The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
   2   Summary for 4.99.6 tcpdump release (so far!)
   3     Refine protocol decoding for:
   4       IPv6: Add a missing comma and remove a colon in the output.
   5       TCP: Note if the Urgent Pointer is non-zero while URG flag not set,
   6            if the verbose level is > 1 (option -vv and more).
   7       TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set,
   8            if the verbose level is > 1 (option -vv and more).
   9
  10 Friday, August 30, 2024 / The Tcpdump Group
  11   Summary for 4.99.5 tcpdump release
  12     Refine protocol decoding for:
  13       Arista: Use the test .pcap file from pull request #955 (HwInfo).
  14       BGP: Fix an undefined behavior when it tries to parse a too-short packet.
  15       CARP: Print the protocol name before any GET_().
  16       CDP: only hex-dump unknown TLVs in verbose mode.
  17       DHCP: parse the SZTP redirect tag.
  18       DHCPv6: client-id/server-id DUID type 2 correction; parse the user class,
  19         boot file URL, and SZTP redirect options; add DUID-UUID printing
  20         (RFC6355).
  21       DNS: Detect and correctly handle too-short URI RRs.
  22       EAP: Assign ndo_protocol in the eap_print() function.
  23       ESP: Don't use EVP_add_cipher_alias() (fixes building on OpenBSD 7.5).
  24       Frame Relay (Multilink): Fix the Timestamp Information Element printing.
  25       ICMPv6: Fix printing the Home Agent Address Discovery Reply Message.
  26       IEEE 802.11: no need for an element ID in the structures for IEs, make
  27         the length in the IE structures a u_int, include the "TA" field while
  28         printing Block Ack Control frame.
  29       IP: Enable TSO (TCP Segmentation Offload) support; fix printing invalid
  30         cases as invalid, not truncated; use ND_ICHECKMSG_ZU() to test the
  31         header length.
  32       IPv6: Fix printing invalid cases as invalid, not truncated; use
  33         ND_ICHECKMSG_U() to print an invalid version.
  34       IPv6: Fix invalid 32-bit versus 64-bit printouts of fragment headers.
  35       ISAKMP: Fix printing Delete payload SPI when size is zero.
  36       Kerberos: Print the protocol name, remove a redundant bounds check.
  37       lwres: Fix an undefined behavior in pointer arithmetic.
  38       OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of
  39           some lengths, and fix handling of snapend.
  40       TCP: Test ports < 1024 in port order to select the printer.
  41       UDP: Move source port equal BCM_LI_PORT to bottom of long if else chain.
  42       UDP: Test ports < 1024 in port order to select the printer.
  43       LDP: Add missing fields of the Common Session Parameters TLV and fix the
  44         offset for the A&D bits.
  45       NFLOG: Use correct AF code points on all OSes.
  46       NFS: Avoid printing non-ASCII characters.
  47       OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes.
  48       OSPF: Update LS-Ack printing not to run off the end of the packet.
  49       OSPF6: Fix an undefined behavior.
  50       pflog: use nd_ types in struct pfloghdr.
  51       PPP: Check if there is some data to hexdump.
  52       PPP: Remove an extra colon before LCP Callback Operation.
  53       Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397;
  54         Note: This problem does not affect any tcpdump release.
  55       PTP: Fix spelling of type SIGNALING, Parse major and minor version
  56         correctly, Print majorSdoId field instead of just the first bit.
  57       RIP: Make a couple trivial protocol updates.
  58       RPKI-Router: Refine length and bounds checks.
  59       RX: Use the "%Y-%m-%d" date format.
  60       smbutil.c: Use the "%Y-%m-%d" date format.
  61       SNMP: Fix two undefined behaviors.
  62       Text protocols: Fix printing truncation if it is not the case.
  63       ZEP: Use the "%Y-%m-%d" date format.
  64       ZMTP: Replace custom code with bittok2str().
  65     User interface:
  66       Print the supported time stamp types (-J) to stdout instead of stderr.
  67       Print the list of data link types (-L) to stdout instead of stderr.
  68       Use symmetrical quotation characters in error messages.
  69       Update --version option to print 32/64-bit build and time_t size.
  70       Improve error messages for invalid interface indexes specified
  71         with -i.
  72       Support "3des" as an alias for "des_ede3_cbc" even if the crypto
  73         library doesn't support adding aliases.
  74     Source code:
  75       tcpdump: Fix a memory leak.
  76       child_cleanup: reap as many child processes as possible.
  77       Ignore failures when setting the default "any" device DLL to LINUX_SLL2.
  78       Fix for backends which doesn't support capsicum.
  79       Update ND_BYTES_BETWEEN() macro for better accuracy.
  80       Update ND_BYTES_AVAILABLE_AFTER() macro for better accuracy.
  81       Introduce new ND_ICHECK*() macros to deduplicate more code.
  82       Skip privilege dropping when using -Z root on --with-user builds.
  83       Add a nd_printjn() function.
  84       Make nd_trunc_longjmp() not static inline.
  85       Include <time.h> from netdissect.h.
  86       Remove init_crc10_table() and the entourage.
  87       Initialize tzcode early.
  88       Capsicum support: Fix a 'not defined' macro error.
  89       Update the "Error converting time" tests for packet times.
  90       Fix warnings when building for 32-bit and defining _TIME_BITS=64.
  91       Free interface list just before exiting where it wasn't being
  92         freed.
  93     Building and testing:
  94       Add a configure option to help debugging (--enable-instrument-functions).
  95       At build time require a proof of suitable snprintf(3) implementation in
  96         libc (and document Solaris 9 as unsupported because of that).
  97       Makefile.in: Add two "touch .devel" commands in the releasecheck target.
  98       Autoconf: Get --with-user and --with-chroot right.
  99       Autoconf: Fix --static-pcap-only test on Solaris 10.
 100       Autoconf: Add some warning flags for clang 13 or newer.
 101       Autoconf: Update config.{guess,sub}, timestamps 2024-01-01.
 102       Autoconf: Add autogen.sh, remove configure and config.h.in and put
 103         these generated files in the release tarball.
 104       Autoconf: Update the install-sh script to the 2020-11-14.01 version.
 105       configure: Apply autoupdate 2.69.
 106       CMake: improve the comment before project(tcpdump C).
 107       Do not require vsnprintf().
 108       tests: Use the -tttt option, by default, for the tests.
 109       Autoconf, CMake: Get the size of a void * and a time_t.
 110       Fix propagation of cc_werr_cflags() output.
 111       Makefile.in: Fix the depend target.
 112       mkdep: Exit with a non-zero status if a command fails.
 113       Autoconf: use V_INCLS to update the list of include search paths.
 114       Autoconf: don't put anything before -I and -L flags for local libpcap.
 115       Autoconf, CMake: work around an Xcode 15+ issue.
 116       Autoconf, CMake: use pkg-config and Homebrew when looking for
 117         libcrypto.
 118       Fix Sun C invocation from CMake.
 119       mkdep: Use TMPDIR if it is set and not null.
 120       Add initial support for building with TinyCC.
 121       Makefile.in: Use the variable MAKE instead of the make command.
 122       Makefile.in: Add instrumentation configuration in releasecheck target.
 123       Make various improvements to the TESTrun script.
 124       Untangle detection of pcap_findalldevs().
 125       Autoconf: don't use egrep, use $EGREP.
 126       Autoconf: check for gethostbyaddr(), not gethostbyname().
 127       Autoconf, CMake: search for gethostbyaddr() in libnetwork.
 128       Make illumos build warning-free.
 129     Documentation:
 130       Fixed errors in doc/README.Win32.md and renamed it to README.windows.md.
 131       Make various improvements to the man page.
 132       Add initial README file for Haiku.
 133       Make various improvements to CONTRIBUTING.md.
 134
 135 Friday, April 7, 2023 / The Tcpdump Group
 136   Summary for 4.99.4 tcpdump release
 137     Source code:
 138       Fix spaces before tabs in indentation.
 139     Updated printers:
 140       LSP ping: Fix "Unused value" warnings from Coverity.
 141       CVE-2023-1801: Fix an out-of-bounds write in the SMB printer.
 142       DNS: sync resource types with IANA.
 143       ICMPv6: Update the output to show a RPL DAO field name.
 144       Geneve: Fix the Geneve UDP port test.
 145     Building and testing:
 146       Require at least autoconf 2.69.
 147       Don't check for strftime(), as it's in C90 and beyond.
 148       Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21.
 149     Documentation:
 150       man: Document TCP flag names better.
 151
 152 Thursday, January 12, 2023 / The Tcpdump Group
 153   Summary for 4.99.3 tcpdump release
 154     Updated printers:
 155       PTP: Use the proper values for the control field and print un-allocated
 156         values for the message field as "Reserved" instead of "none".
 157     Source code:
 158       smbutil.c: Replace obsolete function call (asctime)
 159     Building and testing:
 160       cmake: Update the minimum required version to 2.8.12 (except Windows).
 161       CI: Introduce and use TCPDUMP_CMAKE_TAINTED.
 162       Makefile.in: Add the releasecheck target.
 163       Makefile.in: Add "make -s install" in the releasecheck target.
 164       Cirrus CI: Run the "make releasecheck" command in the Linux task.
 165       Makefile.in: Add the whitespacecheck target.
 166       Cirrus CI: Run the "make whitespacecheck" command in the Linux task.
 167       Address all shellcheck warnings in update-test.sh.
 168       Makefile.in: Get rid of a remain of gnuc.h.
 169     Documentation:
 170       Reformat the installation notes (INSTALL.txt) in Markdown.
 171       Convert CONTRIBUTING to Markdown.
 172       CONTRIBUTING.md: Document the use of "protocol: " in a commit summary.
 173       Add a README file for NetBSD.
 174       Fix CMake build to set man page section numbers in tcpdump.1
 175
 176 Saturday, December 31, 2022 / The Tcpdump Group
 177   Summary for 4.99.2 tcpdump release
 178     Updated printers:
 179       BGP: Update cease notification decoding to RFC 9003.
 180       BGP: decode BGP link-bandwidth extended community properly.
 181       BGP: Fix parsing the AIGP attribute
 182       BGP: make sure the path attributes don't go past the end of the packet.
 183       BGP: Shutdown message can be up to 255 bytes length according to rfc9003
 184       DSA: correctly determine VID.
 185       EAP: fix some length checks and output issues.
 186       802.11: Fix the misleading comment regarding "From DS", "To DS" Frame
 187         Control Flags.
 188       802.11: Fetch the CF and TIM IEs a field at a time.
