The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
   2   Summary for 4.99.5 tcpdump release (so far!)
   3     Refine protocol decoding for:
   4       Arista: Use the test .pcap file from pull request #955 (HwInfo).
   5       BGP: Fix an undefined behavior when it tries to parse a too-short packet.
   6       CARP: Print the protocol name before any GET_().
   7       CDP: only hex-dump unknown TLVs in verbose mode.
   8       DHCP: parse the SZTP redirect tag.
   9       DHCPv6: client-id/server-id DUID type 2 correction; Parse the user class,          boot file URL, and SZTP redirect options; Add DUID-UUID printing
  10          (RFC6355).
  11       EAP: Assign ndo_protocol in the eap_print() function.
  12       IEEE 802.11: no need for an element ID in the structures for IEs, make
  13         the length in the IE structures a u_int, include the "TA" field while
  14         printing Block Ack Control frame.
  15       IP: Enable TSO (TCP Segmentation Offload) support; fix printing invalid
  16         cases as invalid, not truncated; use ND_ICHECKMSG_ZU() to test the
  17         header length.
  18       IPv6: Fix printing invalid cases as invalid, not truncated; use
  19         ND_ICHECKMSG_U() to print an invalid version.
  20       Kerberos: Print the protocol name, remove a redundant bounds check.
  21       lwres: Fix an undefined behavior in pointer arithmetic.
  22       OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of
  23           some lengths, and fix handling of snapend.
  24       TCP: Test ports < 1024 in port order to select the printer.
  25       UDP: Move source port equal BCM_LI_PORT to bottom of long if else chain.
  26       UDP: Test ports < 1024 in port order to select the printer.
  27       LDP: Add missing fields of the Common Session Parameters TLV and fix the
  28         offset for the A&D bits.
  29       NFLOG: Use correct AF code points on all OSes.
  30       OSPF6: Fix an undefined behavior.
  31       pflog: use nd_ types in struct pfloghdr.
  32       PPP: Check if there is some data to hexdump.
  33       PTP: Fix spelling of type SIGNALING, Parse major and minor version
  34         correctly, Print majorSdoId field instead of just the first bit.
  35       RIP: Make a couple trivial protocol updates.
  36       RPKI-Router: Refine length and bounds checks.
  37       SNMP: Fix two undefined behaviors.
  38       Text protocols: Fix printing truncation if it is not the case.
  39       ZMTP: Replace custom code with bittok2str().
  40     User interface:
  41       Print the supported time stamp types (-J) to stdout instead of stderr.
  42       Print the list of data link types (-L) to stdout instead of stderr.
  43       Use symmetrical quotation characters in error messages.
  44     Source code:
  45       tcpdump: Fix a memory leak.
  46       child_cleanup: reap as many child processes as possible.
  47       Ignore failures when setting the default "any" device DLL to LINUX_SLL2.
  48       Fix for backends which doesn't support capsicum.
  49       Update ND_BYTES_BETWEEN() macro for better accuracy.
  50       Update ND_BYTES_AVAILABLE_AFTER() macro for better accuracy.
  51       Introduce new ND_ICHECK*() macros to deduplicate more code.
  52       Skip privilege dropping when using -Z root on --with-user builds.
  53       Add a nd_printjn() function.
  54       Make nd_trunc_longjmp() not static inline.
  55       Include <time.h> from netdissect.h.
  56       Remove init_crc10_table() and the entourage.
  57       Initialize tzcode early.
  58     Building and testing:
  59       Add a configure option to help debugging (--enable-instrument-functions)
  60       At build time require a proof of suitable snprintf(3) implementation in
  61         libc (and document Solaris 9 as unsupported because of that).
  62       Makefile.in: Add two "touch .devel" commands in the releasecheck target.
  63       Autoconf: Get --with-user and --with-chroot right.
  64       Autoconf: Fix --static-pcap-only test on Solaris 10.
  65       autoconf: Add some warning flags for clang 13 or newer.
  66       Autoconf: Update config.{guess,sub}, timestamps 2024-01-01.
  67       Autoconf: Add autogen.sh, remove configure and config.h.in and put
  68         these generated files in the release tarball.
  69       configure: Apply autoupdate 2.69.
  70       CMake: improve the comment before project(tcpdump C).
  71       Do not require vsnprintf().
  72
  73 Friday, April 7, 2023 / The Tcpdump Group
  74   Summary for 4.99.4 tcpdump release
  75     Source code:
  76       Fix spaces before tabs in indentation.
  77     Updated printers:
  78       LSP ping: Fix "Unused value" warnings from Coverity.
  79       CVE-2023-1801: Fix an out-of-bounds write in the SMB printer.
  80       DNS: sync resource types with IANA.
  81       ICMPv6: Update the output to show a RPL DAO field name.
  82       Geneve: Fix the Geneve UDP port test.
  83     Building and testing:
  84       Require at least autoconf 2.69.
  85       Don't check for strftime(), as it's in C90 and beyond.
  86       Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21.
  87     Documentation:
  88       man: Document TCP flag names better.
  89
  90 Thursday, January 12, 2023 / The Tcpdump Group
  91   Summary for 4.99.3 tcpdump release
  92     Updated printers:
  93       PTP: Use the proper values for the control field and print un-allocated
  94         values for the message field as "Reserved" instead of "none".
  95     Source code:
  96       smbutil.c: Replace obsolete function call (asctime)
  97     Building and testing:
  98       cmake: Update the minimum required version to 2.8.12 (except Windows).
