
 251       Add the snapshot length to the "reading from file ..." message.
 252       Fix local time printing (DST offset in timestamps).
 253       Allow -C arguments > 2^31-1 GB if they can fit into a long.
 254       Handle very large -f files by rejecting them.
 255       Report periodic stats only when safe to do so.
 256       Print the number of packets captured only as often as necessary.
 257       With no -s, or with -s 0, don't specify the snapshot length with newer
 258         versions of libpcap.
 259       Improve version and usage message printing.
 260     Building and testing:
 261       Install into bindir, not sbindir.
 262       autoconf: replace --with-system-libpcap with --disable-local-libpcap.
 263       Require the compiler to support C99.
 264       Better detect and use various C compilers and their features.
 265       Add CMake as the second build system.
 266       Make out-of-tree builds more reliable.
 267       Use pkg-config to detect libpcap if available.
 268       Improve Windows support.
 269       Add more tests and improve the scripts that run them.
 270       Test both with "normal" and "x87" floating-point.
 271       Eliminate dependency on libdnet.
 272     FreeBSD:
 273       Print a proper error message about monitor mode VAP.
 274       Use libcasper if available.
 275       Fix failure to capture on RDMA device.
 276       Include the correct capsicum header.
 277     Source code:
 278       Start the transition to longjmp() for packet truncation handling.
 279       Introduce new helper functions, including GET_*(), nd_print_protocol(),
 280         nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others.
 281       Put integer signedness right in many cases.
 282       Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix
 283         alignment issues, especially on SPARC.
 284       Fix many C compiler, Coverity, UBSan and cppcheck warnings.
 285       Fix issues detected with AddressSanitizer.
 286       Remove many workarounds for older compilers and OSes.
 287       Add a sanity check on packet header length.
 288       Add and remove plenty of bounds checks.
 289       Clean up pcap_findalldevs() call to find the first interface.
 290       Use a short timeout, rather than immediate mode, for text output.
 291       Handle DLT_ENC files *not* written on the same OS and byte-order host.
 292       Add, and use, macros to do locale-independent case mapping.
 293       Use a table instead of getprotobynumber().
 294       Get rid of ND_UNALIGNED and ND_TCHECK().
 295       Make roundup2() generally available.
 296       Resync SMI list against Wireshark.
 297       Fix many typos.
 298
 299 Friday, September 20, 2019, by mcr@sandelman.ca
 300   A huge thank you to Denis, Francois-Xavier and Guy who did much of the heavy lifting.
 301   Summary for 4.9.3 tcpdump release
 302     Fix buffer overflow/overread vulnerabilities:
 303       CVE-2017-16808 (AoE)
 304       CVE-2018-14468 (FrameRelay)
 305       CVE-2018-14469 (IKEv1)
 306       CVE-2018-14470 (BABEL)
 307       CVE-2018-14466 (AFS/RX)
 308       CVE-2018-14461 (LDP)
 309       CVE-2018-14462 (ICMP)
 310       CVE-2018-14465 (RSVP)
 311       CVE-2018-14881 (BGP)
 312       CVE-2018-14464 (LMP)
 313       CVE-2018-14463 (VRRP)
 314       CVE-2018-14467 (BGP)
 315       CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
 316       CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)
 317       CVE-2018-14880 (OSPF6)
 318       CVE-2018-16451 (SMB)
 319       CVE-2018-14882 (RPL)
 320       CVE-2018-16227 (802.11)
 321       CVE-2018-16229 (DCCP)
 322       CVE-2018-16230 (BGP)
 323       CVE-2018-16452 (SMB)
 324       CVE-2018-16300 (BGP)
 325       CVE-2018-16228 (HNCP)
 326       CVE-2019-15166 (LMP)
 327       CVE-2019-15167 (VRRP)
 328     Fix for cmdline argument/local issues:
 329       CVE-2018-14879 (tcpdump -V)
 330
 331 Sunday September 3, 2017 denis@ovsienko.info
 332   Summary for 4.9.2 tcpdump release
 333     Do not use getprotobynumber() for protocol name resolution.  Do not do
 334       any protocol name resolution if -n is specified.