 189       802.15.4, BGP, LISP: fix some length checks, compiler warnings,
 190         and undefined behavior warnings.
 191       PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
 192         OSes.
 193       RRCP: support more Realtek protocols than just RRCP.
 194       MPLS: show the EXP field as TC, as per RFC 5462.
 195       ICMP: redo MPLS Extension code as general ICMP Extension code.
 196       VQP: Do not print unknown error codes twice.
 197       Juniper: Add some bounds checks.
 198       Juniper: Don't treat known DLT_ types as "Unknown".
 199       lwres: Fix a length check, update a variable type.
 200       EAP: Fix some undefined behaviors at runtime.
 201       Ethernet: Rework the length checks, add a length check.
 202       IPX: Add two length checks.
 203       Zephyr: Avoid printing non-ASCII characters.
 204       VRRP: Print the protocol name before any GET_().
 205       DCCP: Get rid of trailing commas in lists.
 206       Juniper: Report invalid packets as invalid, not truncated.
 207       IPv6: Remove an obsolete code in an always-false #if wrapper.
 208       ISAKMP: Use GET_U_1() to replace a direct dereference.
 209       RADIUS: Use GET_U_1() to replace a direct dereference.
 210       TCP: Fix an invalid check.
 211       RESP: Fix an invalid check.
 212       RESP: Remove an unnecessary test.
 213       Arista: Refine the output format and print HwInfo.
 214       sFlow: add support for IPv6 agent, add a length check.
 215       VRRP: add support for IPv6.
 216       OSPF: Update to match the Router Properties registry.
 217       OSPF: Remove two unnecessary dereferences.
 218       OSPF: Add support bit Nt RFC3101.
 219       OSPFv3: Remove two unnecessary dereferences.
 220       ICMPv6: Fix output for Router Renumbering messages.
 221       ICMPv6: Fix the Node Information flags.
 222       ICMPv6: Remove an unused macro and extra blank lines.
 223       ICMPv6: Add a length check in the rpl_dio_print() function.
 224       ICMPv6: Use GET_IP6ADDR_STRING() in the rpl_dio_print() function.
 225       IPv6: Add some checks for the Hop-by-Hop Options header
 226       IPv6: Add a check for the Jumbo Payload Hop-by-Hop option.
 227       NFS: Fix the format for printing an unsigned int
 228       PTP: fix printing of the correction fields
 229       PTP: Use ND_LCHECK_U for checking invalid length.
 230       WHOIS: Add its own printer source file and printer function
 231       MPTCP: print length before subtype inside MPTCP options
 232       ESP: Add a workaround to a "use-of-uninitialized-value".
 233       PPP: Add tests to avoid incorrectly re-entering ppp_hdlc().
 234       PPP: Don't process further if protocol is unknown (-e option).
 235       PPP: Change the pointer to packet data.
 236       ZEP: Add three length checks.
 237       Add some const qualifiers.
 238     Building and testing:
 239       Update config.guess and config.sub.
 240       Use AS_HELP_STRING macro instead of AC_HELP_STRING.
 241       Handle some Autoconf/make errors better.
 242       Fix an error when cross-compiling.
 243       Use "git archive" for the "make releasetar" process.
 244       Remove the release candidate rcX targets.
 245       Mend "make check" on Solaris 9 with Autoconf.
 246       Address assorted compiler warnings.
 247       Fix auto-enabling of Capsicum on FreeBSD with Autoconf.
 248       Treat "msys" as Windows for test exit statuses.
 249       Clean up some help messages in configure.
 250       Use unified diff by default.
 251       Remove awk code from mkdep.
 252       Fix configure test errors with Clang 15
 253       CMake: Prevent stripping of the RPATH on installation.
 254       AppVeyor CI: update Npcap site, update to 1.12 SDK.
 255       Cirrus CI: Use the same configuration as for the main branch.
 256       CI: Add back running tcpdump -J/-L and capture, now with Cirrus VMs.
 257       Remove four test files (They are now in the libpcap tests directory).
 258       On Solaris, for 64-bit builds, use the 64-bit pcap-config.
 259       Tell CMake not to check for a C++ compiler.
 260       CMake: Add a way to request -Werror and equivalents.
 261       configure: Special-case macOS /usr/bin/pcap-config as we do in CMake.
 262       configure: Use pcap-config --static-pcap-only if available.
 263       configure: Use ac_c_werror_flag to force unknown compiler flags to fail.
 264       configure: Use AC_COMPILE_IFELSE() and AC_LANG_SOURCE() for testing
 265         flags.
 266       Run the test that fails on OpenBSD only if we're not on OpenBSD.
 267     Source code:
 268       Fix some snapend-changing routines to protect against pointer
 269         underflow.
 270       Use __func__ from C99 in some function calls.
 271       Memory allocator: Update nd_add_alloc_list() to a static function.
 272       addrtoname.c: Fix two invalid tests.
 273       Use more S_SUCCESS and S_ERR_HOST_PROGRAM in main().
 274       Add some comments about "don't use GET_IP6ADDR_STRING()".
 275       Assign ndo->ndo_packetp in pretty_print_packet().
 276       Add ND_LCHECKMSG_U, ND_LCHECK_U, ND_LCHECKMSG_ZU and ND_LCHECK_ZU macros.
 277       Update tok2strbuf() to a static function.
 278       netdissect.h: Keep the link-layer dissectors names sorted.
 279       setsignal(): Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP)
 280         to avoid corrupting binary pcap output.
 281       Use __builtin_unreachable().
 282       Fail if nd_push_buffer() or nd_push_snaplen() fails.
 283       Improve code style and fix many typos.
 284     Documentation:
 285       Some man page cleanups.
 286       Update the print interface for the packet count to stdout.
 287       Note that we require compilers to support at least some of C99.
 288       Update AIX and Solaris-related specifics.
 289       INSTALL.txt: Add doc/README.*, delete the deleted win32 directory.
 290       Update README.md and README.Win32.md.
 291       Update some comments with new RFC numbers.
 292
 293 Wednesday, June 9, 2021 by gharris
 294   Summary for 4.99.1 tcpdump release
 295     Source code:
 296       Squelch some compiler warnings
 297       ICMP: Update the snapend for some nested IP packets.
 298       MACsec: Update the snapend thus the ICV field is not payload
 299         for the caller.
 300       EIGRP: Fix packet header fields
 301       SMB: Disable printer by default in CMake builds
 302       OLSR: Print the protocol name even if the packet is invalid
 303       MSDP: Print ": " before the protocol name
 304       ESP: Remove padding, padding length and next header from the buffer
 305       DHCPv6: Update the snapend for nested DHCPv6 packets
 306       OpenFlow 1.0: Get snapend right for nested frames.
 307       TCP: Update the snapend before decoding a MPTCP option
 308       Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks
 309       ForCES: Refine SPARSEDATA-TLV length check.
 310       ASCII/hex: Use nd_trunc_longjmp() in truncation cases
 311       GeoNet: Add a ND_TCHECK_LEN() call
 312       Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES().
 313       BGP: Fix overwrites of global 'astostr' temporary buffer
 314       ARP: fix overwrites of static buffer in q922_string().
 315       Frame Relay: have q922_string() handle errors better.
 316     Building and testing:
 317       Rebuild configure script when building release
 318       Fix "make clean" for out-of-tree autotools builds
 319       CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH.
 320     Documentation:
 321       man: Update a reference as www.cifs.org is gone.
 322       man: Update DNS sections
 323     Solaris:
 324       Fix a compile error with Sun C
 325
 326 Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
 327   Summary for 4.99.0 tcpdump release
 328     CVE-2018-16301: For the -F option handle large input files safely.
 329     Improve the contents, wording and formatting of the man page.
 330     Print unsupported link-layer protocol packets in hex.
 331     Add support for new network protocols and DLTs: Arista, Autosar SOME/IP,
 332       Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand
 333       (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch
 334       Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS,
 335       ZigBee Encapsulation Protocol (ZEP).
 336     Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP,
 337       ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS,
 338       NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD,
 339       VXLAN-GPE.
 340     User interface:
 341       Make SLL2 the default for Linux "any" pseudo-device.
 342       Add --micro and --nano shorthands.
 343       Add --count to print a counter only instead of decoding.
 344       Add --print, to cause packet printing even with -w.
 345       Add support for remote capture if libpcap supports it.
 346       Display the "wireless" flag and connection status.
 347       Flush the output packet buffer on a SIGUSR2.
 348       Add the snapshot length to the "reading from file ..." message.
 349       Fix local time printing (DST offset in timestamps).
 350       Allow -C arguments > 2^31-1 GB if they can fit into a long.
 351       Handle very large -f files by rejecting them.
 352       Report periodic stats only when safe to do so.
 353       Print the number of packets captured only as often as necessary.
 354       With no -s, or with -s 0, don't specify the snapshot length with newer
 355         versions of libpcap.
 356       Improve version and usage message printing.
 357     Building and testing:
 358       Install into bindir, not sbindir.
 359       autoconf: replace --with-system-libpcap with --disable-local-libpcap.
 360       Require the compiler to support C99.
 361       Better detect and use various C compilers and their features.
 362       Add CMake as the second build system.
 363       Make out-of-tree builds more reliable.
 364       Use pkg-config to detect libpcap if available.
 365       Improve Windows support.
 366       Add more tests and improve the scripts that run them.
 367       Test both with "normal" and "x87" floating-point.
 368       Eliminate dependency on libdnet.
 369     FreeBSD:
 370       Print a proper error message about monitor mode VAP.
 371       Use libcasper if available.
 372       Fix failure to capture on RDMA device.
 373       Include the correct capsicum header.
 374     Source code:
 375       Start the transition to longjmp() for packet truncation handling.
 376       Introduce new helper functions, including GET_*(), nd_print_protocol(),
 377         nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others.
 378       Put integer signedness right in many cases.
 379       Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix
 380         alignment issues, especially on SPARC.