  99       CI: Introduce and use TCPDUMP_CMAKE_TAINTED.
 100       Makefile.in: Add the releasecheck target.
 101       Makefile.in: Add "make -s install" in the releasecheck target.
 102       Cirrus CI: Run the "make releasecheck" command in the Linux task.
 103       Makefile.in: Add the whitespacecheck target.
 104       Cirrus CI: Run the "make whitespacecheck" command in the Linux task.
 105       Address all shellcheck warnings in update-test.sh.
 106       Makefile.in: Get rid of a remain of gnuc.h.
 107     Documentation:
 108       Reformat the installation notes (INSTALL.txt) in Markdown.
 109       Convert CONTRIBUTING to Markdown.
 110       CONTRIBUTING.md: Document the use of "protocol: " in a commit summary.
 111       Add a README file for NetBSD.
 112       Fix CMake build to set man page section numbers in tcpdump.1
 113
 114 Saturday, December 31, 2022 / The Tcpdump Group
 115   Summary for 4.99.2 tcpdump release
 116     Updated printers:
 117       BGP: Update cease notification decoding to RFC 9003.
 118       BGP: decode BGP link-bandwidth extended community properly.
 119       BGP: Fix parsing the AIGP attribute
 120       BGP: make sure the path attributes don't go past the end of the packet.
 121       BGP: Shutdown message can be up to 255 bytes length according to rfc9003
 122       DSA: correctly determine VID.
 123       EAP: fix some length checks and output issues.
 124       802.11: Fix the misleading comment regarding "From DS", "To DS" Frame
 125         Control Flags.
 126       802.11: Fetch the CF and TIM IEs a field at a time.
 127       802.15.4, BGP, LISP: fix some length checks, compiler warnings,
 128         and undefined behavior warnings.
 129       PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
 130         OSes.
 131       RRCP: support more Realtek protocols than just RRCP.
 132       MPLS: show the EXP field as TC, as per RFC 5462.
 133       ICMP: redo MPLS Extension code as general ICMP Extension code.
 134       VQP: Do not print unknown error codes twice.
 135       Juniper: Add some bounds checks.
 136       Juniper: Don't treat known DLT_ types as "Unknown".
 137       lwres: Fix a length check, update a variable type.
 138       EAP: Fix some undefined behaviors at runtime.
 139       Ethernet: Rework the length checks, add a length check.
 140       IPX: Add two length checks.
 141       Zephyr: Avoid printing non-ASCII characters.
 142       VRRP: Print the protocol name before any GET_().
 143       DCCP: Get rid of trailing commas in lists.
 144       Juniper: Report invalid packets as invalid, not truncated.
 145       IPv6: Remove an obsolete code in an always-false #if wrapper.
 146       ISAKMP: Use GET_U_1() to replace a direct dereference.
 147       RADIUS: Use GET_U_1() to replace a direct dereference.
 148       TCP: Fix an invalid check.
 149       RESP: Fix an invalid check.
 150       RESP: Remove an unnecessary test.
 151       Arista: Refine the output format and print HwInfo.
 152       sFlow: add support for IPv6 agent, add a length check.
 153       VRRP: add support for IPv6.
 154       OSPF: Update to match the Router Properties registry.
 155       OSPF: Remove two unnecessary dereferences.
 156       OSPF: Add support bit Nt RFC3101.
 157       OSPFv3: Remove two unnecessary dereferences.
 158       ICMPv6: Fix output for Router Renumbering messages.
 159       ICMPv6: Fix the Node Information flags.
 160       ICMPv6: Remove an unused macro and extra blank lines.
 161       ICMPv6: Add a length check in the rpl_dio_print() function.
 162       ICMPv6: Use GET_IP6ADDR_STRING() in the rpl_dio_print() function.
 163       IPv6: Add some checks for the Hop-by-Hop Options header
 164       IPv6: Add a check for the Jumbo Payload Hop-by-Hop option.
 165       NFS: Fix the format for printing an unsigned int
 166       PTP: fix printing of the correction fields
 167       PTP: Use ND_LCHECK_U for checking invalid length.
 168       WHOIS: Add its own printer source file and printer function
 169       MPTCP: print length before subtype inside MPTCP options
 170       ESP: Add a workaround to a "use-of-uninitialized-value".
 171       PPP: Add tests to avoid incorrectly re-entering ppp_hdlc().
 172       PPP: Don't process further if protocol is unknown (-e option).
 173       PPP: Change the pointer to packet data.
 174       ZEP: Add three length checks.
 175       Add some const qualifiers.
 176     Building and testing:
 177       Update config.guess and config.sub.
 178       Use AS_HELP_STRING macro instead of AC_HELP_STRING.
 179       Handle some Autoconf/make errors better.
 180       Fix an error when cross-compiling.
 181       Use "git archive" for the "make releasetar" process.
 182       Remove the release candidate rcX targets.
 183       Mend "make check" on Solaris 9 with Autoconf.
 184       Address assorted compiler warnings.
 185       Fix auto-enabling of Capsicum on FreeBSD with Autoconf.
 186       Treat "msys" as Windows for test exit statuses.
 187       Clean up some help messages in configure.
 188       Use unified diff by default.
 189       Remove awk code from mkdep.
 190       Fix configure test errors with Clang 15
 191       CMake: Prevent stripping of the RPATH on installation.
 192       AppVeyor CI: update Npcap site, update to 1.12 SDK.
 193       Cirrus CI: Use the same configuration as for the main branch.
 194       CI: Add back running tcpdump -J/-L and capture, now with Cirrus VMs.
 195       Remove four test files (They are now in the libpcap tests directory).
 196       On Solaris, for 64-bit builds, use the 64-bit pcap-config.
 197       Tell CMake not to check for a C++ compiler.
 198       CMake: Add a way to request -Werror and equivalents.
 199       configure: Special-case macOS /usr/bin/pcap-config as we do in CMake.
 200       configure: Use pcap-config --static-pcap-only if available.
 201       configure: Use ac_c_werror_flag to force unknown compiler flags to fail.
 202       configure: Use AC_COMPILE_IFELSE() and AC_LANG_SOURCE() for testing
 203         flags.
 204       Run the test that fails on OpenBSD only if we're not on OpenBSD.
 205     Source code:
 206       Fix some snapend-changing routines to protect against pointer
 207         underflow.
 208       Use __func__ from C99 in some function calls.
 209       Memory allocator: Update nd_add_alloc_list() to a static function.
 210       addrtoname.c: Fix two invalid tests.