 335     Improve errors detection in the test scripts.
 336     Fix a segfault with OpenSSL 1.1 and improve OpenSSL usage.
 337     Clean up IS-IS printing.
 338     Fix buffer overflow vulnerabilities:
 339       CVE-2017-11543 (SLIP)
 340       CVE-2017-13011 (bittok2str_internal)
 341     Fix infinite loop vulnerabilities:
 342       CVE-2017-12989 (RESP)
 343       CVE-2017-12990 (ISAKMP)
 344       CVE-2017-12995 (DNS)
 345       CVE-2017-12997 (LLDP)
 346     Fix buffer over-read vulnerabilities:
 347       CVE-2017-11541 (safeputs)
 348       CVE-2017-11542 (PIMv1)
 349       CVE-2017-12893 (SMB/CIFS)
 350       CVE-2017-12894 (lookup_bytestring)
 351       CVE-2017-12895 (ICMP)
 352       CVE-2017-12896 (ISAKMP)
 353       CVE-2017-12897 (ISO CLNS)
 354       CVE-2017-12898 (NFS)
 355       CVE-2017-12899 (DECnet)
 356       CVE-2017-12900 (tok2strbuf)
 357       CVE-2017-12901 (EIGRP)
 358       CVE-2017-12902 (Zephyr)
 359       CVE-2017-12985 (IPv6)
 360       CVE-2017-12986 (IPv6 routing headers)
 361       CVE-2017-12987 (IEEE 802.11)
 362       CVE-2017-12988 (telnet)
 363       CVE-2017-12991 (BGP)
 364       CVE-2017-12992 (RIPng)
 365       CVE-2017-12993 (Juniper)
 366       CVE-2017-12994 (BGP)
 367       CVE-2017-12996 (PIMv2)
 368       CVE-2017-12998 (ISO IS-IS)
 369       CVE-2017-12999 (ISO IS-IS)
 370       CVE-2017-13000 (IEEE 802.15.4)
 371       CVE-2017-13001 (NFS)
 372       CVE-2017-13002 (AODV)
 373       CVE-2017-13003 (LMP)
 374       CVE-2017-13004 (Juniper)
 375       CVE-2017-13005 (NFS)
 376       CVE-2017-13006 (L2TP)
 377       CVE-2017-13007 (Apple PKTAP)
 378       CVE-2017-13008 (IEEE 802.11)
 379       CVE-2017-13009 (IPv6 mobility)
 380       CVE-2017-13010 (BEEP)
 381       CVE-2017-13012 (ICMP)
 382       CVE-2017-13013 (ARP)
 383       CVE-2017-13014 (White Board)
 384       CVE-2017-13015 (EAP)
 385       CVE-2017-11543 (SLIP)
 386       CVE-2017-13016 (ISO ES-IS)
 387       CVE-2017-13017 (DHCPv6)
 388       CVE-2017-13018 (PGM)
 389       CVE-2017-13019 (PGM)
 390       CVE-2017-13020 (VTP)
 391       CVE-2017-13021 (ICMPv6)
 392       CVE-2017-13022 (IP)
 393       CVE-2017-13023 (IPv6 mobility)
 394       CVE-2017-13024 (IPv6 mobility)
 395       CVE-2017-13025 (IPv6 mobility)
 396       CVE-2017-13026 (ISO IS-IS)
 397       CVE-2017-13027 (LLDP)
 398       CVE-2017-13028 (BOOTP)
 399       CVE-2017-13029 (PPP)
 400       CVE-2017-13030 (PIM)
 401       CVE-2017-13031 (IPv6 fragmentation header)
 402       CVE-2017-13032 (RADIUS)
 403       CVE-2017-13033 (VTP)
 404       CVE-2017-13034 (PGM)
 405       CVE-2017-13035 (ISO IS-IS)
 406       CVE-2017-13036 (OSPFv3)
 407       CVE-2017-13037 (IP)
 408       CVE-2017-13038 (PPP)
 409       CVE-2017-13039 (ISAKMP)
 410       CVE-2017-13040 (MPTCP)
 411       CVE-2017-13041 (ICMPv6)
 412       CVE-2017-13042 (HNCP)
 413       CVE-2017-13043 (BGP)
 414       CVE-2017-13044 (HNCP)
 415       CVE-2017-13045 (VQP)
 416       CVE-2017-13046 (BGP)
 417       CVE-2017-13047 (ISO ES-IS)
 418       CVE-2017-13048 (RSVP)
 419       CVE-2017-13049 (Rx)
 420       CVE-2017-13050 (RPKI-Router)
 421       CVE-2017-13051 (RSVP)
 422       CVE-2017-13052 (CFM)
 423       CVE-2017-13053 (BGP)
 424       CVE-2017-13054 (LLDP)
 425       CVE-2017-13055 (ISO IS-IS)
 426       CVE-2017-13687 (Cisco HDLC)
 427       CVE-2017-13688 (OLSR)
 428       CVE-2017-13689 (IKEv1)
 429       CVE-2017-13690 (IKEv2)
 430       CVE-2017-13725 (IPv6 routing headers)
 431
 432 Sunday July 23, 2017 denis@ovsienko.info
 433   Summary for 4.9.1 tcpdump release
 434     CVE-2017-11108/Fix bounds checking for STP.
 435     Make assorted documentation updates and fix a few typos in tcpdump output.
 436     Fixup -C for file size >2GB (GH #488).
 437     Show AddressSanitizer presence in version output.
 438     Fix a bug in test scripts (exposed in GH #613).
 439     On FreeBSD adjust Capsicum capabilities for netmap.
 440     On Linux fix a use-after-free when the requested interface does not exist.
 441
 442 Wednesday January 18, 2017 devel.fx.lebail@orange.fr
 443   Summary for 4.9.0 tcpdump release
 444     General updates:
 445     Fix some heap overflows found with American Fuzzy Lop by Hanno Boeck and others
 446         (More information in the log with CVE-2016-* and CVE-2017-*)
 447     Change the way protocols print link-layer addresses (Fix heap overflows
 448         in CALM-FAST and GeoNetworking printers)
 449     Pass correct caplen value to ether_print() and some other functions
 450     Fix lookup_nsap() to match what isonsap_string() expects
 451     Clean up relative time stamp printing (Fix an array overflow)
 452     Fix some alignment issues with GCC on Solaris 10 SPARC
 453     Add some ND_TTEST_/ND_TCHECK_ macros to simplify writing bounds checks
 454     Add a fn_printztn() which returns the number of bytes processed
 455     Add nd_init() and nd_cleanup() functions. Improve libsmi support
 456     Add CONTRIBUTING file
 457     Add a summary comment in all printers
 458     Compile with more warning options in devel mode if supported (-Wcast-qual, ...)
 459     Fix some leaks found by Valgrind/Memcheck
 460     Fix a bunch of de-constifications
 461     Squelch some Coverity warnings and some compiler warnings
 462     Update Coverity and Travis-CI setup
 463     Update Visual Studio files
 464
 465     Frontend:
 466     Fix capsicum support to work with zerocopy buffers in bpf
 467     Try opening interfaces by name first, then by name-as-index
 468     Work around pcap_create() failures fetching time stamp type lists
 469     Fix a segmentation fault with 'tcpdump -J'
 470     Improve addrtostr6() bounds checking
 471     Add exit_tcpdump() function
 472     Don't drop CAP_SYS_CHROOT before chrooting
 473     Fixes issue where statistics not reported when -G and -W options used
 474
 475     Updated printers:
 476     802.11: Beginnings of 11ac radiotap support
 477     802.11: Check the Protected bit for management frames
 478     802.11: Do bounds checking on last_presentp before dereferencing it (Fix a heap overflow)
 479     802.11: Fix the radiotap printer to handle the special bits correctly
 480     802.11: If we have the MCS field, it's 11n
 481     802.11: Only print unknown frame type or subtype messages once
 482     802.11: Radiotap dBm values get printed as dB; Update a test output accordingly
 483     802.11: Source and destination addresses were backwards
 484     AH: Add a bounds check
 485     AH: Report to our caller that dissection failed if a bounds check fails
 486     AP1394: Print src > dst, not dst > src
 487     ARP: Don't assume the target hardware address is <= 6 octets long (Fix a heap overflow)
 488     ATALK: Add bounds and length checks (Fix heap overflows)
 489     ATM: Add some bounds checks (Fix a heap overflow)
 490     ATM: Fix an incorrect bounds check
 491     BFD: Update specification from draft to RFC 5880
 492     BFD: Update to print optional authentication field
 493     BGP: Add support for the AIGP attribute (RFC7311)
 494     BGP: Print LARGE_COMMUNITY Path Attribute
 495     BGP: Update BGP numbers from IANA; Print minor values for FSM notification
 496     BOOTP: Add a bounds check
 497     Babel: Add decoder for source-specific extension
 498     CDP: Filter out non-printable characters
 499     CFM: Fixes to match the IEEE standard, additional bounds and length checks
 500     CSLIP: Add more bounds checks (Fix a heap overflow)
 501     ClassicalIPoATM: Add a bounds check on LLC+SNAP header (Fix a heap overflow)
 502     DHCP: Fix MUDURL and TZ options
 503     DHCPv6: Process MUDURL and TZ options
 504     DHCPv6: Update Status Codes with RFCs/IANA names
 505     DNS: Represent the "DNSSEC OK" bit as "DO" instead of "OK". Add a test case
 506     DTP: Improve packet integrity checks
 507     EGP: Fix bounds checks
 508     ESP: Don't use OpenSSL_add_all_algorithms() in OpenSSL 1.1.0 or later
 509     Ethernet: Add some bounds checking before calling isoclns_print (Fix a heap overflow)
 510     Ethernet: Print the Length/Type field as length when needed
 511     FDDI: Fix -e output for FDDI
 512     FR: Add some packet-length checks and improve Q.933 printing (Fix heap overflows)
 513     GRE: Add some bounds checks (Fix heap overflows)
 514     Geneve: Fix error message with invalid option length; Update list option classes
 515     HNCP: Fix incorrect time interval format. Fix handling of IPv4 prefixes
 516     ICMP6: Fetch a 32-bit big-endian quantity with EXTRACT_32BITS()
 517     IGMP: Add a length check
 518     IP: Add a bounds check (Fix a heap overflow)
 519     IP: Check before fetching the protocol version (Fix a heap overflow)
 520     IP: Don't try to dissect if IP version != 4 (Fix a heap overflow)
 521     IP: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 522     IPComp: Check whether we have the CPI before we fetch it (Fix a heap overflow)