 381       Fix many C compiler, Coverity, UBSan and cppcheck warnings.
 382       Fix issues detected with AddressSanitizer.
 383       Remove many workarounds for older compilers and OSes.
 384       Add a sanity check on packet header length.
 385       Add and remove plenty of bounds checks.
 386       Clean up pcap_findalldevs() call to find the first interface.
 387       Use a short timeout, rather than immediate mode, for text output.
 388       Handle DLT_ENC files *not* written on the same OS and byte-order host.
 389       Add, and use, macros to do locale-independent case mapping.
 390       Use a table instead of getprotobynumber().
 391       Get rid of ND_UNALIGNED and ND_TCHECK().
 392       Make roundup2() generally available.
 393       Resync SMI list against Wireshark.
 394       Fix many typos.
 395
 396 Friday, September 20, 2019, by mcr@sandelman.ca
 397   A huge thank you to Denis, Francois-Xavier and Guy who did much of the heavy lifting.
 398   Summary for 4.9.3 tcpdump release
 399     Fix buffer overflow/overread vulnerabilities:
 400       CVE-2017-16808 (AoE)
 401       CVE-2018-14468 (FrameRelay)
 402       CVE-2018-14469 (IKEv1)
 403       CVE-2018-14470 (BABEL)
 404       CVE-2018-14466 (AFS/RX)
 405       CVE-2018-14461 (LDP)
 406       CVE-2018-14462 (ICMP)
 407       CVE-2018-14465 (RSVP)
 408       CVE-2018-14881 (BGP)
 409       CVE-2018-14464 (LMP)
 410       CVE-2018-14463 (VRRP)
 411       CVE-2018-14467 (BGP)
 412       CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
 413       CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)
 414       CVE-2018-14880 (OSPF6)
 415       CVE-2018-16451 (SMB)
 416       CVE-2018-14882 (RPL)
 417       CVE-2018-16227 (802.11)
 418       CVE-2018-16229 (DCCP)
 419       CVE-2018-16230 (BGP)
 420       CVE-2018-16452 (SMB)
 421       CVE-2018-16300 (BGP)
 422       CVE-2018-16228 (HNCP)
 423       CVE-2019-15166 (LMP)
 424       CVE-2019-15167 (VRRP)
 425     Fix for cmdline argument/local issues:
 426       CVE-2018-14879 (tcpdump -V)
 427
 428 Sunday September 3, 2017 denis@ovsienko.info
 429   Summary for 4.9.2 tcpdump release
 430     Do not use getprotobynumber() for protocol name resolution.  Do not do
 431       any protocol name resolution if -n is specified.
 432     Improve errors detection in the test scripts.
 433     Fix a segfault with OpenSSL 1.1 and improve OpenSSL usage.
 434     Clean up IS-IS printing.
 435     Fix buffer overflow vulnerabilities:
 436       CVE-2017-11543 (SLIP)
 437       CVE-2017-13011 (bittok2str_internal)
 438     Fix infinite loop vulnerabilities:
 439       CVE-2017-12989 (RESP)
 440       CVE-2017-12990 (ISAKMP)
 441       CVE-2017-12995 (DNS)
 442       CVE-2017-12997 (LLDP)
 443     Fix buffer over-read vulnerabilities:
 444       CVE-2017-11541 (safeputs)
 445       CVE-2017-11542 (PIMv1)
 446       CVE-2017-12893 (SMB/CIFS)
 447       CVE-2017-12894 (lookup_bytestring)
 448       CVE-2017-12895 (ICMP)
 449       CVE-2017-12896 (ISAKMP)
 450       CVE-2017-12897 (ISO CLNS)
 451       CVE-2017-12898 (NFS)
 452       CVE-2017-12899 (DECnet)
 453       CVE-2017-12900 (tok2strbuf)
 454       CVE-2017-12901 (EIGRP)
 455       CVE-2017-12902 (Zephyr)
 456       CVE-2017-12985 (IPv6)
 457       CVE-2017-12986 (IPv6 routing headers)
 458       CVE-2017-12987 (IEEE 802.11)
 459       CVE-2017-12988 (telnet)
 460       CVE-2017-12991 (BGP)
 461       CVE-2017-12992 (RIPng)
 462       CVE-2017-12993 (Juniper)
 463       CVE-2017-12994 (BGP)
 464       CVE-2017-12996 (PIMv2)
 465       CVE-2017-12998 (ISO IS-IS)
 466       CVE-2017-12999 (ISO IS-IS)
 467       CVE-2017-13000 (IEEE 802.15.4)
 468       CVE-2017-13001 (NFS)
 469       CVE-2017-13002 (AODV)
 470       CVE-2017-13003 (LMP)
 471       CVE-2017-13004 (Juniper)
 472       CVE-2017-13005 (NFS)
 473       CVE-2017-13006 (L2TP)
 474       CVE-2017-13007 (Apple PKTAP)
 475       CVE-2017-13008 (IEEE 802.11)
 476       CVE-2017-13009 (IPv6 mobility)
 477       CVE-2017-13010 (BEEP)
 478       CVE-2017-13012 (ICMP)
 479       CVE-2017-13013 (ARP)
 480       CVE-2017-13014 (White Board)
 481       CVE-2017-13015 (EAP)
 482       CVE-2017-11543 (SLIP)
 483       CVE-2017-13016 (ISO ES-IS)
 484       CVE-2017-13017 (DHCPv6)
 485       CVE-2017-13018 (PGM)
 486       CVE-2017-13019 (PGM)
 487       CVE-2017-13020 (VTP)
 488       CVE-2017-13021 (ICMPv6)
 489       CVE-2017-13022 (IP)
 490       CVE-2017-13023 (IPv6 mobility)
 491       CVE-2017-13024 (IPv6 mobility)
 492       CVE-2017-13025 (IPv6 mobility)
 493       CVE-2017-13026 (ISO IS-IS)
 494       CVE-2017-13027 (LLDP)
 495       CVE-2017-13028 (BOOTP)
 496       CVE-2017-13029 (PPP)
 497       CVE-2017-13030 (PIM)
 498       CVE-2017-13031 (IPv6 fragmentation header)
 499       CVE-2017-13032 (RADIUS)
 500       CVE-2017-13033 (VTP)
 501       CVE-2017-13034 (PGM)
 502       CVE-2017-13035 (ISO IS-IS)
 503       CVE-2017-13036 (OSPFv3)
 504       CVE-2017-13037 (IP)
 505       CVE-2017-13038 (PPP)
 506       CVE-2017-13039 (ISAKMP)
 507       CVE-2017-13040 (MPTCP)
 508       CVE-2017-13041 (ICMPv6)
 509       CVE-2017-13042 (HNCP)
 510       CVE-2017-13043 (BGP)
 511       CVE-2017-13044 (HNCP)
 512       CVE-2017-13045 (VQP)
 513       CVE-2017-13046 (BGP)
 514       CVE-2017-13047 (ISO ES-IS)
 515       CVE-2017-13048 (RSVP)
 516       CVE-2017-13049 (Rx)
 517       CVE-2017-13050 (RPKI-Router)
 518       CVE-2017-13051 (RSVP)
 519       CVE-2017-13052 (CFM)
 520       CVE-2017-13053 (BGP)
 521       CVE-2017-13054 (LLDP)
 522       CVE-2017-13055 (ISO IS-IS)
 523       CVE-2017-13687 (Cisco HDLC)
 524       CVE-2017-13688 (OLSR)
 525       CVE-2017-13689 (IKEv1)
 526       CVE-2017-13690 (IKEv2)
 527       CVE-2017-13725 (IPv6 routing headers)
 528
 529 Sunday July 23, 2017 denis@ovsienko.info
 530   Summary for 4.9.1 tcpdump release
 531     CVE-2017-11108/Fix bounds checking for STP.
 532     Make assorted documentation updates and fix a few typos in tcpdump output.
 533     Fixup -C for file size >2GB (GH #488).
 534     Show AddressSanitizer presence in version output.
 535     Fix a bug in test scripts (exposed in GH #613).
 536     On FreeBSD adjust Capsicum capabilities for netmap.
 537     On Linux fix a use-after-free when the requested interface does not exist.
 538
 539 Wednesday January 18, 2017 devel.fx.lebail@orange.fr
 540   Summary for 4.9.0 tcpdump release
 541     General updates:
 542     Fix some heap overflows found with American Fuzzy Lop by Hanno Boeck and others
 543         (More information in the log with CVE-2016-* and CVE-2017-*)
 544     Change the way protocols print link-layer addresses (Fix heap overflows
 545         in CALM-FAST and GeoNetworking printers)