 211       Use more S_SUCCESS and S_ERR_HOST_PROGRAM in main().
 212       Add some comments about "don't use GET_IP6ADDR_STRING()".
 213       Assign ndo->ndo_packetp in pretty_print_packet().
 214       Add ND_LCHECKMSG_U, ND_LCHECK_U, ND_LCHECKMSG_ZU and ND_LCHECK_ZU macros.
 215       Update tok2strbuf() to a static function.
 216       netdissect.h: Keep the link-layer dissectors names sorted.
 217       setsignal(): Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP)
 218         to avoid corrupting binary pcap output.
 219       Use __builtin_unreachable().
 220       Fail if nd_push_buffer() or nd_push_snaplen() fails.
 221       Improve code style and fix many typos.
 222     Documentation:
 223       Some man page cleanups.
 224       Update the print interface for the packet count to stdout.
 225       Note that we require compilers to support at least some of C99.
 226       Update AIX and Solaris-related specifics.
 227       INSTALL.txt: Add doc/README.*, delete the deleted win32 directory.
 228       Update README.md and README.Win32.md.
 229       Update some comments with new RFC numbers.
 230
 231 Wednesday, June 9, 2021 by gharris
 232   Summary for 4.99.1 tcpdump release
 233     Source code:
 234       Squelch some compiler warnings
 235       ICMP: Update the snapend for some nested IP packets.
 236       MACsec: Update the snapend thus the ICV field is not payload
 237         for the caller.
 238       EIGRP: Fix packet header fields
 239       SMB: Disable printer by default in CMake builds
 240       OLSR: Print the protocol name even if the packet is invalid
 241       MSDP: Print ": " before the protocol name
 242       ESP: Remove padding, padding length and next header from the buffer
 243       DHCPv6: Update the snapend for nested DHCPv6 packets
 244       OpenFlow 1.0: Get snapend right for nested frames.
 245       TCP: Update the snapend before decoding a MPTCP option
 246       Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks
 247       ForCES: Refine SPARSEDATA-TLV length check.
 248       ASCII/hex: Use nd_trunc_longjmp() in truncation cases
 249       GeoNet: Add a ND_TCHECK_LEN() call
 250       Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES().
 251       BGP: Fix overwrites of global 'astostr' temporary buffer
 252       ARP: fix overwrites of static buffer in q922_string().
 253       Frame Relay: have q922_string() handle errors better.
 254     Building and testing:
 255       Rebuild configure script when building release
 256       Fix "make clean" for out-of-tree autotools builds
 257       CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH.
 258     Documentation:
 259       man: Update a reference as www.cifs.org is gone. [skip ci]
 260       man: Update DNS sections
 261     Solaris:
 262       Fix a compile error with Sun C
 263
 264 Wednesday, December 30, 2020, by mcr@sandelman.ca, denis and fxl.
 265   Summary for 4.99.0 tcpdump release
 266     CVE-2018-16301: For the -F option handle large input files safely.
 267     Improve the contents, wording and formatting of the man page.
 268     Print unsupported link-layer protocol packets in hex.
 269     Add support for new network protocols and DLTs: Arista, Autosar SOME/IP,
 270       Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand
 271       (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch
 272       Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS,
 273       ZigBee Encapsulation Protocol (ZEP).
 274     Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP,
 275       ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS,
 276       NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD,
 277       VXLAN-GPE.
 278     User interface:
 279       Make SLL2 the default for Linux "any" pseudo-device.
 280       Add --micro and --nano shorthands.
 281       Add --count to print a counter only instead of decoding.
 282       Add --print, to cause packet printing even with -w.
 283       Add support for remote capture if libpcap supports it.
 284       Display the "wireless" flag and connection status.
 285       Flush the output packet buffer on a SIGUSR2.
 286       Add the snapshot length to the "reading from file ..." message.
 287       Fix local time printing (DST offset in timestamps).
 288       Allow -C arguments > 2^31-1 GB if they can fit into a long.
 289       Handle very large -f files by rejecting them.
 290       Report periodic stats only when safe to do so.
 291       Print the number of packets captured only as often as necessary.
 292       With no -s, or with -s 0, don't specify the snapshot length with newer
 293         versions of libpcap.
 294       Improve version and usage message printing.
 295     Building and testing:
 296       Install into bindir, not sbindir.
 297       autoconf: replace --with-system-libpcap with --disable-local-libpcap.
 298       Require the compiler to support C99.
 299       Better detect and use various C compilers and their features.
 300       Add CMake as the second build system.
 301       Make out-of-tree builds more reliable.
 302       Use pkg-config to detect libpcap if available.
 303       Improve Windows support.
 304       Add more tests and improve the scripts that run them.
 305       Test both with "normal" and "x87" floating-point.
 306       Eliminate dependency on libdnet.
 307     FreeBSD:
 308       Print a proper error message about monitor mode VAP.
 309       Use libcasper if available.
 310       Fix failure to capture on RDMA device.
 311       Include the correct capsicum header.
 312     Source code:
 313       Start the transition to longjmp() for packet truncation handling.
 314       Introduce new helper functions, including GET_*(), nd_print_protocol(),
 315         nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others.
 316       Put integer signedness right in many cases.
 317       Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix
 318         alignment issues, especially on SPARC.