 523     IPoFC: Fix -e output (IP-over-Fibre Channel)
 524     IPv6: Don't overwrite the destination IPv6 address for routing headers
 525     IPv6: Fix header printing
 526     IPv6: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 527     ISAKMP: Clean up parsing of IKEv2 Security Associations
 528     ISOCLNS/IS-IS: Add support for Purge Originator Identifier (RFC6232) and test cases
 529     ISOCLNS/IS-IS: Don't overwrite packet data when checking the signature
 530     ISOCLNS/IS-IS: Filter out non-printable characters
 531     ISOCLNS/IS-IS: Fix segmentation faults
 532     ISOCLNS/IS-IS: Have signature_verify() do the copying and clearing
 533     ISOCLNS: Add some bounds checks
 534     Juniper: Make sure a Juniper header TLV isn't bigger than what's left in the packet (Fix a heap overflow)
 535     LLC/SNAP: With -e, print the LLC header before the SNAP header; without it, cut the SNAP header
 536     LLC: Add a bounds check (Fix a heap overflow)
 537     LLC: Clean up printing of LLC packets
 538     LLC: Fix the printing of RFC 948-style IP packets
 539     LLC: Skip the LLC and SNAP headers with -x for 802.11 and some other protocols
 540     LLDP: Implement IANA OUI and LLDP MUD option
 541     MPLS LSP ping: Update printing for RFC 4379, bug fixes, more bounds checks
 542     MPLS: "length" is now the *remaining* packet length
 543     MPLS: Add bounds and length checks (Fix a heap overflow)
 544     NFS: Don't assume the ONC RPC header is nicely aligned
 545     NFS: Don't overflow the Opaque_Handle buffer (Fix a segmentation fault)
 546     NFS: Don't run past the end of an NFSv3 file handle
 547     OLSR: Add a test to cover a HNA sgw case
 548     OLSR: Fix 'Advertised networks' count
 549     OLSR: Fix printing of smart-gateway HNAs in IPv4
 550     OSPF: Add a bounds check for the Hello packet options
 551     OSPF: Do more bounds checking
 552     OSPF: Fix a segmentation fault
 553     OSPF: Fix printing 'ospf_topology_values' default
 554     OTV: Add missing bounds checks
 555     PGM: Print the formatted IP address, not the raw binary address, as a string
 556     PIM: Add some bounds checking (Fix a heap overflow)
 557     PIMv2: Fix checksumming of Register messages
 558     PPP: Add some bounds checks (Fix a heap overflow)
 559     PPP: Report invalid PAP AACK/ANAK packets
 560     Q.933: Add a missing bounds check
 561     RADIUS: Add Value 13 "VLAN" to Tunnel-Type attribute
 562     RADIUS: Filter out non-printable characters
 563     RADIUS: Translate UDP/1700 as RADIUS
 564     RESP: Do better checking of RESP packets
 565     RPKI-RTR: Add a return value check for "fn_printn" call
 566     RPKI-RTR: Remove printing when truncated condition already detected
 567     RPL: Fix 'Consistency Check' control code
 568     RPL: Fix suboption print
 569     RSVP: An INTEGRITY object in a submessage covers only the submessage
 570     RSVP: Fix an infinite loop; Add bounds and length checks
 571     RSVP: Fix some if statements missing brackets
 572     RSVP: Have signature_verify() do the copying and clearing
 573     RTCP: Add some bounds checks
 574     RTP: Add some bounds checks, fix two segmentation faults
 575     SCTP: Do more bounds checking
 576     SFLOW: Fix bounds checking
 577     SLOW: Fix bugs, add checks
 578     SMB: Before fetching the flags2 field, make sure we have it
 579     SMB: Do bounds checks on NBNS resource types and resource data lengths
 580     SNMP: Clean up the "have libsmi but no modules loaded" case
 581     SNMP: Clean up the object abbreviation list and fix the code to match them
 582     SNMP: Do bounds checks when printing character and octet strings
 583     SNMP: Improve ASN.1 bounds checks
 584     SNMP: More bounds and length checks
 585     STP: Add a bunch of bounds checks, and fix some printing (Fix heap overflows)
 586     STP: Filter out non-printable characters
 587     TCP: Add bounds and length checks for packets with TCP option 20
 588     TCP: Correct TCP option Kind value for TCP Auth and add SCPS-TP
 589     TCP: Fix two bounds checks (Fix heap overflows)
 590     TCP: Make sure we have the data offset field before fetching it (Fix a heap overflow)
 591     TCP: Put TCP-AO option decoding right
 592     TFTP: Don't use strchr() to scan packet data (Fix a heap overflow)
 593     Telnet: Add some bounds checks
 594     TokenRing: Fix -e output
 595     UDLD: Fix an infinite loop
 596     UDP: Add a bounds check (Fix a heap overflow)
 597     UDP: Check against the packet length first
 598     VAT: Add some bounds checks
 599     VTP: Add a test on Mgmt Domain Name length
 600     VTP: Add bounds checks and filter out non-printable characters
 601     VXLAN: Add a bound check and a test case
 602     ZeroMQ: Fix an infinite loop
 603
 604 Tuesday October 25, 2016 mcr@sandelman.ca
 605   Summary for 4.8.1 tcpdump release
 606         Fix "-x" for Apple PKTAP and PPI packets
 607         Improve separation frontend/backend (tcpdump/libnetdissect)
 608         Fix display of timestamps with -tt, -ttt and -ttttt options
 609         Add support for the Marvell Extended Distributed Switch Architecture header
 610         Use PRIx64 to print a 64-bit number in hex.
 611         Printer for HNCP (RFCs 7787 and 7788).
 612         dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer.
 613         RSVP: Add bounds and length checks
 614         OSPF: Do more bounds checking
 615         Handle OpenSSL 1.1.x.
 616         Initial support for the REdis Serialization Protocol known as RESP.
 617         Add printing function for Generic Protocol Extension for VXLAN
 618             draft-ietf-nvo3-vxlan-gpe-01
 619         Network Service Header: draft-ietf-sfc-nsh-01
 620         Don't recompile the filter if the new file has the same DLT.
 621         Pass an adjusted struct pcap_pkthdr to the sub-printer.
 622         Add three test cases for already fixed CVEs
 623            CVE-2014-8767: OLSR
 624            CVE-2014-8768: Geonet
 625            CVE-2014-8769: AODV
 626         Don't do the DDP-over-UDP heuristic first: GitHub issue #499.
 627         Use the new debugging routines in libpcap.
 628         Harmonize TCP source or destination ports tests with UDP ones
 629         Introduce data types to use for integral values in packet structures.
 630         RSVP: Fix an infinite loop
 631         Support of Type 3 and Type 4 LISP packets.
 632         Don't require IPv6 library support in order to support IPv6 addresses.
 633         Many many changes to support libnetdissect usage.
 634         Add a test that makes unaligned accesses: GitHub issue #478.
 635         add a DNSSEC test case: GH #445 and GH #467.
 636         BGP: add decoding of ADD-PATH capability
 637         fixes to LLC header printing, and RFC948-style IP packets
 638
 639 Friday April 10, 2015 guy@alum.mit.edu
 640   Summary for 4.7.4 tcpdump release
 641         RPKI to Router Protocol: Fix Segmentation Faults and other problems
 642         RPKI to Router Protocol: print strings with fn_printn()
 643         wb: fix some bounds checks
 644
 645 Wednesday March 11, 2015 mcr@sandelman.ca
 646   Summary for 4.7.3 tcpdump release
 647         Capsicum fixes for FreeBSD 10
 648
 649 Tuesday March 10, 2015 mcr@sandelman.ca
 650   Summary for 4.7.2 tcpdump release
 651         DCCP: update Packet Types with RFC4340/IANA names
 652         fixes for CVE-2015-0261: IPv6 mobility header check issue
 653         fixes for CVE-2015-2153, 2154, 2155: kday packets
 654
 655 Friday Nov. 12, 2014 guy@alum.mit.edu
 656   Summary for 4.7.0 tcpdump release
 657         changes to hex printing of CDP packets
 658         Fix PPI printing
 659         Radius: update Packet Type Codes and Attribute Types with RFC/IANA names
 660         Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support.
 661         improvements to telnet printer, even if not -v
 662         omit length for bcp, print-tcp uses it
 663         formatting fixes for a bunch of protocols
 664         new bounds checks for a number of protocols
 665         split netflow 1,6, and 6 dissector up.
 666         added geneve dissector
 667         CVE-2014-9140 PPP dissector fixed.
 668
 669 Tuesday  Sep.  2, 2014 mcr@sandelman.ca
 670   Summary for 4.6.2 tcpdump release
 671         fix out-of-source-tree builds: find libpcap that is out of source
 672         better configure check for libsmi
 673
 674 Saturday Jul. 19, 2014 mcr@sandelman.ca
 675   Summary for 4.6.1 tcpdump release
 676         added FreeBSD capsicum
 677         add a short option '#', same as long option '--number'
 678
 679 Wednesday Jul. 2, 2014 mcr@sandelman.ca
 680   Summary for 4.6.0 tcpdump release
 681         all of tcpdump is now using the new "NDO" code base (Thanks Denis!)