 546     Pass correct caplen value to ether_print() and some other functions
 547     Fix lookup_nsap() to match what isonsap_string() expects
 548     Clean up relative time stamp printing (Fix an array overflow)
 549     Fix some alignment issues with GCC on Solaris 10 SPARC
 550     Add some ND_TTEST_/ND_TCHECK_ macros to simplify writing bounds checks
 551     Add a fn_printztn() which returns the number of bytes processed
 552     Add nd_init() and nd_cleanup() functions. Improve libsmi support
 553     Add CONTRIBUTING file
 554     Add a summary comment in all printers
 555     Compile with more warning options in devel mode if supported (-Wcast-qual, ...)
 556     Fix some leaks found by Valgrind/Memcheck
 557     Fix a bunch of de-constifications
 558     Squelch some Coverity warnings and some compiler warnings
 559     Update Coverity and Travis-CI setup
 560     Update Visual Studio files
 561
 562     Frontend:
 563     Fix capsicum support to work with zerocopy buffers in bpf
 564     Try opening interfaces by name first, then by name-as-index
 565     Work around pcap_create() failures fetching time stamp type lists
 566     Fix a segmentation fault with 'tcpdump -J'
 567     Improve addrtostr6() bounds checking
 568     Add exit_tcpdump() function
 569     Don't drop CAP_SYS_CHROOT before chrooting
 570     Fixes issue where statistics not reported when -G and -W options used
 571
 572     Updated printers:
 573     802.11: Beginnings of 11ac radiotap support
 574     802.11: Check the Protected bit for management frames
 575     802.11: Do bounds checking on last_presentp before dereferencing it (Fix a heap overflow)
 576     802.11: Fix the radiotap printer to handle the special bits correctly
 577     802.11: If we have the MCS field, it's 11n
 578     802.11: Only print unknown frame type or subtype messages once
 579     802.11: Radiotap dBm values get printed as dB; Update a test output accordingly
 580     802.11: Source and destination addresses were backwards
 581     AH: Add a bounds check
 582     AH: Report to our caller that dissection failed if a bounds check fails
 583     AP1394: Print src > dst, not dst > src
 584     ARP: Don't assume the target hardware address is <= 6 octets long (Fix a heap overflow)
 585     ATALK: Add bounds and length checks (Fix heap overflows)
 586     ATM: Add some bounds checks (Fix a heap overflow)
 587     ATM: Fix an incorrect bounds check
 588     BFD: Update specification from draft to RFC 5880
 589     BFD: Update to print optional authentication field
 590     BGP: Add support for the AIGP attribute (RFC7311)
 591     BGP: Print LARGE_COMMUNITY Path Attribute
 592     BGP: Update BGP numbers from IANA; Print minor values for FSM notification
 593     BOOTP: Add a bounds check
 594     Babel: Add decoder for source-specific extension
 595     CDP: Filter out non-printable characters
 596     CFM: Fixes to match the IEEE standard, additional bounds and length checks
 597     CSLIP: Add more bounds checks (Fix a heap overflow)
 598     ClassicalIPoATM: Add a bounds check on LLC+SNAP header (Fix a heap overflow)
 599     DHCP: Fix MUDURL and TZ options
 600     DHCPv6: Process MUDURL and TZ options
 601     DHCPv6: Update Status Codes with RFCs/IANA names
 602     DNS: Represent the "DNSSEC OK" bit as "DO" instead of "OK". Add a test case
 603     DTP: Improve packet integrity checks
 604     EGP: Fix bounds checks
 605     ESP: Don't use OpenSSL_add_all_algorithms() in OpenSSL 1.1.0 or later
 606     Ethernet: Add some bounds checking before calling isoclns_print (Fix a heap overflow)
 607     Ethernet: Print the Length/Type field as length when needed
 608     FDDI: Fix -e output for FDDI
 609     FR: Add some packet-length checks and improve Q.933 printing (Fix heap overflows)
 610     GRE: Add some bounds checks (Fix heap overflows)
 611     Geneve: Fix error message with invalid option length; Update list option classes
 612     HNCP: Fix incorrect time interval format. Fix handling of IPv4 prefixes
 613     ICMP6: Fetch a 32-bit big-endian quantity with EXTRACT_32BITS()
 614     IGMP: Add a length check
 615     IP: Add a bounds check (Fix a heap overflow)
 616     IP: Check before fetching the protocol version (Fix a heap overflow)
 617     IP: Don't try to dissect if IP version != 4 (Fix a heap overflow)
 618     IP: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 619     IPComp: Check whether we have the CPI before we fetch it (Fix a heap overflow)
 620     IPoFC: Fix -e output (IP-over-Fibre Channel)
 621     IPv6: Don't overwrite the destination IPv6 address for routing headers
 622     IPv6: Fix header printing
 623     IPv6: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 624     ISAKMP: Clean up parsing of IKEv2 Security Associations
 625     ISOCLNS/IS-IS: Add support for Purge Originator Identifier (RFC6232) and test cases
 626     ISOCLNS/IS-IS: Don't overwrite packet data when checking the signature
 627     ISOCLNS/IS-IS: Filter out non-printable characters
 628     ISOCLNS/IS-IS: Fix segmentation faults
 629     ISOCLNS/IS-IS: Have signature_verify() do the copying and clearing
 630     ISOCLNS: Add some bounds checks
 631     Juniper: Make sure a Juniper header TLV isn't bigger than what's left in the packet (Fix a heap overflow)
 632     LLC/SNAP: With -e, print the LLC header before the SNAP header; without it, cut the SNAP header
 633     LLC: Add a bounds check (Fix a heap overflow)
 634     LLC: Clean up printing of LLC packets
 635     LLC: Fix the printing of RFC 948-style IP packets
 636     LLC: Skip the LLC and SNAP headers with -x for 802.11 and some other protocols
 637     LLDP: Implement IANA OUI and LLDP MUD option
 638     MPLS LSP ping: Update printing for RFC 4379, bug fixes, more bounds checks
 639     MPLS: "length" is now the *remaining* packet length
 640     MPLS: Add bounds and length checks (Fix a heap overflow)
 641     NFS: Don't assume the ONC RPC header is nicely aligned
 642     NFS: Don't overflow the Opaque_Handle buffer (Fix a segmentation fault)
 643     NFS: Don't run past the end of an NFSv3 file handle
 644     OLSR: Add a test to cover a HNA sgw case
 645     OLSR: Fix 'Advertised networks' count
 646     OLSR: Fix printing of smart-gateway HNAs in IPv4
 647     OSPF: Add a bounds check for the Hello packet options
 648     OSPF: Do more bounds checking
 649     OSPF: Fix a segmentation fault
 650     OSPF: Fix printing 'ospf_topology_values' default
 651     OTV: Add missing bounds checks
 652     PGM: Print the formatted IP address, not the raw binary address, as a string
 653     PIM: Add some bounds checking (Fix a heap overflow)
 654     PIMv2: Fix checksumming of Register messages
 655     PPP: Add some bounds checks (Fix a heap overflow)
 656     PPP: Report invalid PAP AACK/ANAK packets
 657     Q.933: Add a missing bounds check
 658     RADIUS: Add Value 13 "VLAN" to Tunnel-Type attribute
 659     RADIUS: Filter out non-printable characters
 660     RADIUS: Translate UDP/1700 as RADIUS
 661     RESP: Do better checking of RESP packets
 662     RPKI-RTR: Add a return value check for "fn_printn" call
 663     RPKI-RTR: Remove printing when truncated condition already detected
 664     RPL: Fix 'Consistency Check' control code
 665     RPL: Fix suboption print
 666     RSVP: An INTEGRITY object in a submessage covers only the submessage
 667     RSVP: Fix an infinite loop; Add bounds and length checks
 668     RSVP: Fix some if statements missing brackets
 669     RSVP: Have signature_verify() do the copying and clearing
 670     RTCP: Add some bounds checks
 671     RTP: Add some bounds checks, fix two segmentation faults
 672     SCTP: Do more bounds checking
 673     SFLOW: Fix bounds checking
 674     SLOW: Fix bugs, add checks
 675     SMB: Before fetching the flags2 field, make sure we have it
 676     SMB: Do bounds checks on NBNS resource types and resource data lengths
 677     SNMP: Clean up the "have libsmi but no modules loaded" case
 678     SNMP: Clean up the object abbreviation list and fix the code to match them
 679     SNMP: Do bounds checks when printing character and octet strings
 680     SNMP: Improve ASN.1 bounds checks
 681     SNMP: More bounds and length checks
 682     STP: Add a bunch of bounds checks, and fix some printing (Fix heap overflows)
 683     STP: Filter out non-printable characters
 684     TCP: Add bounds and length checks for packets with TCP option 20
 685     TCP: Correct TCP option Kind value for TCP Auth and add SCPS-TP
 686     TCP: Fix two bounds checks (Fix heap overflows)
 687     TCP: Make sure we have the data offset field before fetching it (Fix a heap overflow)
 688     TCP: Put TCP-AO option decoding right
 689     TFTP: Don't use strchr() to scan packet data (Fix a heap overflow)
 690     Telnet: Add some bounds checks
 691     TokenRing: Fix -e output
 692     UDLD: Fix an infinite loop
 693     UDP: Add a bounds check (Fix a heap overflow)
 694     UDP: Check against the packet length first
 695     VAT: Add some bounds checks
 696     VTP: Add a test on Mgmt Domain Name length
 697     VTP: Add bounds checks and filter out non-printable characters
 698     VXLAN: Add a bound check and a test case
 699     ZeroMQ: Fix an infinite loop
 700
 701 Tuesday October 25, 2016 mcr@sandelman.ca
 702   Summary for 4.8.1 tcpdump release
 703         Fix "-x" for Apple PKTAP and PPI packets
 704         Improve separation frontend/backend (tcpdump/libnetdissect)
 705         Fix display of timestamps with -tt, -ttt and -ttttt options
 706         Add support for the Marvell Extended Distributed Switch Architecture header
 707         Use PRIx64 to print a 64-bit number in hex.
 708         Printer for HNCP (RFCs 7787 and 7788).
 709         dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer.
 710         RSVP: Add bounds and length checks
 711         OSPF: Do more bounds checking
 712         Handle OpenSSL 1.1.x.
 713         Initial support for the REdis Serialization Protocol known as RESP.
 714         Add printing function for Generic Protocol Extension for VXLAN
 715             draft-ietf-nvo3-vxlan-gpe-01
 716         Network Service Header: draft-ietf-sfc-nsh-01
 717         Don't recompile the filter if the new file has the same DLT.
 718         Pass an adjusted struct pcap_pkthdr to the sub-printer.
 719         Add three test cases for already fixed CVEs
 720            CVE-2014-8767: OLSR
 721            CVE-2014-8768: Geonet
 722            CVE-2014-8769: AODV
 723         Don't do the DDP-over-UDP heuristic first: GitHub issue #499.
 724         Use the new debugging routines in libpcap.
 725         Harmonize TCP source or destination ports tests with UDP ones
 726         Introduce data types to use for integral values in packet structures.
 727         RSVP: Fix an infinite loop
 728         Support of Type 3 and Type 4 LISP packets.
 729         Don't require IPv6 library support in order to support IPv6 addresses.
 730         Many many changes to support libnetdissect usage.
 731         Add a test that makes unaligned accesses: GitHub issue #478.
 732         add a DNSSEC test case: GH #445 and GH #467.
 733         BGP: add decoding of ADD-PATH capability
 734         fixes to LLC header printing, and RFC948-style IP packets
 735
 736 Friday April 10, 2015 guy@alum.mit.edu
 737   Summary for 4.7.4 tcpdump release
 738         RPKI to Router Protocol: Fix Segmentation Faults and other problems
 739         RPKI to Router Protocol: print strings with fn_printn()
 740         wb: fix some bounds checks
 741
 742 Wednesday March 11, 2015 mcr@sandelman.ca
 743   Summary for 4.7.3 tcpdump release
 744         Capsicum fixes for FreeBSD 10
 745
 746 Tuesday March 10, 2015 mcr@sandelman.ca
 747   Summary for 4.7.2 tcpdump release
 748         DCCP: update Packet Types with RFC4340/IANA names
 749         fixes for CVE-2015-0261: IPv6 mobility header check issue
 750         fixes for CVE-2015-2153, 2154, 2155: kday packets
 751
 752 Friday Nov. 12, 2014 guy@alum.mit.edu
 753   Summary for 4.7.0 tcpdump release
 754         changes to hex printing of CDP packets
 755         Fix PPI printing
 756         Radius: update Packet Type Codes and Attribute Types with RFC/IANA names
 757         Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support.