 319       Fix many C compiler, Coverity, UBSan and cppcheck warnings.
 320       Fix issues detected with AddressSanitizer.
 321       Remove many workarounds for older compilers and OSes.
 322       Add a sanity check on packet header length.
 323       Add and remove plenty of bounds checks.
 324       Clean up pcap_findalldevs() call to find the first interface.
 325       Use a short timeout, rather than immediate mode, for text output.
 326       Handle DLT_ENC files *not* written on the same OS and byte-order host.
 327       Add, and use, macros to do locale-independent case mapping.
 328       Use a table instead of getprotobynumber().
 329       Get rid of ND_UNALIGNED and ND_TCHECK().
 330       Make roundup2() generally available.
 331       Resync SMI list against Wireshark.
 332       Fix many typos.
 333
 334 Friday, September 20, 2019, by mcr@sandelman.ca
 335   A huge thank you to Denis, Francois-Xavier and Guy who did much of the heavy lifting.
 336   Summary for 4.9.3 tcpdump release
 337     Fix buffer overflow/overread vulnerabilities:
 338       CVE-2017-16808 (AoE)
 339       CVE-2018-14468 (FrameRelay)
 340       CVE-2018-14469 (IKEv1)
 341       CVE-2018-14470 (BABEL)
 342       CVE-2018-14466 (AFS/RX)
 343       CVE-2018-14461 (LDP)
 344       CVE-2018-14462 (ICMP)
 345       CVE-2018-14465 (RSVP)
 346       CVE-2018-14881 (BGP)
 347       CVE-2018-14464 (LMP)
 348       CVE-2018-14463 (VRRP)
 349       CVE-2018-14467 (BGP)
 350       CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
 351       CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)
 352       CVE-2018-14880 (OSPF6)
 353       CVE-2018-16451 (SMB)
 354       CVE-2018-14882 (RPL)
 355       CVE-2018-16227 (802.11)
 356       CVE-2018-16229 (DCCP)
 357       CVE-2018-16230 (BGP)
 358       CVE-2018-16452 (SMB)
 359       CVE-2018-16300 (BGP)
 360       CVE-2018-16228 (HNCP)
 361       CVE-2019-15166 (LMP)
 362       CVE-2019-15167 (VRRP)
 363     Fix for cmdline argument/local issues:
 364       CVE-2018-14879 (tcpdump -V)
 365
 366 Sunday September 3, 2017 denis@ovsienko.info
 367   Summary for 4.9.2 tcpdump release
 368     Do not use getprotobynumber() for protocol name resolution.  Do not do
 369       any protocol name resolution if -n is specified.