 682         nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes
 683         M3UA decode added.
 684         many new test cases: 82 in 4.5.1 to 133 in 4.6.0
 685         many improvements to travis continuous integration system: OSX, and Coverity options
 686         cleaned up some unnecessary header files
 687         Added bittok2str().
 688         a number of unaligned access faults fixed
 689         -A flag does not consider CR to be printable anymore
 690         fx.lebail took over coverity baby sitting
 691         default snapshot size increased to 256K for accommodate USB captures
 692         WARNING: this release contains a lot of very worthwhile code churn.
 693
 694 Wednesday Jan. 15, 2014 guy@alum.mit.edu
 695   Summary for 4.5.2 tcpdump release
 696         Man page fix
 697         Fix crashes on SPARC
 698
 699 Monday Nov. 11, 2013 mcr@sandelman.ca
 700   Summary for 4.5.1 tcpdump release
 701         CREDITS file fixes
 702
 703 Thursday Nov. 7, 2013  mcr@sandelman.ca and guy@alum.mit.edu.
 704   Summary for 4.5.0 tcpdump release
 705         some NFSv4 fixes for printing
 706         fix printing of unknown TCP options, and tcp fast-open
 707         fixes for syslog parser
 708         some gcc-version-specific flag tuning
 709         adopt MacOS deprecation workarounds for openssl
 710         improvements to babel printing
 711         add OpenFlow 1.0 (no SSL) and test cases
 712         GeoNet printer.
 713         added STBC Rx support
 714         improvements to DHCPv6 decoder
 715         clarify which autoconf is needed
 716         Point users to the the-tcpdump-group repository on GitHub rather
 717             than the mcr repository
 718         Add MSDP printer.
 719         Fixed IPv6 check on Solaris and other OSes requiring extra
 720             networking libraries.
 721         Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03),
 722             and add "vxlan" as an option for -T.
 723         Add support for OTV (draft-hasmit-otv-04).
 724         fixes for DLT_IEEE802_11_RADIO datalink types
 725         added MPTCP decoder
 726
 727 Saturday April 6, 2013 guy@alum.mit.edu.
 728   Summary for 4.4.0 tcpdump release
 729         RPKI-RTR (RFC6810) is now official (TCP Port 323)
 730         Fix detection of OpenSSL libcrypto.
 731         Add DNSSL (RFC6106) support.
 732         Add "radius" as an option for -T.
 733         Update Action codes for handle_action function according to
 734             802.11s amendment.
 735         Decode DHCPv6 AFTR-Name option (RFC6334).
 736         Updates for Babel.
 737         Fix printing of infinite lifetime in ICMPv6.
 738         Added support for SPB, SPBM Service Identifier, and Unicast
 739             Address sub-TLV in ISIS.
 740         Decode RIPv2 authentication up to RFC4822.
 741         Fix RIP Request/full table decoding issues.
 742         On Linux systems with cap-ng.h, drop root privileges
 743             using Linux Capabilities.
 744         Add support for reading multiple files.
 745         Add MS NLB heartbeat printer.
 746         Separate multiple nexthops in BGP.
 747
 748 Wednesday  November 28, 2012 guy@alum.mit.edu.
 749   Summary for 4.3.1 tcpdump release
 750         Print "LLDP, length N" for LLDP packets even when not in verbose
 751             mode, so something is printed even if only the timestamp is
 752             present
 753         Document "-T carp"
 754         Print NTP poll interval correctly (it's an exponent, so print
 755             both its raw value and 2^value)
 756         Document that "-e" is used to get MAC addresses
 757         More clearly document that you need to escape or quote
 758             backslashes in filter expressions on the command line
 759         Fix some "the the" in the man page
 760         Use the right maximum path length
 761         Don't treat 192_1_2, when passed to -i, as an interface number
 762
 763 Friday  April 3, 2012.  mcr@sandelman.ca.
 764   Summary for 4.3.0 tcpdump release
 765         fixes for forces: SPARSE data (per RFC 5810)
 766         some more test cases added
 767         updates to documentation on -l, -U and -w flags.
 768         Fix printing of BGP optional headers.
 769         Tried to include DLT_PFSYNC support, failed due to headers required.
 770         added TIPC support.
 771         Fix LLDP Network Policy bit definitions.
 772         fixes for IGMPv3's Max Response Time: it is in units of 0.1 second.
 773         SIGUSR1 can be used rather than SIGINFO for stats
 774         permit -n flag to affect print-ip for protocol numbers
 775         ND_OPT_ADVINTERVAL is in milliseconds, not seconds
 776         Teach PPPoE parser about RFC 4638
 777
 778
 779 Friday  December 9, 2011.  guy@alum.mit.edu.
 780   Summary for 4.2.1 tcpdump release
 781         Only build the Babel printer if IPv6 is enabled.
 782         Support Babel on port 6696 as well as 6697.
 783         Include ppi.h in release tarball.
 784         Include all the test files in the release tarball, and don't
 785          "include" test files that no longer exist.
 786         Don't assume we have <rpc/rpc.h> - check for it.
 787         Support "-T carp" as a way of dissecting IP protocol 112 as CARP
 788          rather than VRRP.
 789         Support Hilscher NetAnalyzer link-layer header format.
 790         Constify some pointers and fix compiler warnings.
 791         Get rid of never-true test.
 792         Fix an unintended fall-through in a case statement in the ARP
 793          printer.
 794         Fix several cases where sizeof(sizeof(XXX)) was used when just
 795          sizeof(XXX) was intended.
 796         Make stricter sanity checks in the ES-IS printer.
 797         Get rid of some GCCisms that caused builds to fai with compilers
 798          that don't support them.
 799         Fix typo in man page.
 800         Added length checks to Babel printer.
 801
 802 Sunday  July 24, 2011.  mcr@sandelman.ca.
 803   Summary for 4.2.+
 804         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
 805           at gmail dot com>
 806         updates to forces for new port numbers
 807         Use "-H", not "-h", for the 802.11s option. (-h always help)
 808         Better ICMPv6 checksum handling.
 809         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
 810         get rid of uuencoded pcap test files, git can do binary.
 811         sFlow changes for 64-bit counters.
 812         fixes for PPI packet header handling and printing.
 813         Add DCB Exchange protocol (DCBX) version 1.01.
 814         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
 815         improvements to radiotap for rate values > 127.
 816         Many improvements to ForCES decode, including fix SCTP TML port
 817         updated RPL type code to RPL-17 draft
 818         Improve printout of DHCPv6 options.
 819         added support and test case for QinQ (802.1q VLAN) packets
 820         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
 821         Build fixes for Sparc and other machines with alignment restrictions.
 822         Merged changes from Debian package.
 823         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
 824         Build fixes for OSX (Snow Leopard and others)
 825         Add support for IEEE 802.15.4 packets
 826
 827 Tue.    July 20, 2010.  guy@alum.mit.edu.
 828   Summary for 4.1.2 tcpdump release
 829         If -U is specified, flush the file after creating it, so it's
 830           not zero-length
 831         Fix TCP flags output description, and some typos, in the man
 832           page
 833         Add a -h flag, and only attempt to recognize 802.11s mesh
 834           headers if it's set
 835         When printing the link-layer type list, send *all* output to
 836           stderr
 837         Include the CFLAGS setting when configure was run in the
 838           compiler flags
 839
 840 Thu.    April 1, 2010.  guy@alum.mit.edu.
 841   Summary for 4.1.1 tcpdump release
 842         Fix build on systems with PF, such as FreeBSD and OpenBSD.
 843         Don't blow up if a zero-length link-layer address is passed to
 844           linkaddr_string().