 758         improvements to telnet printer, even if not -v
 759         omit length for bcp, print-tcp uses it
 760         formatting fixes for a bunch of protocols
 761         new bounds checks for a number of protocols
 762         split netflow 1,6, and 6 dissector up.
 763         added geneve dissector
 764         CVE-2014-9140 PPP dissector fixed.
 765
 766 Tuesday  Sep.  2, 2014 mcr@sandelman.ca
 767   Summary for 4.6.2 tcpdump release
 768         fix out-of-source-tree builds: find libpcap that is out of source
 769         better configure check for libsmi
 770
 771 Saturday Jul. 19, 2014 mcr@sandelman.ca
 772   Summary for 4.6.1 tcpdump release
 773         added FreeBSD capsicum
 774         add a short option '#', same as long option '--number'
 775
 776 Wednesday Jul. 2, 2014 mcr@sandelman.ca
 777   Summary for 4.6.0 tcpdump release
 778         all of tcpdump is now using the new "NDO" code base (Thanks Denis!)
 779         nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes
 780         M3UA decode added.
 781         many new test cases: 82 in 4.5.1 to 133 in 4.6.0
 782         many improvements to travis continuous integration system: OSX, and Coverity options
 783         cleaned up some unnecessary header files
 784         Added bittok2str().
 785         a number of unaligned access faults fixed
 786         -A flag does not consider CR to be printable anymore
 787         fx.lebail took over coverity baby sitting
 788         default snapshot size increased to 256K for accommodate USB captures
 789         WARNING: this release contains a lot of very worthwhile code churn.
 790
 791 Wednesday Jan. 15, 2014 guy@alum.mit.edu
 792   Summary for 4.5.2 tcpdump release
 793         Man page fix
 794         Fix crashes on SPARC
 795
 796 Monday Nov. 11, 2013 mcr@sandelman.ca
 797   Summary for 4.5.1 tcpdump release
 798         CREDITS file fixes
 799
 800 Thursday Nov. 7, 2013  mcr@sandelman.ca and guy@alum.mit.edu.
 801   Summary for 4.5.0 tcpdump release
 802         some NFSv4 fixes for printing
 803         fix printing of unknown TCP options, and tcp fast-open
 804         fixes for syslog parser
 805         some gcc-version-specific flag tuning
 806         adopt MacOS deprecation workarounds for openssl
 807         improvements to babel printing
 808         add OpenFlow 1.0 (no SSL) and test cases
 809         GeoNet printer.
 810         added STBC Rx support
 811         improvements to DHCPv6 decoder
 812         clarify which autoconf is needed
 813         Point users to the the-tcpdump-group repository on GitHub rather
 814             than the mcr repository
 815         Add MSDP printer.
 816         Fixed IPv6 check on Solaris and other OSes requiring extra
 817             networking libraries.
 818         Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03),
 819             and add "vxlan" as an option for -T.
 820         Add support for OTV (draft-hasmit-otv-04).
 821         fixes for DLT_IEEE802_11_RADIO datalink types
 822         added MPTCP decoder
 823
 824 Saturday April 6, 2013 guy@alum.mit.edu.
 825   Summary for 4.4.0 tcpdump release
 826         RPKI-RTR (RFC6810) is now official (TCP Port 323)
 827         Fix detection of OpenSSL libcrypto.
 828         Add DNSSL (RFC6106) support.
 829         Add "radius" as an option for -T.
 830         Update Action codes for handle_action function according to
 831             802.11s amendment.
 832         Decode DHCPv6 AFTR-Name option (RFC6334).
 833         Updates for Babel.
 834         Fix printing of infinite lifetime in ICMPv6.
 835         Added support for SPB, SPBM Service Identifier, and Unicast
 836             Address sub-TLV in ISIS.
 837         Decode RIPv2 authentication up to RFC4822.
 838         Fix RIP Request/full table decoding issues.
 839         On Linux systems with cap-ng.h, drop root privileges
 840             using Linux Capabilities.
 841         Add support for reading multiple files.
 842         Add MS NLB heartbeat printer.
 843         Separate multiple nexthops in BGP.
 844
 845 Wednesday  November 28, 2012 guy@alum.mit.edu.
 846   Summary for 4.3.1 tcpdump release
 847         Print "LLDP, length N" for LLDP packets even when not in verbose
 848             mode, so something is printed even if only the timestamp is
 849             present
 850         Document "-T carp"
 851         Print NTP poll interval correctly (it's an exponent, so print
 852             both its raw value and 2^value)
 853         Document that "-e" is used to get MAC addresses
 854         More clearly document that you need to escape or quote
 855             backslashes in filter expressions on the command line
 856         Fix some "the the" in the man page
 857         Use the right maximum path length
 858         Don't treat 192_1_2, when passed to -i, as an interface number
 859
 860 Friday  April 3, 2012.  mcr@sandelman.ca.
 861   Summary for 4.3.0 tcpdump release
 862         fixes for forces: SPARSE data (per RFC 5810)
 863         some more test cases added
 864         updates to documentation on -l, -U and -w flags.
 865         Fix printing of BGP optional headers.
 866         Tried to include DLT_PFSYNC support, failed due to headers required.
 867         added TIPC support.
 868         Fix LLDP Network Policy bit definitions.
 869         fixes for IGMPv3's Max Response Time: it is in units of 0.1 second.
 870         SIGUSR1 can be used rather than SIGINFO for stats
 871         permit -n flag to affect print-ip for protocol numbers
 872         ND_OPT_ADVINTERVAL is in milliseconds, not seconds
 873         Teach PPPoE parser about RFC 4638
 874
 875
 876 Friday  December 9, 2011.  guy@alum.mit.edu.
 877   Summary for 4.2.1 tcpdump release
 878         Only build the Babel printer if IPv6 is enabled.
 879         Support Babel on port 6696 as well as 6697.
 880         Include ppi.h in release tarball.
 881         Include all the test files in the release tarball, and don't
 882          "include" test files that no longer exist.
 883         Don't assume we have <rpc/rpc.h> - check for it.
 884         Support "-T carp" as a way of dissecting IP protocol 112 as CARP
 885          rather than VRRP.
 886         Support Hilscher NetAnalyzer link-layer header format.
 887         Constify some pointers and fix compiler warnings.
 888         Get rid of never-true test.
 889         Fix an unintended fall-through in a case statement in the ARP
 890          printer.
 891         Fix several cases where sizeof(sizeof(XXX)) was used when just
 892          sizeof(XXX) was intended.
 893         Make stricter sanity checks in the ES-IS printer.
 894         Get rid of some GCCisms that caused builds to fai with compilers
 895          that don't support them.
 896         Fix typo in man page.
 897         Added length checks to Babel printer.
 898
 899 Sunday  July 24, 2011.  mcr@sandelman.ca.
 900   Summary for 4.2.+
 901         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
 902           at gmail dot com>
 903         updates to forces for new port numbers
 904         Use "-H", not "-h", for the 802.11s option. (-h always help)
 905         Better ICMPv6 checksum handling.
 906         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
 907         get rid of uuencoded pcap test files, git can do binary.
 908         sFlow changes for 64-bit counters.
 909         fixes for PPI packet header handling and printing.
 910         Add DCB Exchange protocol (DCBX) version 1.01.
 911         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
 912         improvements to radiotap for rate values > 127.
 913         Many improvements to ForCES decode, including fix SCTP TML port
 914         updated RPL type code to RPL-17 draft
 915         Improve printout of DHCPv6 options.
 916         added support and test case for QinQ (802.1q VLAN) packets
 917         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
 918         Build fixes for Sparc and other machines with alignment restrictions.
 919         Merged changes from Debian package.
 920         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
 921         Build fixes for OSX (Snow Leopard and others)
 922         Add support for IEEE 802.15.4 packets
 923
 924 Tue.    July 20, 2010.  guy@alum.mit.edu.
 925   Summary for 4.1.2 tcpdump release
 926         If -U is specified, flush the file after creating it, so it's
 927           not zero-length
 928         Fix TCP flags output description, and some typos, in the man
 929           page
 930         Add a -h flag, and only attempt to recognize 802.11s mesh
 931           headers if it's set
 932         When printing the link-layer type list, send *all* output to
 933           stderr
 934         Include the CFLAGS setting when configure was run in the
 935           compiler flags
 936
 937 Thu.    April 1, 2010.  guy@alum.mit.edu.
 938   Summary for 4.1.1 tcpdump release
 939         Fix build on systems with PF, such as FreeBSD and OpenBSD.
 940         Don't blow up if a zero-length link-layer address is passed to
 941           linkaddr_string().
 942
 943 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
 944   Summary for 4.1.0 tcpdump release
 945         Fix printing of MAC addresses for VLAN frames with a length
 946           field
 947         Add some additional bounds checks and use the EXTRACT_ macros
 948           more
 949         Add a -b flag to print the AS number in BGP packets in ASDOT
 950           notation rather than ASPLAIN notation
 951         Add ICMPv6 RFC 5006 support
 952         Decode the access flags in NFS access requests
 953         Handle the new DLT_ for memory-mapped USB captures on Linux
 954         Make the default snapshot (-s) the maximum
 955         Print name of device (when -L is used)
 956         Support for OpenSolaris (and SXCE build 125 and later)
 957         Print new TCP flags
 958         Add support for RPL DIO
 959         Add support for TCP User Timeout (UTO)
 960         Add support for non-standard Ethertypes used by 3com PPPoE gear
 961         Add support for 802.11n and 802.11s
 962         Add support for Transparent Ethernet Bridge ethertype in GRE
 963         Add 4 byte AS support for BGP printer
 964         Add support for the MDT SAFI 66 BG printer
 965         Add basic IPv6 support to print-olsr
 966         Add USB printer
 967         Add printer for ForCES
 968         Handle frames with an FCS
 969         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
 970         Fix TCP sequence number printing
 971         Report 802.2 packets as 802.2 instead of 802.3
 972         Don't include -L/usr/lib in LDFLAGS
 973         On x86_64 Linux, look in lib64 directory too
 974         Lots of code clean ups
 975         Autoconf clean ups
 976         Update testcases to make output changes
 977         Fix compiling with/out smi (--with{,out}-smi)
 978         Fix compiling without IPv6 support (--disable-ipv6)
 979
 980 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
 981         Add support for Bluetooth Sniffing
 982         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
 983         Add support for 802.11 AVS
 984         Add support for SMB over TCP
 985         Add support for 4 byte BGP AS printing
 986         Add support for compiling on case-insensitive file systems
 987         Add support for ikev2 printing
 988         Update support for decoding AFS
 989         Update DHCPv6 printer
 990         Use newer libpcap API's (allows -B option on all platforms)
 991         Add -I to turn on monitor mode
 992         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
 993         Cleanup unused files and various cruft
 994
 995 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
 996         Rework ARP printer
 997         Rework OSPFv3 printer
 998         Add support for Frame-Relay ARP
 999         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
1000         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
1001         TLV: Add support for Juniper .pcap extensions
1002         Print EGP header in new-world-order style
1003         Converted print-isakmp.c to NETDISSECT
1004         Moved AF specific stuff into af.h
1005         Test subsystem now table driven, and saves outputs and diffs to one place
1006         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
1007          libpcap files on an OS other than where the file was generated
1008
1009
1010 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
1011
1012         NFS: Print unsigned values as such.
1013         RX: parse safely.
1014         BGP: fixes for IPv6-less builds.
1015         801.1ag: use standard codepoint.