 370     Improve errors detection in the test scripts.
 371     Fix a segfault with OpenSSL 1.1 and improve OpenSSL usage.
 372     Clean up IS-IS printing.
 373     Fix buffer overflow vulnerabilities:
 374       CVE-2017-11543 (SLIP)
 375       CVE-2017-13011 (bittok2str_internal)
 376     Fix infinite loop vulnerabilities:
 377       CVE-2017-12989 (RESP)
 378       CVE-2017-12990 (ISAKMP)
 379       CVE-2017-12995 (DNS)
 380       CVE-2017-12997 (LLDP)
 381     Fix buffer over-read vulnerabilities:
 382       CVE-2017-11541 (safeputs)
 383       CVE-2017-11542 (PIMv1)
 384       CVE-2017-12893 (SMB/CIFS)
 385       CVE-2017-12894 (lookup_bytestring)
 386       CVE-2017-12895 (ICMP)
 387       CVE-2017-12896 (ISAKMP)
 388       CVE-2017-12897 (ISO CLNS)
 389       CVE-2017-12898 (NFS)
 390       CVE-2017-12899 (DECnet)
 391       CVE-2017-12900 (tok2strbuf)
 392       CVE-2017-12901 (EIGRP)
 393       CVE-2017-12902 (Zephyr)
 394       CVE-2017-12985 (IPv6)
 395       CVE-2017-12986 (IPv6 routing headers)
 396       CVE-2017-12987 (IEEE 802.11)
 397       CVE-2017-12988 (telnet)
 398       CVE-2017-12991 (BGP)
 399       CVE-2017-12992 (RIPng)
 400       CVE-2017-12993 (Juniper)
 401       CVE-2017-12994 (BGP)
 402       CVE-2017-12996 (PIMv2)
 403       CVE-2017-12998 (ISO IS-IS)
 404       CVE-2017-12999 (ISO IS-IS)
 405       CVE-2017-13000 (IEEE 802.15.4)
 406       CVE-2017-13001 (NFS)
 407       CVE-2017-13002 (AODV)
 408       CVE-2017-13003 (LMP)
 409       CVE-2017-13004 (Juniper)
 410       CVE-2017-13005 (NFS)
 411       CVE-2017-13006 (L2TP)
 412       CVE-2017-13007 (Apple PKTAP)
 413       CVE-2017-13008 (IEEE 802.11)
 414       CVE-2017-13009 (IPv6 mobility)
 415       CVE-2017-13010 (BEEP)
 416       CVE-2017-13012 (ICMP)
 417       CVE-2017-13013 (ARP)
 418       CVE-2017-13014 (White Board)
 419       CVE-2017-13015 (EAP)
 420       CVE-2017-11543 (SLIP)
 421       CVE-2017-13016 (ISO ES-IS)
 422       CVE-2017-13017 (DHCPv6)
 423       CVE-2017-13018 (PGM)
 424       CVE-2017-13019 (PGM)
 425       CVE-2017-13020 (VTP)
 426       CVE-2017-13021 (ICMPv6)
 427       CVE-2017-13022 (IP)
 428       CVE-2017-13023 (IPv6 mobility)
 429       CVE-2017-13024 (IPv6 mobility)
 430       CVE-2017-13025 (IPv6 mobility)
 431       CVE-2017-13026 (ISO IS-IS)
 432       CVE-2017-13027 (LLDP)
 433       CVE-2017-13028 (BOOTP)
 434       CVE-2017-13029 (PPP)
 435       CVE-2017-13030 (PIM)
 436       CVE-2017-13031 (IPv6 fragmentation header)
 437       CVE-2017-13032 (RADIUS)
 438       CVE-2017-13033 (VTP)
 439       CVE-2017-13034 (PGM)
 440       CVE-2017-13035 (ISO IS-IS)
 441       CVE-2017-13036 (OSPFv3)
 442       CVE-2017-13037 (IP)
 443       CVE-2017-13038 (PPP)
 444       CVE-2017-13039 (ISAKMP)
 445       CVE-2017-13040 (MPTCP)
 446       CVE-2017-13041 (ICMPv6)
 447       CVE-2017-13042 (HNCP)
 448       CVE-2017-13043 (BGP)
 449       CVE-2017-13044 (HNCP)
 450       CVE-2017-13045 (VQP)
 451       CVE-2017-13046 (BGP)
 452       CVE-2017-13047 (ISO ES-IS)
 453       CVE-2017-13048 (RSVP)
 454       CVE-2017-13049 (Rx)
 455       CVE-2017-13050 (RPKI-Router)
 456       CVE-2017-13051 (RSVP)
 457       CVE-2017-13052 (CFM)
 458       CVE-2017-13053 (BGP)
 459       CVE-2017-13054 (LLDP)
 460       CVE-2017-13055 (ISO IS-IS)
 461       CVE-2017-13687 (Cisco HDLC)
 462       CVE-2017-13688 (OLSR)
 463       CVE-2017-13689 (IKEv1)
 464       CVE-2017-13690 (IKEv2)
 465       CVE-2017-13725 (IPv6 routing headers)
 466
 467 Sunday July 23, 2017 denis@ovsienko.info
 468   Summary for 4.9.1 tcpdump release
 469     CVE-2017-11108/Fix bounds checking for STP.
 470     Make assorted documentation updates and fix a few typos in tcpdump output.
 471     Fixup -C for file size >2GB (GH #488).
 472     Show AddressSanitizer presence in version output.
 473     Fix a bug in test scripts (exposed in GH #613).
 474     On FreeBSD adjust Capsicum capabilities for netmap.
 475     On Linux fix a use-after-free when the requested interface does not exist.
 476
 477 Wednesday January 18, 2017 devel.fx.lebail@orange.fr
 478   Summary for 4.9.0 tcpdump release
 479     General updates:
 480     Fix some heap overflows found with American Fuzzy Lop by Hanno Boeck and others
 481         (More information in the log with CVE-2016-* and CVE-2017-*)
 482     Change the way protocols print link-layer addresses (Fix heap overflows
 483         in CALM-FAST and GeoNetworking printers)
 484     Pass correct caplen value to ether_print() and some other functions
 485     Fix lookup_nsap() to match what isonsap_string() expects
 486     Clean up relative time stamp printing (Fix an array overflow)
 487     Fix some alignment issues with GCC on Solaris 10 SPARC
 488     Add some ND_TTEST_/ND_TCHECK_ macros to simplify writing bounds checks
 489     Add a fn_printztn() which returns the number of bytes processed
 490     Add nd_init() and nd_cleanup() functions. Improve libsmi support
 491     Add CONTRIBUTING file
 492     Add a summary comment in all printers
 493     Compile with more warning options in devel mode if supported (-Wcast-qual, ...)
 494     Fix some leaks found by Valgrind/Memcheck
 495     Fix a bunch of de-constifications
 496     Squelch some Coverity warnings and some compiler warnings
 497     Update Coverity and Travis-CI setup
 498     Update Visual Studio files
 499
 500     Frontend:
 501     Fix capsicum support to work with zerocopy buffers in bpf
 502     Try opening interfaces by name first, then by name-as-index
 503     Work around pcap_create() failures fetching time stamp type lists
 504     Fix a segmentation fault with 'tcpdump -J'
 505     Improve addrtostr6() bounds checking
 506     Add exit_tcpdump() function
 507     Don't drop CAP_SYS_CHROOT before chrooting
 508     Fixes issue where statistics not reported when -G and -W options used
 509
 510     Updated printers:
 511     802.11: Beginnings of 11ac radiotap support
 512     802.11: Check the Protected bit for management frames
 513     802.11: Do bounds checking on last_presentp before dereferencing it (Fix a heap overflow)
 514     802.11: Fix the radiotap printer to handle the special bits correctly
 515     802.11: If we have the MCS field, it's 11n
 516     802.11: Only print unknown frame type or subtype messages once
 517     802.11: Radiotap dBm values get printed as dB; Update a test output accordingly
 518     802.11: Source and destination addresses were backwards
 519     AH: Add a bounds check
 520     AH: Report to our caller that dissection failed if a bounds check fails
 521     AP1394: Print src > dst, not dst > src
 522     ARP: Don't assume the target hardware address is <= 6 octets long (Fix a heap overflow)
 523     ATALK: Add bounds and length checks (Fix heap overflows)
 524     ATM: Add some bounds checks (Fix a heap overflow)
 525     ATM: Fix an incorrect bounds check
 526     BFD: Update specification from draft to RFC 5880
 527     BFD: Update to print optional authentication field
 528     BGP: Add support for the AIGP attribute (RFC7311)
 529     BGP: Print LARGE_COMMUNITY Path Attribute