 845
 846 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
 847   Summary for 4.1.0 tcpdump release
 848         Fix printing of MAC addresses for VLAN frames with a length
 849           field
 850         Add some additional bounds checks and use the EXTRACT_ macros
 851           more
 852         Add a -b flag to print the AS number in BGP packets in ASDOT
 853           notation rather than ASPLAIN notation
 854         Add ICMPv6 RFC 5006 support
 855         Decode the access flags in NFS access requests
 856         Handle the new DLT_ for memory-mapped USB captures on Linux
 857         Make the default snapshot (-s) the maximum
 858         Print name of device (when -L is used)
 859         Support for OpenSolaris (and SXCE build 125 and later)
 860         Print new TCP flags
 861         Add support for RPL DIO
 862         Add support for TCP User Timeout (UTO)
 863         Add support for non-standard Ethertypes used by 3com PPPoE gear
 864         Add support for 802.11n and 802.11s
 865         Add support for Transparent Ethernet Bridge ethertype in GRE
 866         Add 4 byte AS support for BGP printer
 867         Add support for the MDT SAFI 66 BG printer
 868         Add basic IPv6 support to print-olsr
 869         Add USB printer
 870         Add printer for ForCES
 871         Handle frames with an FCS
 872         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
 873         Fix TCP sequence number printing
 874         Report 802.2 packets as 802.2 instead of 802.3
 875         Don't include -L/usr/lib in LDFLAGS
 876         On x86_64 Linux, look in lib64 directory too
 877         Lots of code clean ups
 878         Autoconf clean ups
 879         Update testcases to make output changes
 880         Fix compiling with/out smi (--with{,out}-smi)
 881         Fix compiling without IPv6 support (--disable-ipv6)
 882
 883 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
 884         Add support for Bluetooth Sniffing
 885         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
 886         Add support for 802.11 AVS
 887         Add support for SMB over TCP
 888         Add support for 4 byte BGP AS printing
 889         Add support for compiling on case-insensitive file systems
 890         Add support for ikev2 printing
 891         Update support for decoding AFS
 892         Update DHCPv6 printer
 893         Use newer libpcap API's (allows -B option on all platforms)
 894         Add -I to turn on monitor mode
 895         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
 896         Cleanup unused files and various cruft
 897
 898 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
 899         Rework ARP printer
 900         Rework OSPFv3 printer
 901         Add support for Frame-Relay ARP
 902         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
 903         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
 904         TLV: Add support for Juniper .pcap extensions
 905         Print EGP header in new-world-order style
 906         Converted print-isakmp.c to NETDISSECT
 907         Moved AF specific stuff into af.h
 908         Test subsystem now table driven, and saves outputs and diffs to one place
 909         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
 910          libpcap files on an OS other than where the file was generated
 911
 912
 913 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
 914
 915         NFS: Print unsigned values as such.
 916         RX: parse safely.
 917         BGP: fixes for IPv6-less builds.
 918         801.1ag: use standard codepoint.
 919         use /dev/bpf on systems with such a device.
 920         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
 921         smb: make sure that we haven't gone past the end of the captured data.
 922         smb: squelch an uninitialized complaint from coverity.
 923         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 924                 if it got MSG_DENIED.
 925         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 926         revised INSTALL.txt about libpcap dependency.
 927
 928 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 929         Update man page to reflect changes to libpcap
 930         Changes to both TCP and IP Printer Output
 931         Fix a potential buffer overflow in the 802.11 printer
 932         Print basic info about a few more Cisco LAN protocols.
 933         mDNS cleanup
 934         ICMP MPLS rework of the extension code
 935         bugfix: use the correct codepoint for the OSPF simple text auth token
 936          entry, and use safeputs to print the password.
 937         Add support in pflog for additional values
 938         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 939         Add support for the Message-id NACK c-type.
 940         Add support for 802.3ah loopback ctrl msg
 941         Add support for Multiple-STP as per 802.1s
 942         Add support for rapid-SPT as per 802.1w
 943         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 944          Sender-ID tlv, private tlv, port, interface status
 945         Add support for unidirectional link detection as per
 946          https://tools.ietf.org/id/draft-foschiano-udld-02.txt
 947         Add support for the olsr protocol as per RFC 3626 plus the LQ
 948          extensions from olsr.org
 949         Add support for variable-length checksum in DCCP, as per section 9 of
 950          RFC 4340.
 951         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 952         Add support for Multiple-STP as per 802.1s
 953         Add support for the cisco propriatry 'dynamic trunking protocol'
 954         Add support for the cisco proprietary VTP protocol
 955         Update dhcp6 options table as per IETF standardization activities
 956
 957
 958 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 959
 960         Fix compiling on AIX (, at end of ENUM)
 961         Updated list of DNS RR typecodes
 962         Use local Ethernet defs on WIN32
 963         Add support for Frame-Relay ARP
 964         Fixes for compiling under MSVC++
 965         Add support for parsing Juniper .pcap files
 966         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 967         Rework the OSPFv3 printer
 968         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 969         Add support for Cisco style NLPID encapsulation
 970         Add cisco prop. eigrp related, extended communities
 971         Add support for BGP signaled VPLS
 972         Cleanup the bootp printer
 973         Add support for PPP over Frame-Relay
 974         Add some bounds checking to the IP options code, and clean up
 975          the options output a bit.
 976         Add additional modp groups to ISAKMP printer
 977         Add support for Address-Withdraw and Label-Withdraw Msgs
 978         Add support for the BFD Discriminator TLV
 979         Fixes for 64bit compiling
 980         Add support for PIMv2 checksum verification
 981         Add support for further dissection of the IPCP Compression Option
 982         Add support for Cisco's proposed VQP protocol
 983         Add basic support for keyed authentication TCP option
 984         Lots of minor cosmetic changes to output printers
 985
 986
 987 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 988         Decoder support for more Juniper link-layer types
 989         Fix a potential buffer overflow (although it can't occur in
 990                 practice).
 991         Fix the handling of unknown management frame types in the 802.11
 992                 printer.
 993         Add FRF.16 support, fix various Frame Relay bugs.
 994         Add support for RSVP integrity objects, update fast-reroute
 995                 object printer to latest spec.
 996         Clean up documentation of vlan filter expression, document mpls
 997                 filter expression.
 998         Document new pppoed and pppoes filter expressions.
 999         Update diffserver-TE codepoints as per RFC 4124.
1000         Spelling fixes in ICMPv6.
1001         Don't require any fields other than flags to be present in IS-IS
1002                 restart signaling TLVs, and only print the system ID in
1003                 those TLVs as system IDs, not as node IDs.
1004         Support for DCCP.
1005
1006 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
1007
1008         Option to chroot() when dropping privs
1009         Fixes for compiling on nearly every platform,
1010                 including improved 64bit support
1011         Many new testcases
1012         Support for sending packets
1013         Many compilation fixes on most platforms
1014         Fixes for recent version of GCC to eliminate warnings
1015         Improved Unicode support
1016
1017         Decoders & DLT Changes, Updates and New:
1018                 AES ESP support
1019                 Juniper ATM, FRF.15, FRF.16, PPPoE,
1020                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
1021                         GGSN,ES,MONITOR,SERVICES
1022                 L2VPN
1023                 Axent Raptor/Symantec Firewall
1024                 TCP-MD5 (RFC 2385)
1025                 ESP-in-UDP (RFC 3948)
1026                 ATM OAM
1027                 LMP, LMP Service Discovery
1028                 IP over FC
1029                 IP over IEEE 1394
1030                 BACnet MS/TP
1031                 SS7
1032                 LDP over TCP
1033                 LACP, MARKER as per 802.3ad
1034                 PGM (RFC 3208)
1035                 LSP-PING
1036                 G.7041/Y.1303 Generic Framing Procedure
1037                 EIGRP-IP, EIGRP-IPX
1038                 ICMP6
1039                 Radio - via radiotap
1040                 DHCPv6
1041                 HDLC over PPP
1042
1043 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
1044
1045         No changes from 3.8.2. Version bumped only to maintain consistency
1046         with libpcap 0.8.3.
1047
1048 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
1049
1050         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
1051         https://web.archive.org/web/20160328035955/https://www.rapid7.com/resources/advisories/R7-0017.jsp
1052         IP-over-IEEE1394 printing.
1053         some MINGW32 changes.
1054         updates for autoconf 2.5
1055         fixes for print-aodv.c - check for too short packets
1056         formatting changes to print-ascii for hex output.
1057         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
1058                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
1059                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
1060                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
1061         print-ether.c - better handling of unknown types.
1062         print-isoclns.c - additional decoding of types.
1063         print-llc.c - strings for LLC names added.