1016         use /dev/bpf on systems with such a device.
1017         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
1018         smb: make sure that we haven't gone past the end of the captured data.
1019         smb: squelch an uninitialized complaint from coverity.
1020         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
1021                 if it got MSG_DENIED.
1022         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
1023         revised INSTALL.txt about libpcap dependency.
1024
1025 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
1026         Update man page to reflect changes to libpcap
1027         Changes to both TCP and IP Printer Output
1028         Fix a potential buffer overflow in the 802.11 printer
1029         Print basic info about a few more Cisco LAN protocols.
1030         mDNS cleanup
1031         ICMP MPLS rework of the extension code
1032         bugfix: use the correct codepoint for the OSPF simple text auth token
1033          entry, and use safeputs to print the password.
1034         Add support in pflog for additional values
1035         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
1036         Add support for the Message-id NACK c-type.
1037         Add support for 802.3ah loopback ctrl msg
1038         Add support for Multiple-STP as per 802.1s
1039         Add support for rapid-SPT as per 802.1w
1040         Add support for CFM Link-trace msg, Link-trace-Reply msg,
1041          Sender-ID tlv, private tlv, port, interface status
1042         Add support for unidirectional link detection as per
1043          https://tools.ietf.org/id/draft-foschiano-udld-02.txt
1044         Add support for the olsr protocol as per RFC 3626 plus the LQ
1045          extensions from olsr.org
1046         Add support for variable-length checksum in DCCP, as per section 9 of
1047          RFC 4340.
1048         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
1049         Add support for Multiple-STP as per 802.1s
1050         Add support for the cisco proprietary 'dynamic trunking protocol'
1051         Add support for the cisco proprietary VTP protocol
1052         Update dhcp6 options table as per IETF standardization activities
1053
1054
1055 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
1056
1057         Fix compiling on AIX (, at end of ENUM)
1058         Updated list of DNS RR typecodes
1059         Use local Ethernet defs on WIN32
1060         Add support for Frame-Relay ARP
1061         Fixes for compiling under MSVC++
1062         Add support for parsing Juniper .pcap files
1063         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
1064         Rework the OSPFv3 printer
1065         Fix printing for 4.4BSD/NetBSD NFS Filehandles
1066         Add support for Cisco style NLPID encapsulation
1067         Add cisco prop. eigrp related, extended communities
1068         Add support for BGP signaled VPLS
1069         Cleanup the bootp printer
1070         Add support for PPP over Frame-Relay
1071         Add some bounds checking to the IP options code, and clean up
1072          the options output a bit.
1073         Add additional modp groups to ISAKMP printer
1074         Add support for Address-Withdraw and Label-Withdraw Msgs
1075         Add support for the BFD Discriminator TLV
1076         Fixes for 64bit compiling
1077         Add support for PIMv2 checksum verification
1078         Add support for further dissection of the IPCP Compression Option
1079         Add support for Cisco's proposed VQP protocol
1080         Add basic support for keyed authentication TCP option
1081         Lots of minor cosmetic changes to output printers
1082
1083
1084 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
1085         Decoder support for more Juniper link-layer types
1086         Fix a potential buffer overflow (although it can't occur in
1087                 practice).
1088         Fix the handling of unknown management frame types in the 802.11
1089                 printer.
1090         Add FRF.16 support, fix various Frame Relay bugs.
1091         Add support for RSVP integrity objects, update fast-reroute
1092                 object printer to latest spec.
1093         Clean up documentation of vlan filter expression, document mpls
1094                 filter expression.
1095         Document new pppoed and pppoes filter expressions.
1096         Update diffserver-TE codepoints as per RFC 4124.
1097         Spelling fixes in ICMPv6.
1098         Don't require any fields other than flags to be present in IS-IS
1099                 restart signaling TLVs, and only print the system ID in
1100                 those TLVs as system IDs, not as node IDs.
1101         Support for DCCP.
1102
1103 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
1104
1105         Option to chroot() when dropping privs
1106         Fixes for compiling on nearly every platform,
1107                 including improved 64bit support
1108         Many new testcases
1109         Support for sending packets
1110         Many compilation fixes on most platforms
1111         Fixes for recent version of GCC to eliminate warnings
1112         Improved Unicode support
1113
1114         Decoders & DLT Changes, Updates and New:
1115                 AES ESP support
1116                 Juniper ATM, FRF.15, FRF.16, PPPoE,
1117                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
1118                         GGSN,ES,MONITOR,SERVICES
1119                 L2VPN
1120                 Axent Raptor/Symantec Firewall
1121                 TCP-MD5 (RFC 2385)
1122                 ESP-in-UDP (RFC 3948)
1123                 ATM OAM
1124                 LMP, LMP Service Discovery
1125                 IP over FC
1126                 IP over IEEE 1394
1127                 BACnet MS/TP
1128                 SS7
1129                 LDP over TCP
1130                 LACP, MARKER as per 802.3ad
1131                 PGM (RFC 3208)
1132                 LSP-PING
1133                 G.7041/Y.1303 Generic Framing Procedure
1134                 EIGRP-IP, EIGRP-IPX
1135                 ICMP6
1136                 Radio - via radiotap
1137                 DHCPv6
1138                 HDLC over PPP
1139
1140 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
1141
1142         No changes from 3.8.2. Version bumped only to maintain consistency
1143         with libpcap 0.8.3.
1144
1145 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
1146
1147         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
1148         https://web.archive.org/web/20160328035955/https://www.rapid7.com/resources/advisories/R7-0017.jsp
1149         IP-over-IEEE1394 printing.
1150         some MINGW32 changes.
1151         updates for autoconf 2.5
1152         fixes for print-aodv.c - check for too short packets
1153         formatting changes to print-ascii for hex output.
1154         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
1155                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
1156                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
1157                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
1158         print-ether.c - better handling of unknown types.
1159         print-isoclns.c - additional decoding of types.
1160         print-llc.c - strings for LLC names added.
1161         print-pfloc.c - various enhancements
1162         print-radius.c - better decoding to strings.
1163
1164 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
1165
1166         changed syntax of -E argument so that multiple SAs can be decrypted
1167         fixes for Digital Unix headers and Documentation
1168         __attribute__ fixes
1169         CDP changes from Terry Kennedy <terry@tmk.com>.
1170         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
1171         Fixes for ASN.1 decoder for 2.100.3 forms.
1172         Added a count of packets received and processed to clarify numbers.
1173         Incorporated WinDUMP patches for Win32 builds.
1174         PPPoE payload length headers.
1175         Fixes for HP C compiler builds.
1176         Use new pcap_breakloop() and pcap_findalldevs() if we can.
1177         BGP output split into multiple lines.
1178         Fixes to 802.11 decoding.
1179         Fixes to PIM decoder.
1180         SuperH is a CPU that can't handle unaligned access. Many fixes for
1181                 unaligned access work.
1182         Fixes to Frame-Relay decoder for Q.933/922 frames.
1183         Clarified when Solaris can do captures as non-root.
1184         Added tests/ subdir for examples/regression tests.
1185         New -U flag.    -flush stdout after every packet
1186         New -A flag     -print ascii only
1187         support for decoding IS-IS inside Cisco HDLC Frames
1188         more verbosity for tftp decoder
1189         mDNS decoder
1190         new BFD decoder
1191         cross compilation patches
1192         RFC 3561 AODV support.
1193         UDP/TCP pseudo-checksum properly for source-route options.
1194         sanitized all files to modified BSD license
1195         Add support for RFC 2625 IP-over-Fibre Channel.
1196         fixes for DECnet support.
1197         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
1198         RFC 2684 encapsulation of BPDUs.
1199
1200 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
1201
1202         Fixed infinite loop when parsing invalid isakmp packets.
1203          (reported by iDefense; already fixed in CVS)
1204         Fixed infinite loop when parsing invalid BGP packets.
1205         Fixed buffer overflow with certain invalid NFS packets.
1206         Pretty-print unprintable network names in 802.11 printer.
1207         Handle truncated nbp (appletalk) packets.
1208         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
1209         Print IP protocol name even if we don't have a printer for it.
1210         Print IP protocol name or number for fragments.
1211         Print the whole MPLS label stack, not just the top label.
1212         Print request header and file handle for NFS v3 FSINFO and PATHCONF
1213          requests.
1214         Fix NFS packet truncation checks.
1215         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
1216         Handle unknown RADIUS attributes properly.
1217         Fix an ASN.1 parsing error that would cause e.g. the OID
1218          2.100.3 to be misrepresented as 4.20.3 .
1219
1220 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
1221         keyword "ipx" added.
1222         Better OSI/802.2 support on Linux.
1223         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
1224         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
1225         BXXP protocol was replaced by the BEEP protocol;
1226         improvements to SNAP demux.