 530     BGP: Update BGP numbers from IANA; Print minor values for FSM notification
 531     BOOTP: Add a bounds check
 532     Babel: Add decoder for source-specific extension
 533     CDP: Filter out non-printable characters
 534     CFM: Fixes to match the IEEE standard, additional bounds and length checks
 535     CSLIP: Add more bounds checks (Fix a heap overflow)
 536     ClassicalIPoATM: Add a bounds check on LLC+SNAP header (Fix a heap overflow)
 537     DHCP: Fix MUDURL and TZ options
 538     DHCPv6: Process MUDURL and TZ options
 539     DHCPv6: Update Status Codes with RFCs/IANA names
 540     DNS: Represent the "DNSSEC OK" bit as "DO" instead of "OK". Add a test case
 541     DTP: Improve packet integrity checks
 542     EGP: Fix bounds checks
 543     ESP: Don't use OpenSSL_add_all_algorithms() in OpenSSL 1.1.0 or later
 544     Ethernet: Add some bounds checking before calling isoclns_print (Fix a heap overflow)
 545     Ethernet: Print the Length/Type field as length when needed
 546     FDDI: Fix -e output for FDDI
 547     FR: Add some packet-length checks and improve Q.933 printing (Fix heap overflows)
 548     GRE: Add some bounds checks (Fix heap overflows)
 549     Geneve: Fix error message with invalid option length; Update list option classes
 550     HNCP: Fix incorrect time interval format. Fix handling of IPv4 prefixes
 551     ICMP6: Fetch a 32-bit big-endian quantity with EXTRACT_32BITS()
 552     IGMP: Add a length check
 553     IP: Add a bounds check (Fix a heap overflow)
 554     IP: Check before fetching the protocol version (Fix a heap overflow)
 555     IP: Don't try to dissect if IP version != 4 (Fix a heap overflow)
 556     IP: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 557     IPComp: Check whether we have the CPI before we fetch it (Fix a heap overflow)
 558     IPoFC: Fix -e output (IP-over-Fibre Channel)
 559     IPv6: Don't overwrite the destination IPv6 address for routing headers
 560     IPv6: Fix header printing
 561     IPv6: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP
 562     ISAKMP: Clean up parsing of IKEv2 Security Associations
 563     ISOCLNS/IS-IS: Add support for Purge Originator Identifier (RFC6232) and test cases
 564     ISOCLNS/IS-IS: Don't overwrite packet data when checking the signature
 565     ISOCLNS/IS-IS: Filter out non-printable characters
 566     ISOCLNS/IS-IS: Fix segmentation faults
 567     ISOCLNS/IS-IS: Have signature_verify() do the copying and clearing
 568     ISOCLNS: Add some bounds checks
 569     Juniper: Make sure a Juniper header TLV isn't bigger than what's left in the packet (Fix a heap overflow)
 570     LLC/SNAP: With -e, print the LLC header before the SNAP header; without it, cut the SNAP header
 571     LLC: Add a bounds check (Fix a heap overflow)
 572     LLC: Clean up printing of LLC packets
 573     LLC: Fix the printing of RFC 948-style IP packets
 574     LLC: Skip the LLC and SNAP headers with -x for 802.11 and some other protocols
 575     LLDP: Implement IANA OUI and LLDP MUD option
 576     MPLS LSP ping: Update printing for RFC 4379, bug fixes, more bounds checks
 577     MPLS: "length" is now the *remaining* packet length
 578     MPLS: Add bounds and length checks (Fix a heap overflow)
 579     NFS: Don't assume the ONC RPC header is nicely aligned
 580     NFS: Don't overflow the Opaque_Handle buffer (Fix a segmentation fault)
 581     NFS: Don't run past the end of an NFSv3 file handle
 582     OLSR: Add a test to cover a HNA sgw case
 583     OLSR: Fix 'Advertised networks' count
 584     OLSR: Fix printing of smart-gateway HNAs in IPv4
 585     OSPF: Add a bounds check for the Hello packet options
 586     OSPF: Do more bounds checking
 587     OSPF: Fix a segmentation fault
 588     OSPF: Fix printing 'ospf_topology_values' default
 589     OTV: Add missing bounds checks
 590     PGM: Print the formatted IP address, not the raw binary address, as a string
 591     PIM: Add some bounds checking (Fix a heap overflow)
 592     PIMv2: Fix checksumming of Register messages
 593     PPP: Add some bounds checks (Fix a heap overflow)
 594     PPP: Report invalid PAP AACK/ANAK packets
 595     Q.933: Add a missing bounds check
 596     RADIUS: Add Value 13 "VLAN" to Tunnel-Type attribute
 597     RADIUS: Filter out non-printable characters
 598     RADIUS: Translate UDP/1700 as RADIUS
 599     RESP: Do better checking of RESP packets
 600     RPKI-RTR: Add a return value check for "fn_printn" call
 601     RPKI-RTR: Remove printing when truncated condition already detected
 602     RPL: Fix 'Consistency Check' control code
 603     RPL: Fix suboption print
 604     RSVP: An INTEGRITY object in a submessage covers only the submessage
 605     RSVP: Fix an infinite loop; Add bounds and length checks
 606     RSVP: Fix some if statements missing brackets
 607     RSVP: Have signature_verify() do the copying and clearing
 608     RTCP: Add some bounds checks
 609     RTP: Add some bounds checks, fix two segmentation faults
 610     SCTP: Do more bounds checking
 611     SFLOW: Fix bounds checking
 612     SLOW: Fix bugs, add checks
 613     SMB: Before fetching the flags2 field, make sure we have it
 614     SMB: Do bounds checks on NBNS resource types and resource data lengths
 615     SNMP: Clean up the "have libsmi but no modules loaded" case
 616     SNMP: Clean up the object abbreviation list and fix the code to match them
 617     SNMP: Do bounds checks when printing character and octet strings
 618     SNMP: Improve ASN.1 bounds checks
 619     SNMP: More bounds and length checks
 620     STP: Add a bunch of bounds checks, and fix some printing (Fix heap overflows)
 621     STP: Filter out non-printable characters
 622     TCP: Add bounds and length checks for packets with TCP option 20
 623     TCP: Correct TCP option Kind value for TCP Auth and add SCPS-TP
 624     TCP: Fix two bounds checks (Fix heap overflows)
 625     TCP: Make sure we have the data offset field before fetching it (Fix a heap overflow)
 626     TCP: Put TCP-AO option decoding right
 627     TFTP: Don't use strchr() to scan packet data (Fix a heap overflow)
 628     Telnet: Add some bounds checks
 629     TokenRing: Fix -e output
 630     UDLD: Fix an infinite loop
 631     UDP: Add a bounds check (Fix a heap overflow)
 632     UDP: Check against the packet length first
 633     VAT: Add some bounds checks
 634     VTP: Add a test on Mgmt Domain Name length
 635     VTP: Add bounds checks and filter out non-printable characters
 636     VXLAN: Add a bound check and a test case
 637     ZeroMQ: Fix an infinite loop
 638
 639 Tuesday October 25, 2016 mcr@sandelman.ca
 640   Summary for 4.8.1 tcpdump release
 641         Fix "-x" for Apple PKTAP and PPI packets
 642         Improve separation frontend/backend (tcpdump/libnetdissect)
 643         Fix display of timestamps with -tt, -ttt and -ttttt options
 644         Add support for the Marvell Extended Distributed Switch Architecture header
 645         Use PRIx64 to print a 64-bit number in hex.
 646         Printer for HNCP (RFCs 7787 and 7788).
 647         dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer.