1064         print-pfloc.c - various enhancements
1065         print-radius.c - better decoding to strings.
1066
1067 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
1068
1069         changed syntax of -E argument so that multiple SAs can be decrypted
1070         fixes for Digital Unix headers and Documentation
1071         __attribute__ fixes
1072         CDP changes from Terry Kennedy <terry@tmk.com>.
1073         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
1074         Fixes for ASN.1 decoder for 2.100.3 forms.
1075         Added a count of packets received and processed to clarify numbers.
1076         Incorporated WinDUMP patches for Win32 builds.
1077         PPPoE payload length headers.
1078         Fixes for HP C compiler builds.
1079         Use new pcap_breakloop() and pcap_findalldevs() if we can.
1080         BGP output split into multiple lines.
1081         Fixes to 802.11 decoding.
1082         Fixes to PIM decoder.
1083         SuperH is a CPU that can't handle unaligned access. Many fixes for
1084                 unaligned access work.
1085         Fixes to Frame-Relay decoder for Q.933/922 frames.
1086         Clarified when Solaris can do captures as non-root.
1087         Added tests/ subdir for examples/regression tests.
1088         New -U flag.    -flush stdout after every packet
1089         New -A flag     -print ascii only
1090         support for decoding IS-IS inside Cisco HDLC Frames
1091         more verbosity for tftp decoder
1092         mDNS decoder
1093         new BFD decoder
1094         cross compilation patches
1095         RFC 3561 AODV support.
1096         UDP/TCP pseudo-checksum properly for source-route options.
1097         sanitized all files to modified BSD license
1098         Add support for RFC 2625 IP-over-Fibre Channel.
1099         fixes for DECnet support.
1100         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
1101         RFC 2684 encapsulation of BPDUs.
1102
1103 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
1104
1105         Fixed infinite loop when parsing invalid isakmp packets.
1106          (reported by iDefense; already fixed in CVS)
1107         Fixed infinite loop when parsing invalid BGP packets.
1108         Fixed buffer overflow with certain invalid NFS packets.
1109         Pretty-print unprintable network names in 802.11 printer.
1110         Handle truncated nbp (appletalk) packets.
1111         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
1112         Print IP protocol name even if we don't have a printer for it.
1113         Print IP protocol name or number for fragments.
1114         Print the whole MPLS label stack, not just the top label.
1115         Print request header and file handle for NFS v3 FSINFO and PATHCONF
1116          requests.
1117         Fix NFS packet truncation checks.
1118         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
1119         Handle unknown RADIUS attributes properly.
1120         Fix an ASN.1 parsing error that would cause e.g. the OID
1121          2.100.3 to be misrepresented as 4.20.3 .
1122
1123 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
1124         keyword "ipx" added.
1125         Better OSI/802.2 support on Linux.
1126         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
1127         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
1128         BXXP protocol was replaced by the BEEP protocol;
1129         improvements to SNAP demux.
1130         Changes to "any" interface documentation.
1131         Documentation on pcap_stats() counters.
1132         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
1133         Added MPLS encapsulation decoding per RFC3032.
1134         DNS dissector handles TKEY, TSIG and IXFR.
1135         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
1136         SMB printing has much improved bounds checks
1137         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
1138         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
1139         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
1140         IPX socket 0x85be is for Cisco EIGRP over IPX.
1141         Improvements to fragmented ESP handling.
1142         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
1143         Linux ARPHDR_ATM support fixed.
1144         Added a "netbeui" keyword, which selects NetBEUI packets.
1145         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
1146         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
1147         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
1148         Better Linux libc5 compat.
1149         BIND9 lwres dissector added.
1150         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
1151         Apple LocalTalk LINKTYPE_ reserved.
1152         New time stamp formats documented.
1153         DHCP6 updated to draft-22.txt spec.
1154         ICMP types/codes now accept symbolic names.
1155         Add SIGINFO handler from LBL
1156         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
1157         now we are -Wstrict-prototype clean.
1158         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
1159         PPPoE dissector cleaned up.
1160         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
1161         In dissector, now the caller prints the IP addresses rather than proto.
1162         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
1163         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
1164         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
1165         captures on the "any" device won't be done in promiscuous mode
1166         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
1167         ARCNet support, from NetBSD.
1168         HSRP dissector, from Julian Cowley <julian@lava.net>.
1169         Handle (GRE-encapsulated) PPTP
1170         added -C option to rotate save file every optarg * 1,000,000 bytes.
1171         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
1172         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
1173         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
1174         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
1175         ESP printing updated to RFC2406.
1176         HP-UX can now handle large number of PPAs.
1177         MSDP printer added.
1178         L2TP dissector improvements from Motonori Shindo.
1179
1180 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
1181         Cleaned up documentation.
1182         Promisc mode fixes for Linux
1183         IPsec changes/cleanups.
1184         Alignment fixes for picky architectures
1185
1186         Removed dependency on native headers for packet dissectors.
1187         Removed Linux specific headers that were shipped
1188
1189         libpcap changes provide for exchanging capture files between
1190           systems. Save files now have well known PACKET_ values instead of
1191           depending upon system dependent mappings of DLT_* types.
1192
1193         Support for computing/checking IP and UDP/TCP checksums.
1194
1195         Updated autoconf stock files.
1196
1197         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
1198
1199         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
1200                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
1201
1202         Added filtering support for: VLANs, ESIS, ISIS
1203
1204         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
1205                 L2TP, PPPoE
1206
1207         HP-UX 11.0 -- find the right dlpi device.
1208         Solaris 8 - IPv6 works
1209         Linux - Added support for an "any" device to capture on all interfaces
1210
1211         Security fixes: buffer overrun audit done. Strcpy replaced with
1212                 strlcpy, sprintf replaced with snprintf.
1213         Look for lex problems, and warn about them.
1214
1215
1216 v3.5 Fri Jan 28 18:00:00 PST 2000
1217
1218 Bill Fenner <fenner@research.att.com>
1219 - switch to config.h for autoconf
1220 - unify RCSID strings
1221 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
1222 - Really fix the RIP printer
1223 - Fix MAC address -> name translation.
1224 - some -Wall -Wformat fixes
1225 - update makemib to parse much of SMIv2
1226 - Print TCP sequence # with -vv even if you normally wouldn't
1227 - Print as much of IP/TCP/UDP headers as possible even if truncated.
1228
1229 itojun@iijlab.net
1230 - -X will make a ascii dump.  from netbsd.
1231 - telnet command sequence decoder (ff xx xx).  from netbsd.
1232 - print-bgp.c: improve options printing.  ugly code exists for
1233   unaligned option parsing (need some fix).
1234 - const poisoning in SMB decoder.
1235 - -Wall -Werror clean checks.
1236 - bring in KAME IPv6/IPsec decoding code.
1237
1238 Assar Westerlund  <assar@sics.se>
1239 - SNMPv2 and SNMPv3 printer
1240 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
1241   SNMP packets.
1242 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
1243 - portability fixes
1244 - permit building in different directories.
1245
1246 Ken Hornstein <kenh@cmf.nrl.navy.mil>
1247 - bring in code at
1248   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
1249   AFS3 packets
1250
1251 Andrew Tridgell <tridge@linuxcare.com>
1252 - SMB printing code
1253
1254 Love <lha@stacken.kth.se>
1255 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
1256   change date format to the right one.
1257
1258 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
1259 - Created tcpdump.org repository
1260
1261 v3.4 Sat Jul 25 12:40:55 PDT 1998
1262
1263 - Hardwire Linux slip support since it's too hard to detect.
1264
1265 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
1266   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
1267
1268 - Added -a which tries to translate network and broadcast addresses to
1269   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
1270
1271 - Added a configure option to disable gcc.
1272
1273 - Added a "raw" packet printer.
1274
1275 - Not having an interface address is no longer fatal. Requested by John
1276   Hawkinson.
1277
1278 - Rework signal setup to accommodate Linux.