1227         Changes to "any" interface documentation.
1228         Documentation on pcap_stats() counters.
1229         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
1230         Added MPLS encapsulation decoding per RFC3032.
1231         DNS dissector handles TKEY, TSIG and IXFR.
1232         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
1233         SMB printing has much improved bounds checks
1234         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
1235         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
1236         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
1237         IPX socket 0x85be is for Cisco EIGRP over IPX.
1238         Improvements to fragmented ESP handling.
1239         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
1240         Linux ARPHDR_ATM support fixed.
1241         Added a "netbeui" keyword, which selects NetBEUI packets.
1242         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
1243         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
1244         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
1245         Better Linux libc5 compat.
1246         BIND9 lwres dissector added.
1247         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
1248         Apple LocalTalk LINKTYPE_ reserved.
1249         New time stamp formats documented.
1250         DHCP6 updated to draft-22.txt spec.
1251         ICMP types/codes now accept symbolic names.
1252         Add SIGINFO handler from LBL
1253         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
1254         now we are -Wstrict-prototype clean.
1255         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
1256         PPPoE dissector cleaned up.
1257         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
1258         In dissector, now the caller prints the IP addresses rather than proto.
1259         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
1260         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
1261         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
1262         captures on the "any" device won't be done in promiscuous mode
1263         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
1264         ARCNet support, from NetBSD.
1265         HSRP dissector, from Julian Cowley <julian@lava.net>.
1266         Handle (GRE-encapsulated) PPTP
1267         added -C option to rotate save file every optarg * 1,000,000 bytes.
1268         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
1269         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
1270         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
1271         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
1272         ESP printing updated to RFC2406.
1273         HP-UX can now handle large number of PPAs.
1274         MSDP printer added.
1275         L2TP dissector improvements from Motonori Shindo.
1276
1277 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
1278         Cleaned up documentation.
1279         Promisc mode fixes for Linux
1280         IPsec changes/cleanups.
1281         Alignment fixes for picky architectures
1282
1283         Removed dependency on native headers for packet dissectors.
1284         Removed Linux specific headers that were shipped
1285
1286         libpcap changes provide for exchanging capture files between
1287           systems. Save files now have well known PACKET_ values instead of
1288           depending upon system dependent mappings of DLT_* types.
1289
1290         Support for computing/checking IP and UDP/TCP checksums.
1291
1292         Updated autoconf stock files.
1293
1294         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
1295
1296         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
1297                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
1298
1299         Added filtering support for: VLANs, ESIS, ISIS
1300
1301         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
1302                 L2TP, PPPoE
1303
1304         HP-UX 11.0 -- find the right dlpi device.
1305         Solaris 8 - IPv6 works
1306         Linux - Added support for an "any" device to capture on all interfaces
1307
1308         Security fixes: buffer overrun audit done. Strcpy replaced with
1309                 strlcpy, sprintf replaced with snprintf.
1310         Look for lex problems, and warn about them.
1311
1312
1313 v3.5 Fri Jan 28 18:00:00 PST 2000
1314
1315 Bill Fenner <fenner@research.att.com>
1316 - switch to config.h for autoconf
1317 - unify RCSID strings
1318 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
1319 - Really fix the RIP printer
1320 - Fix MAC address -> name translation.
1321 - some -Wall -Wformat fixes
1322 - update makemib to parse much of SMIv2
1323 - Print TCP sequence # with -vv even if you normally wouldn't
1324 - Print as much of IP/TCP/UDP headers as possible even if truncated.
1325
1326 itojun@iijlab.net
1327 - -X will make a ascii dump.  from netbsd.
1328 - telnet command sequence decoder (ff xx xx).  from netbsd.
1329 - print-bgp.c: improve options printing.  ugly code exists for
1330   unaligned option parsing (need some fix).
1331 - const poisoning in SMB decoder.
1332 - -Wall -Werror clean checks.
1333 - bring in KAME IPv6/IPsec decoding code.
1334
1335 Assar Westerlund  <assar@sics.se>
1336 - SNMPv2 and SNMPv3 printer
1337 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
1338   SNMP packets.
1339 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
1340 - portability fixes
1341 - permit building in different directories.
1342
1343 Ken Hornstein <kenh@cmf.nrl.navy.mil>
1344 - bring in code at
1345   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
1346   AFS3 packets
1347
1348 Andrew Tridgell <tridge@linuxcare.com>
1349 - SMB printing code
1350
1351 Love <lha@stacken.kth.se>
1352 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
1353   change date format to the right one.
1354
1355 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
1356 - Created tcpdump.org repository
1357
1358 v3.4 Sat Jul 25 12:40:55 PDT 1998
1359
1360 - Hardwire Linux slip support since it's too hard to detect.
1361
1362 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
1363   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
1364
1365 - Added -a which tries to translate network and broadcast addresses to
1366   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
1367
1368 - Added a configure option to disable gcc.
1369
1370 - Added a "raw" packet printer.
1371
1372 - Not having an interface address is no longer fatal. Requested by John
1373   Hawkinson.
1374
1375 - Rework signal setup to accommodate Linux.
1376
1377 - OSPF truncation check fix. Also display the type of OSPF packets
1378   using MD5 authentication. Thanks to Brian Wellington
1379   (bwelling@tis.com)
1380
1381 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
1382   Peisach (epeisach@mit.edu)
1383
1384 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
1385   (plonka@mfa.com)
1386
1387 - Specify full install target as a way of detecting if install
1388   directory does not exist. Thanks to Dave Plonka.
1389
1390 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
1391   (paul@vix.com)
1392
1393 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
1394   Marty Leisner (leisner@sdsp.mc.xerox.com)
1395
1396 - Add a local autoconf macro to check for routines in libraries; the
1397   autoconf version is broken (it only puts the library name in the
1398   cache variable name). Thanks to John Hawkinson.
1399
1400 - Add a local autoconf macro to check for types; the autoconf version
1401   is broken (it uses grep instead of actually compiling a code fragment).
1402
1403 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
1404   formats.
1405
1406 - Extend OSF ip header workaround to versions 1 and 2.
1407
1408 - Fix some signed problems in the nfs printer. As reported by David
1409   Sacerdote (davids@silence.secnet.com)
1410
1411 - Detect group wheel and use it as the default since BSD/OS' install
1412   can't hack numeric groups. Reported by David Sacerdote.
1413
1414 - AIX needs special loader options. Thanks to Jonathan I. Kamens
1415   (jik@cam.ov.com)
1416
1417 - Fixed the nfs printer to print port numbers in decimal. Thanks to
1418   Kent Vander Velden (graphix@iastate.edu)
1419
1420 - Find installed libpcap in /usr/local/lib when not using gcc.
1421
1422 - Disallow network masks with non-network bits set.
1423
1424 - Attempt to detect "egcs" versions of gcc.
1425
1426 - Add missing closing double quotes when displaying bootp strings.
1427   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
1428
1429 v3.3 Sat Nov 30 20:56:27 PST 1996
1430
1431 - Added Linux support.
1432
1433 - GRE encapsulated packet printer thanks to John Hawkinson
1434   (jhawk@mit.edu)
1435
1436 - Rewrite gmt2local() to avoid problematic os dependencies.
1437
1438 - Suppress nfs truncation message on errors.
1439
1440 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
1441   Reported by Joachim Ott (ott@ardala.han.de)
1442
1443 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
1444
1445 - Print arp hardware type in host order. Thanks to Onno van der Linden
1446   (onno@simplex.nl)
1447
1448 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
1449   (barnett@grymoire.crd.ge.com)
1450
1451 - Fix rip printer to not print one more route than is actually in the
1452   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
1453   Bill Fenner (fenner@parc.xerox.com)
1454
1455 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
1456
1457 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
1458   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
1459
1460 - Rewrite ospf printer to improve truncation checks.
1461
1462 - Don't parse tcp options past the EOL. As noted by David Sacerdote
1463   (davids@secnet.com). Also, check tcp options to make sure they ar
1464   actually in the tcp header (in addition to the normal truncation
1465   checks). Fix the SACK code to print the N blocks (instead of the
1466   first block N times).
1467
1468 - Don't say really small UDP packets are truncated just because they
1469   aren't big enough to be a RPC. As noted by David Sacerdote.
1470
1471 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
1472
1473 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
1474   (martin@msp.se)
1475
1476 - Print mtu for icmp unreach need frag packets. Thanks to John
1477   Hawkinson (jhawk@mit.edu)
1478
1479 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
1480   (jch@bsdi.com)
1481
1482 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
1483   (kushida@trl.ibm.co.jp)
1484
1485 - Check igmp checksum if possible. Thanks to John Hawkinson.
1486
1487 - Made changes for SINIX. Thanks to Andrej Borsenkow
1488   (borsenkow.msk@sni.de)
1489
1490 - Use autoconf's idea of the top level directory in install targets.
1491   Thanks to John Hawkinson.
1492
1493 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
1494   Mogul (mogul@pa.dec.com)
1495
1496 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
1497   Thanks to John Hawkinson.
1498
1499 - Added some more packet truncation checks.
1500
1501 - On systems that have it, use sigset() instead of signal() since
1502   signal() has different semantics on these systems.
1503
1504 - Fixed some more alignment problems on the alpha.
1505
1506 - Add code to massage unprintable characters in the domain and ipx
1507   printers. Thanks to John Hawkinson.
1508
1509 - Added explicit netmask support. Thanks to Steve Nuchia
1510   (steve@research.oknet.com)
1511
1512 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
1513   Kennedy (terry@spcvxa.spc.edu)
1514
1515 - Add "atalk" keyword as suggested by John Hawkinson.
1516
1517 - Added an igrp printer. Thanks to Francis Dupont
1518   (francis.dupont@inria.fr)
1519
1520 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
1521   Kennedy (terry@spcvxa.spc.edu)
1522
1523 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
1524   (pascal.hennequin@hugo.int-evry.fr)
1525
1526 - Added some ETHERTYPEs missing on some systems.
1527
1528 - Added truncated packet macros and various checks.
1529
1530 - Fixed endian problems with the DECnet printer.
1531
1532 - Use $CC when checking gcc version. Thanks to Carl Lindberg
1533   (carl_lindberg@blacksmith.com)
1534
1535 - Fixes for AIX (although this system is not yet supported). Thanks to
1536   John Hawkinson.
1537
1538 - Fix bugs in the autoconf misaligned accesses code fragment.
1539
1540 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
1541   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
1542
1543 v3.2 Sun Jun 23 02:28:10 PDT 1996
1544
1545 - Print new icmp unreachable codes as suggested by Martin Fredriksson
1546   (martin@msp.se). Also print code value when unknown for icmp redirect
1547   and time exceeded.
1548
1549 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
1550
1551 - Define "new" domain record types if not found in arpa/nameserv.h.