 648         RSVP: Add bounds and length checks
 649         OSPF: Do more bounds checking
 650         Handle OpenSSL 1.1.x.
 651         Initial support for the REdis Serialization Protocol known as RESP.
 652         Add printing function for Generic Protocol Extension for VXLAN
 653             draft-ietf-nvo3-vxlan-gpe-01
 654         Network Service Header: draft-ietf-sfc-nsh-01
 655         Don't recompile the filter if the new file has the same DLT.
 656         Pass an adjusted struct pcap_pkthdr to the sub-printer.
 657         Add three test cases for already fixed CVEs
 658            CVE-2014-8767: OLSR
 659            CVE-2014-8768: Geonet
 660            CVE-2014-8769: AODV
 661         Don't do the DDP-over-UDP heuristic first: GitHub issue #499.
 662         Use the new debugging routines in libpcap.
 663         Harmonize TCP source or destination ports tests with UDP ones
 664         Introduce data types to use for integral values in packet structures.
 665         RSVP: Fix an infinite loop
 666         Support of Type 3 and Type 4 LISP packets.
 667         Don't require IPv6 library support in order to support IPv6 addresses.
 668         Many many changes to support libnetdissect usage.
 669         Add a test that makes unaligned accesses: GitHub issue #478.
 670         add a DNSSEC test case: GH #445 and GH #467.
 671         BGP: add decoding of ADD-PATH capability
 672         fixes to LLC header printing, and RFC948-style IP packets
 673
 674 Friday April 10, 2015 guy@alum.mit.edu
 675   Summary for 4.7.4 tcpdump release
 676         RPKI to Router Protocol: Fix Segmentation Faults and other problems
 677         RPKI to Router Protocol: print strings with fn_printn()
 678         wb: fix some bounds checks
 679
 680 Wednesday March 11, 2015 mcr@sandelman.ca
 681   Summary for 4.7.3 tcpdump release
 682         Capsicum fixes for FreeBSD 10
 683
 684 Tuesday March 10, 2015 mcr@sandelman.ca
 685   Summary for 4.7.2 tcpdump release
 686         DCCP: update Packet Types with RFC4340/IANA names
 687         fixes for CVE-2015-0261: IPv6 mobility header check issue
 688         fixes for CVE-2015-2153, 2154, 2155: kday packets
 689
 690 Friday Nov. 12, 2014 guy@alum.mit.edu
 691   Summary for 4.7.0 tcpdump release
 692         changes to hex printing of CDP packets
 693         Fix PPI printing
 694         Radius: update Packet Type Codes and Attribute Types with RFC/IANA names
 695         Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support.
 696         improvements to telnet printer, even if not -v
 697         omit length for bcp, print-tcp uses it
 698         formatting fixes for a bunch of protocols
 699         new bounds checks for a number of protocols
 700         split netflow 1,6, and 6 dissector up.
 701         added geneve dissector
 702         CVE-2014-9140 PPP dissector fixed.
 703
 704 Tuesday  Sep.  2, 2014 mcr@sandelman.ca
 705   Summary for 4.6.2 tcpdump release
 706         fix out-of-source-tree builds: find libpcap that is out of source
 707         better configure check for libsmi
 708
 709 Saturday Jul. 19, 2014 mcr@sandelman.ca
 710   Summary for 4.6.1 tcpdump release
 711         added FreeBSD capsicum
 712         add a short option '#', same as long option '--number'
 713
 714 Wednesday Jul. 2, 2014 mcr@sandelman.ca
 715   Summary for 4.6.0 tcpdump release
 716         all of tcpdump is now using the new "NDO" code base (Thanks Denis!)
 717         nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes
 718         M3UA decode added.
 719         many new test cases: 82 in 4.5.1 to 133 in 4.6.0
 720         many improvements to travis continuous integration system: OSX, and Coverity options
 721         cleaned up some unnecessary header files
 722         Added bittok2str().
 723         a number of unaligned access faults fixed
 724         -A flag does not consider CR to be printable anymore
 725         fx.lebail took over coverity baby sitting
 726         default snapshot size increased to 256K for accommodate USB captures
 727         WARNING: this release contains a lot of very worthwhile code churn.
 728
 729 Wednesday Jan. 15, 2014 guy@alum.mit.edu
 730   Summary for 4.5.2 tcpdump release
 731         Man page fix
 732         Fix crashes on SPARC
 733
 734 Monday Nov. 11, 2013 mcr@sandelman.ca
 735   Summary for 4.5.1 tcpdump release
 736         CREDITS file fixes
 737
 738 Thursday Nov. 7, 2013  mcr@sandelman.ca and guy@alum.mit.edu.
 739   Summary for 4.5.0 tcpdump release
 740         some NFSv4 fixes for printing
 741         fix printing of unknown TCP options, and tcp fast-open
 742         fixes for syslog parser
 743         some gcc-version-specific flag tuning
 744         adopt MacOS deprecation workarounds for openssl
 745         improvements to babel printing
 746         add OpenFlow 1.0 (no SSL) and test cases
 747         GeoNet printer.
 748         added STBC Rx support
 749         improvements to DHCPv6 decoder
 750         clarify which autoconf is needed
 751         Point users to the the-tcpdump-group repository on GitHub rather
 752             than the mcr repository
 753         Add MSDP printer.
 754         Fixed IPv6 check on Solaris and other OSes requiring extra
 755             networking libraries.
 756         Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03),
 757             and add "vxlan" as an option for -T.