1279
1280 - OSPF truncation check fix. Also display the type of OSPF packets
1281   using MD5 authentication. Thanks to Brian Wellington
1282   (bwelling@tis.com)
1283
1284 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
1285   Peisach (epeisach@mit.edu)
1286
1287 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
1288   (plonka@mfa.com)
1289
1290 - Specify full install target as a way of detecting if install
1291   directory does not exist. Thanks to Dave Plonka.
1292
1293 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
1294   (paul@vix.com)
1295
1296 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
1297   Marty Leisner (leisner@sdsp.mc.xerox.com)
1298
1299 - Add a local autoconf macro to check for routines in libraries; the
1300   autoconf version is broken (it only puts the library name in the
1301   cache variable name). Thanks to John Hawkinson.
1302
1303 - Add a local autoconf macro to check for types; the autoconf version
1304   is broken (it uses grep instead of actually compiling a code fragment).
1305
1306 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
1307   formats.
1308
1309 - Extend OSF ip header workaround to versions 1 and 2.
1310
1311 - Fix some signed problems in the nfs printer. As reported by David
1312   Sacerdote (davids@silence.secnet.com)
1313
1314 - Detect group wheel and use it as the default since BSD/OS' install
1315   can't hack numeric groups. Reported by David Sacerdote.
1316
1317 - AIX needs special loader options. Thanks to Jonathan I. Kamens
1318   (jik@cam.ov.com)
1319
1320 - Fixed the nfs printer to print port numbers in decimal. Thanks to
1321   Kent Vander Velden (graphix@iastate.edu)
1322
1323 - Find installed libpcap in /usr/local/lib when not using gcc.
1324
1325 - Disallow network masks with non-network bits set.
1326
1327 - Attempt to detect "egcs" versions of gcc.
1328
1329 - Add missing closing double quotes when displaying bootp strings.
1330   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
1331
1332 v3.3 Sat Nov 30 20:56:27 PST 1996
1333
1334 - Added Linux support.
1335
1336 - GRE encapsulated packet printer thanks to John Hawkinson
1337   (jhawk@mit.edu)
1338
1339 - Rewrite gmt2local() to avoid problematic os dependencies.
1340
1341 - Suppress nfs truncation message on errors.
1342
1343 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
1344   Reported by Joachim Ott (ott@ardala.han.de)
1345
1346 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
1347
1348 - Print arp hardware type in host order. Thanks to Onno van der Linden
1349   (onno@simplex.nl)
1350
1351 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
1352   (barnett@grymoire.crd.ge.com)
1353
1354 - Fix rip printer to not print one more route than is actually in the
1355   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
1356   Bill Fenner (fenner@parc.xerox.com)
1357
1358 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
1359
1360 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
1361   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
1362
1363 - Rewrite ospf printer to improve truncation checks.
1364
1365 - Don't parse tcp options past the EOL. As noted by David Sacerdote
1366   (davids@secnet.com). Also, check tcp options to make sure they ar
1367   actually in the tcp header (in addition to the normal truncation
1368   checks). Fix the SACK code to print the N blocks (instead of the
1369   first block N times).
1370
1371 - Don't say really small UDP packets are truncated just because they
1372   aren't big enough to be a RPC. As noted by David Sacerdote.
1373
1374 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
1375
1376 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
1377   (martin@msp.se)
1378
1379 - Print mtu for icmp unreach need frag packets. Thanks to John
1380   Hawkinson (jhawk@mit.edu)
1381
1382 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
1383   (jch@bsdi.com)
1384
1385 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
1386   (kushida@trl.ibm.co.jp)
1387
1388 - Check igmp checksum if possible. Thanks to John Hawkinson.
1389
1390 - Made changes for SINIX. Thanks to Andrej Borsenkow
1391   (borsenkow.msk@sni.de)
1392
1393 - Use autoconf's idea of the top level directory in install targets.
1394   Thanks to John Hawkinson.
1395
1396 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
1397   Mogul (mogul@pa.dec.com)
1398
1399 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
1400   Thanks to John Hawkinson.
1401
1402 - Added some more packet truncation checks.
1403
1404 - On systems that have it, use sigset() instead of signal() since
1405   signal() has different semantics on these systems.
1406
1407 - Fixed some more alignment problems on the alpha.
1408
1409 - Add code to massage unprintable characters in the domain and ipx
1410   printers. Thanks to John Hawkinson.
1411
1412 - Added explicit netmask support. Thanks to Steve Nuchia
1413   (steve@research.oknet.com)
1414
1415 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
1416   Kennedy (terry@spcvxa.spc.edu)
1417
1418 - Add "atalk" keyword as suggested by John Hawkinson.
1419
1420 - Added an igrp printer. Thanks to Francis Dupont
1421   (francis.dupont@inria.fr)
1422
1423 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
1424   Kennedy (terry@spcvxa.spc.edu)
1425
1426 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
1427   (pascal.hennequin@hugo.int-evry.fr)
1428
1429 - Added some ETHERTYPEs missing on some systems.
1430
1431 - Added truncated packet macros and various checks.
1432
1433 - Fixed endian problems with the DECnet printer.
1434
1435 - Use $CC when checking gcc version. Thanks to Carl Lindberg
1436   (carl_lindberg@blacksmith.com)
1437
1438 - Fixes for AIX (although this system is not yet supported). Thanks to
1439   John Hawkinson.
1440
1441 - Fix bugs in the autoconf misaligned accesses code fragment.
1442
1443 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
1444   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
1445
1446 v3.2 Sun Jun 23 02:28:10 PDT 1996
1447
1448 - Print new icmp unreachable codes as suggested by Martin Fredriksson
1449   (martin@msp.se). Also print code value when unknown for icmp redirect
1450   and time exceeded.
1451
1452 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
1453
1454 - Define "new" domain record types if not found in arpa/nameserv.h.
1455   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
1456   fixed an endian bug when printing mx record and added some new record
1457   types.
1458
1459 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
1460
1461 - Added T/TCP options printing. As suggested by Richard Stevens
1462   (rstevens@noao.edu)
1463
1464 - Use autoconf to detect architectures that can't handle misaligned
1465   accesses.
1466
1467 v3.1 Thu Jun 13 20:59:32 PDT 1996
1468
1469 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
1470   and bind (as suggested by Charles Hannum).
1471
1472 - Port to GNU autoconf.
1473
1474 - Add support for printing DVMRP and PIM traffic thanks to
1475   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
1476
1477 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
1478   define being referenced. Reported by Terry Kennedy.
1479
1480 - Minor fixes to the man page thanks to Mark Andrews.
1481
1482 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
1483   (bmah@cs.berkeley.edu).
1484
1485 - Added support for new dns types, thanks to Rainer Orth.
1486
1487 - Fixed tftp_print() to print the block number for ACKs.
1488
1489 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
1490   (cslater@imatek.com).
1491
1492 - Check return status from malloc/calloc/etc.
1493
1494 - Check return status from pcap_loop() so we can print an error and
1495   exit with a bad status if there were problems.
1496
1497 - Bail if ip option length is <= 0. Resulted from a bug report from
1498   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
1499
1500 - Print out a little more information for sun rpc packets.
1501
1502 - Add support for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
1503
1504 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
1505   wrong on little endian machines).
1506
1507 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
1508   (crawdad@fnal.gov).
1509
1510 - Fix ntp_print() to not print garbage when the stratum is
1511   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
1512
1513 - Rewrote tcp options printer code to check for truncation. Added
1514   selective acknowledgment case.
1515
1516 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
1517   (jch@bsdi.com)
1518
1519 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
1520   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
1521   (toku@dit.co.jp)
1522
1523 - Don't checksum ip header if we don't have all of it. Thanks to John
1524   Hawkinson (jhawk@mit.edu).
1525
1526 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
1527   Honig (jhc@bsdi.com)
1528
1529
1530 v3.1a1 Wed May  3 19:21:11 PDT 1995
1531
1532 - Include time.h when SVR4 is defined to avoid problems under Solaris
1533   2.3.
1534
1535 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
1536   strings, not the local buffer. Thanks to Stefan Petri
1537   (petri@ibr.cs.tu-bs.de).