1552   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
1553   fixed an endian bug when printing mx record and added some new record
1554   types.
1555
1556 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
1557
1558 - Added T/TCP options printing. As suggested by Richard Stevens
1559   (rstevens@noao.edu)
1560
1561 - Use autoconf to detect architectures that can't handle misaligned
1562   accesses.
1563
1564 v3.1 Thu Jun 13 20:59:32 PDT 1996
1565
1566 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
1567   and bind (as suggested by Charles Hannum).
1568
1569 - Port to GNU autoconf.
1570
1571 - Add support for printing DVMRP and PIM traffic thanks to
1572   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
1573
1574 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
1575   define being referenced. Reported by Terry Kennedy.
1576
1577 - Minor fixes to the man page thanks to Mark Andrews.
1578
1579 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
1580   (bmah@cs.berkeley.edu).
1581
1582 - Added support for new dns types, thanks to Rainer Orth.
1583
1584 - Fixed tftp_print() to print the block number for ACKs.
1585
1586 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
1587   (cslater@imatek.com).
1588
1589 - Check return status from malloc/calloc/etc.
1590
1591 - Check return status from pcap_loop() so we can print an error and
1592   exit with a bad status if there were problems.
1593
1594 - Bail if ip option length is <= 0. Resulted from a bug report from
1595   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
1596
1597 - Print out a little more information for sun rpc packets.
1598
1599 - Add support for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
1600
1601 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
1602   wrong on little endian machines).
1603
1604 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
1605   (crawdad@fnal.gov).
1606
1607 - Fix ntp_print() to not print garbage when the stratum is
1608   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
1609
1610 - Rewrote tcp options printer code to check for truncation. Added
1611   selective acknowledgment case.
1612
1613 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
1614   (jch@bsdi.com)
1615
1616 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
1617   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
1618   (toku@dit.co.jp)
1619
1620 - Don't checksum ip header if we don't have all of it. Thanks to John
1621   Hawkinson (jhawk@mit.edu).
1622
1623 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
1624   Honig (jhc@bsdi.com)
1625
1626
1627 v3.1a1 Wed May  3 19:21:11 PDT 1995
1628
1629 - Include time.h when SVR4 is defined to avoid problems under Solaris
1630   2.3.
1631
1632 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
1633   strings, not the local buffer. Thanks to Stefan Petri
1634   (petri@ibr.cs.tu-bs.de).
1635
1636 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
1637   that the selected value was not used. Thanks to Pascal Hennequin
1638   (Pascal.Hennequin@hugo.int-evry.fr).
1639
1640 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
1641
1642 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
1643
1644 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
1645
1646 - Although there never was a 3.0.3 release, the linux boys cleverly
1647   "released" one in late 1995.
1648
1649 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
1650
1651 - Change configuration to not use gcc v2 flags with gcc v1.
1652
1653 - Redo gmt2local() so that it works under BSDI (which seems to return
1654   an empty timezone struct from gettimeofday()). Based on report from
1655   Terry Kennedy (terry@spcvxa.spc.edu).
1656
1657 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
1658   on report from Mark Andrews (mandrews@alias.com).
1659
1660 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
1661   Orth (ro@techfak.uni-bielefeld.de).
1662
1663 - Fixed printout of connection id for uncompressed tcp slip packets.
1664   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
1665
1666 - Hack around deficiency in Ultrix's make.
1667
1668 - Add ETHERTYPE_TRAIL define which is missing from irix5.
1669
1670 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
1671
1672 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
1673
1674 v3.0 Mon Jun 20 19:23:27 PDT 1994
1675
1676 - Added support for printing tcp option timestamps thanks to
1677   Mark Andrews (mandrews@alias.com).
1678
1679 - Reorganize protocol dumpers to take const pointers to packets so they
1680   never change the contents (i.e., they used to do endian conversions
1681   in place).  Previously, whenever more than one pass was taken over
1682   the packet, the packet contents would be dumped incorrectly (i.e.,
1683   the output form -x would be wrong on little endian machines because
1684   the protocol dumpers would modify the data).  Thanks to Charles Hannum
1685   (mycroft@gnu.ai.mit.edu) for reporting this problem.
1686
1687 - Added support for decnet protocol dumping thanks to Jeff Mogul
1688   (mogul@pa.dec.com).
1689
1690 - Fix bug that caused length of packet to be incorrectly printed
1691   (off by ether header size) for unknown ethernet types thanks
1692   to Greg Miller (gmiller@kayak.mitre.org).
1693
1694 - Added support for IPX protocol dumping thanks to Brad Parker
1695   (brad@fcr.com).
1696
1697 - Added check to verify IP header checksum under -v thanks to
1698   Brad Parker (brad@fcr.com).
1699
1700 - Move packet capture code to new libpcap library (which is
1701   packaged separately).
1702
1703 - Prototype everything and assume an ansi compiler.
1704
1705 - print-arp.c: Print hardware ethernet addresses if they're not
1706   what we expect.
1707
1708 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
1709   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
1710
1711 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
1712   (mogul@pa.dec.com).
1713
1714 - print-icmp.c: Byte swap netmask before printing. Thanks to
1715   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
1716
1717 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
1718   By default, only the inner packet is dumped, appended with the token
1719   "(encap)".  Under -v, both the inner and output packets are dumped
1720   (on the same line).  Note that the filter applies to the original packet,
1721   not the encapsulated packet.  So if you run tcpdump on a net with an
1722   IP Multicast tunnel, you cannot filter out the datagrams using the
1723   conventional syntax.  (You can filter away all the ip-in-ip traffic
1724   with "not ip proto 4".)
1725
1726 - print-nfs.c: Keep pending rpc's in circular table. Add generic
1727   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
1728
1729 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
1730
1731 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
1732   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
1733   Add && and || operators
1734
1735 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
1736
1737 - Fix bug with -c flag.
1738
1739 v2.2 Fri May 22 17:19:41 PDT 1992
1740
1741 - savefile.c: Remove hack that shouldn't have been exported. Add
1742   truncate checks.
1743
1744 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
1745   matches non-echo/reply ICMP packets.
1746
1747 - Many improvements to filter code optimizer.
1748
1749 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
1750   so that protocol qualifications are allowed. For example, "ip broadcast"
1751   and "ether multicast" are valid filters.
1752
1753 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
1754   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
1755   patches to netinet/if_loop.c.
1756
1757 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
1758   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
1759
1760 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
1761
1762 v2.1 Tue Jan 28 11:00:14 PST 1992
1763
1764 - Internal release (never publicly exported).
1765
1766 v2.0.1 Sun Jan 26 21:10:10 PDT
1767
1768 - Various byte ordering fixes.
1769
1770 - Add truncation checks.
1771
1772 - inet.c: Support BSD style SIOCGIFCONF.
1773
1774 - nametoaddr.c: Handle multi addresses for single host.
1775
1776 - optimize.c: Rewritten.
1777
1778 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
1779   for broadcast nets.
1780
1781 - print-atal.c: Fix an alignment bug (thanks to
1782   stanonik@nprdc.navy.mil) Add missing printf() argument.
1783
1784 - print-bootp.c: First attempt at decoding the vendor buffer.
1785
1786 - print-domain.c: Fix truncation checks.
1787
1788 - print-icmp.c: Calculate length of packets from the ip header.
1789
1790 - print-ip.c: Print frag id in decimal (so it's easier to match up
1791   with non-frags). Add support for ospf, egp and igmp.
1792
1793 - print-nfs.c: Lots of changes.
1794
1795 - print-ntp.c: Make some verbose output depend on -v.
1796
1797 - print-snmp.c: New version from John LoVerso.
1798
1799 - print-tcp.c: Print rfc1072 tcp options.
1800
1801 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
1802   (microseconds) worth of precision. Fix uid bugs.
1803
1804 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
1805   With this option, you can create an architecture independent binary
1806   trace file in real time, without the overhead of the packet printer.
1807   At a later time, the packets can be filtered (again) and printed.
1808
1809 - BSD is supported.  You must have BPF in your kernel.
1810   Since the filtering is now done in the kernel, fewer packets are
1811   dropped.  In fact, with BPF and the packet dumper option, a measly
1812   Sun 3/50 can keep up with a busy network.
1813
1814 - Compressed SLIP packets can now be dumped, provided you use our
1815   SLIP software and BPF.  These packets are dumped as any other IP
1816   packet; the compressed headers are dumped with the '-e' option.
1817
1818 - Machines with little-endian byte ordering are supported (thanks to
1819   Jeff Mogul).
1820
1821 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
1822
1823 - IBM RT and Stanford Enetfilter support has been added by
1824   Rayan Zachariassen <rayan@canet.ca>.  tcpdump has been tested under
1825   both the vanilla Enetfilter interface, and the extended interface
1826   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
1827
1828 - TFTP packets are now printed (requests only).
1829
1830 - BOOTP packets are now printed.
1831
1832 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
1833
1834 - Sparc architectures, including the Sparcstation-1, are now
1835   supported thanks to Steve McCanne and Craig Leres.
1836
1837 - SunOS 4 is now supported thanks to Micky Liu of Columbia
1838   University (micky@cunixc.cc.columbia.edu).
1839
1840 - IP options are now printed.
1841
1842 - RIP packets are now printed.
1843
1844 - There's a -v flag that prints out more information than the
1845   default (e.g., it will enable printing of IP ttl, tos and id)
1846   and -q flag that prints out less (e.g., it will disable
1847   interpretation of AppleTalk-in-UDP).
1848
1849 - The grammar has undergone substantial changes (if you have an
1850   earlier version of tcpdump, you should re-read the manual
1851   entry).
1852
1853   The most useful change is the addition of an expression
1854   syntax that lets you filter on arbitrary fields or values in the
1855   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
1856   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
1857   packets.
1858
1859   The most painful change is that concatenation no longer means
1860   "and" -- e.g., you have to say "host foo and port bar" instead
1861   of "host foo port bar".  The up side to this down is that
1862   repeated qualifiers can be omitted, making most filter
1863   expressions shorter.  E.g., you can now say "ip host foo and
1864   (bar or baz)" to look at ip traffic between hosts foo and bar or
1865   between hosts foo and baz.  [The old way of saying this was "ip
1866   host foo and (ip host bar or ip host baz)".]
1867
1868 v2.0 Sun Jan 13 12:20:40 PST 1991
1869
1870 - Initial public release.