1538
1539 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
1540   that the selected value was not used. Thanks to Pascal Hennequin
1541   (Pascal.Hennequin@hugo.int-evry.fr).
1542
1543 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
1544
1545 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
1546
1547 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
1548
1549 - Although there never was a 3.0.3 release, the linux boys cleverly
1550   "released" one in late 1995.
1551
1552 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
1553
1554 - Change configuration to not use gcc v2 flags with gcc v1.
1555
1556 - Redo gmt2local() so that it works under BSDI (which seems to return
1557   an empty timezone struct from gettimeofday()). Based on report from
1558   Terry Kennedy (terry@spcvxa.spc.edu).
1559
1560 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
1561   on report from Mark Andrews (mandrews@alias.com).
1562
1563 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
1564   Orth (ro@techfak.uni-bielefeld.de).
1565
1566 - Fixed printout of connection id for uncompressed tcp slip packets.
1567   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
1568
1569 - Hack around deficiency in Ultrix's make.
1570
1571 - Add ETHERTYPE_TRAIL define which is missing from irix5.
1572
1573 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
1574
1575 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
1576
1577 v3.0 Mon Jun 20 19:23:27 PDT 1994
1578
1579 - Added support for printing tcp option timestamps thanks to
1580   Mark Andrews (mandrews@alias.com).
1581
1582 - Reorganize protocol dumpers to take const pointers to packets so they
1583   never change the contents (i.e., they used to do endian conversions
1584   in place).  Previously, whenever more than one pass was taken over
1585   the packet, the packet contents would be dumped incorrectly (i.e.,
1586   the output form -x would be wrong on little endian machines because
1587   the protocol dumpers would modify the data).  Thanks to Charles Hannum
1588   (mycroft@gnu.ai.mit.edu) for reporting this problem.
1589
1590 - Added support for decnet protocol dumping thanks to Jeff Mogul
1591   (mogul@pa.dec.com).
1592
1593 - Fix bug that caused length of packet to be incorrectly printed
1594   (off by ether header size) for unknown ethernet types thanks
1595   to Greg Miller (gmiller@kayak.mitre.org).
1596
1597 - Added support for IPX protocol dumping thanks to Brad Parker
1598   (brad@fcr.com).
1599
1600 - Added check to verify IP header checksum under -v thanks to
1601   Brad Parker (brad@fcr.com).
1602
1603 - Move packet capture code to new libpcap library (which is
1604   packaged separately).
1605
1606 - Prototype everything and assume an ansi compiler.
1607
1608 - print-arp.c: Print hardware ethernet addresses if they're not
1609   what we expect.
1610
1611 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
1612   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
1613
1614 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
1615   (mogul@pa.dec.com).
1616
1617 - print-icmp.c: Byte swap netmask before printing. Thanks to
1618   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
1619
1620 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
1621   By default, only the inner packet is dumped, appended with the token
1622   "(encap)".  Under -v, both the inner and output packets are dumped
1623   (on the same line).  Note that the filter applies to the original packet,
1624   not the encapsulated packet.  So if you run tcpdump on a net with an
1625   IP Multicast tunnel, you cannot filter out the datagrams using the
1626   conventional syntax.  (You can filter away all the ip-in-ip traffic
1627   with "not ip proto 4".)
1628
1629 - print-nfs.c: Keep pending rpc's in circular table. Add generic
1630   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
1631
1632 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
1633
1634 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
1635   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
1636   Add && and || operators
1637
1638 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
1639
1640 - Fix bug with -c flag.
1641
1642 v2.2 Fri May 22 17:19:41 PDT 1992
1643
1644 - savefile.c: Remove hack that shouldn't have been exported. Add
1645   truncate checks.
1646
1647 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
1648   matches non-echo/reply ICMP packets.
1649
1650 - Many improvements to filter code optimizer.
1651
1652 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
1653   so that protocol qualifications are allowed. For example, "ip broadcast"
1654   and "ether multicast" are valid filters.
1655
1656 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
1657   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
1658   patches to netinet/if_loop.c.
1659
1660 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
1661   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
1662
1663 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
1664
1665 v2.1 Tue Jan 28 11:00:14 PST 1992
1666
1667 - Internal release (never publicly exported).
1668
1669 v2.0.1 Sun Jan 26 21:10:10 PDT
1670
1671 - Various byte ordering fixes.
1672
1673 - Add truncation checks.
1674
1675 - inet.c: Support BSD style SIOCGIFCONF.
1676
1677 - nametoaddr.c: Handle multi addresses for single host.
1678
1679 - optimize.c: Rewritten.
1680
1681 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
1682   for broadcast nets.
1683
1684 - print-atal.c: Fix an alignment bug (thanks to
1685   stanonik@nprdc.navy.mil) Add missing printf() argument.
1686
1687 - print-bootp.c: First attempt at decoding the vendor buffer.
1688
1689 - print-domain.c: Fix truncation checks.
1690
1691 - print-icmp.c: Calculate length of packets from the ip header.
1692
1693 - print-ip.c: Print frag id in decimal (so it's easier to match up
1694   with non-frags). Add support for ospf, egp and igmp.
1695
1696 - print-nfs.c: Lots of changes.
1697
1698 - print-ntp.c: Make some verbose output depend on -v.
1699
1700 - print-snmp.c: New version from John LoVerso.
1701
1702 - print-tcp.c: Print rfc1072 tcp options.
1703
1704 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
1705   (microseconds) worth of precision. Fix uid bugs.
1706
1707 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
1708   With this option, you can create an architecture independent binary
1709   trace file in real time, without the overhead of the packet printer.
1710   At a later time, the packets can be filtered (again) and printed.
1711
1712 - BSD is supported.  You must have BPF in your kernel.
1713   Since the filtering is now done in the kernel, fewer packets are
1714   dropped.  In fact, with BPF and the packet dumper option, a measly
1715   Sun 3/50 can keep up with a busy network.
1716
1717 - Compressed SLIP packets can now be dumped, provided you use our
1718   SLIP software and BPF.  These packets are dumped as any other IP
1719   packet; the compressed headers are dumped with the '-e' option.
1720
1721 - Machines with little-endian byte ordering are supported (thanks to
1722   Jeff Mogul).
1723
1724 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
1725
1726 - IBM RT and Stanford Enetfilter support has been added by
1727   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
1728   both the vanilla Enetfilter interface, and the extended interface
1729   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
1730
1731 - TFTP packets are now printed (requests only).
1732
1733 - BOOTP packets are now printed.
1734
1735 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
1736
1737 - Sparc architectures, including the Sparcstation-1, are now
1738   supported thanks to Steve McCanne and Craig Leres.
1739
1740 - SunOS 4 is now supported thanks to Micky Liu of Columbia
1741   University (micky@cunixc.cc.columbia.edu).
1742
1743 - IP options are now printed.
1744
1745 - RIP packets are now printed.
1746
1747 - There's a -v flag that prints out more information than the
1748   default (e.g., it will enable printing of IP ttl, tos and id)
1749   and -q flag that prints out less (e.g., it will disable
1750   interpretation of AppleTalk-in-UDP).
1751
1752 - The grammar has undergone substantial changes (if you have an
1753   earlier version of tcpdump, you should re-read the manual
1754   entry).
1755
1756   The most useful change is the addition of an expression
1757   syntax that lets you filter on arbitrary fields or values in the
1758   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
1759   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
1760   packets.
1761
1762   The most painful change is that concatenation no longer means
1763   "and" -- e.g., you have to say "host foo and port bar" instead
1764   of "host foo port bar".  The up side to this down is that
1765   repeated qualifiers can be omitted, making most filter
1766   expressions shorter.  E.g., you can now say "ip host foo and
1767   (bar or baz)" to look at ip traffic between hosts foo and bar or
1768   between hosts foo and baz.  [The old way of saying this was "ip
1769   host foo and (ip host bar or ip host baz)".]
1770
1771 v2.0 Sun Jan 13 12:20:40 PST 1991
1772
1773 - Initial public release.