 758         Add support for OTV (draft-hasmit-otv-04).
 759         fixes for DLT_IEEE802_11_RADIO datalink types
 760         added MPTCP decoder
 761
 762 Saturday April 6, 2013 guy@alum.mit.edu.
 763   Summary for 4.4.0 tcpdump release
 764         RPKI-RTR (RFC6810) is now official (TCP Port 323)
 765         Fix detection of OpenSSL libcrypto.
 766         Add DNSSL (RFC6106) support.
 767         Add "radius" as an option for -T.
 768         Update Action codes for handle_action function according to
 769             802.11s amendment.
 770         Decode DHCPv6 AFTR-Name option (RFC6334).
 771         Updates for Babel.
 772         Fix printing of infinite lifetime in ICMPv6.
 773         Added support for SPB, SPBM Service Identifier, and Unicast
 774             Address sub-TLV in ISIS.
 775         Decode RIPv2 authentication up to RFC4822.
 776         Fix RIP Request/full table decoding issues.
 777         On Linux systems with cap-ng.h, drop root privileges
 778             using Linux Capabilities.
 779         Add support for reading multiple files.
 780         Add MS NLB heartbeat printer.
 781         Separate multiple nexthops in BGP.
 782
 783 Wednesday  November 28, 2012 guy@alum.mit.edu.
 784   Summary for 4.3.1 tcpdump release
 785         Print "LLDP, length N" for LLDP packets even when not in verbose
 786             mode, so something is printed even if only the timestamp is
 787             present
 788         Document "-T carp"
 789         Print NTP poll interval correctly (it's an exponent, so print
 790             both its raw value and 2^value)
 791         Document that "-e" is used to get MAC addresses
 792         More clearly document that you need to escape or quote
 793             backslashes in filter expressions on the command line
 794         Fix some "the the" in the man page
 795         Use the right maximum path length
 796         Don't treat 192_1_2, when passed to -i, as an interface number
 797
 798 Friday  April 3, 2012.  mcr@sandelman.ca.
 799   Summary for 4.3.0 tcpdump release
 800         fixes for forces: SPARSE data (per RFC 5810)
 801         some more test cases added
 802         updates to documentation on -l, -U and -w flags.
 803         Fix printing of BGP optional headers.
 804         Tried to include DLT_PFSYNC support, failed due to headers required.
 805         added TIPC support.
 806         Fix LLDP Network Policy bit definitions.
 807         fixes for IGMPv3's Max Response Time: it is in units of 0.1 second.
 808         SIGUSR1 can be used rather than SIGINFO for stats
 809         permit -n flag to affect print-ip for protocol numbers
 810         ND_OPT_ADVINTERVAL is in milliseconds, not seconds
 811         Teach PPPoE parser about RFC 4638
 812
 813
 814 Friday  December 9, 2011.  guy@alum.mit.edu.
 815   Summary for 4.2.1 tcpdump release
 816         Only build the Babel printer if IPv6 is enabled.
 817         Support Babel on port 6696 as well as 6697.
 818         Include ppi.h in release tarball.
 819         Include all the test files in the release tarball, and don't
 820          "include" test files that no longer exist.
 821         Don't assume we have <rpc/rpc.h> - check for it.
 822         Support "-T carp" as a way of dissecting IP protocol 112 as CARP
 823          rather than VRRP.
 824         Support Hilscher NetAnalyzer link-layer header format.
 825         Constify some pointers and fix compiler warnings.
 826         Get rid of never-true test.
 827         Fix an unintended fall-through in a case statement in the ARP
 828          printer.
 829         Fix several cases where sizeof(sizeof(XXX)) was used when just
 830          sizeof(XXX) was intended.
 831         Make stricter sanity checks in the ES-IS printer.
 832         Get rid of some GCCisms that caused builds to fai with compilers
 833          that don't support them.
 834         Fix typo in man page.
 835         Added length checks to Babel printer.
 836
 837 Sunday  July 24, 2011.  mcr@sandelman.ca.
 838   Summary for 4.2.+
 839         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
 840           at gmail dot com>
 841         updates to forces for new port numbers
 842         Use "-H", not "-h", for the 802.11s option. (-h always help)
 843         Better ICMPv6 checksum handling.
 844         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
 845         get rid of uuencoded pcap test files, git can do binary.
 846         sFlow changes for 64-bit counters.
 847         fixes for PPI packet header handling and printing.
 848         Add DCB Exchange protocol (DCBX) version 1.01.
 849         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
 850         improvements to radiotap for rate values > 127.
 851         Many improvements to ForCES decode, including fix SCTP TML port
 852         updated RPL type code to RPL-17 draft
 853         Improve printout of DHCPv6 options.
 854         added support and test case for QinQ (802.1q VLAN) packets
 855         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
 856         Build fixes for Sparc and other machines with alignment restrictions.
 857         Merged changes from Debian package.
 858         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
 859         Build fixes for OSX (Snow Leopard and others)
 860         Add support for IEEE 802.15.4 packets
 861
 862 Tue.    July 20, 2010.  guy@alum.mit.edu.
 863   Summary for 4.1.2 tcpdump release
 864         If -U is specified, flush the file after creating it, so it's
 865           not zero-length
 866         Fix TCP flags output description, and some typos, in the man
 867           page
 868         Add a -h flag, and only attempt to recognize 802.11s mesh
 869           headers if it's set
 870         When printing the link-layer type list, send *all* output to
 871           stderr
 872         Include the CFLAGS setting when configure was run in the
 873           compiler flags
 874
 875 Thu.    April 1, 2010.  guy@alum.mit.edu.
 876   Summary for 4.1.1 tcpdump release
 877         Fix build on systems with PF, such as FreeBSD and OpenBSD.
 878         Don't blow up if a zero-length link-layer address is passed to
 879           linkaddr_string().
 880
 881 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
 882   Summary for 4.1.0 tcpdump release
 883         Fix printing of MAC addresses for VLAN frames with a length
 884           field
 885         Add some additional bounds checks and use the EXTRACT_ macros
 886           more
 887         Add a -b flag to print the AS number in BGP packets in ASDOT
 888           notation rather than ASPLAIN notation
 889         Add ICMPv6 RFC 5006 support
 890         Decode the access flags in NFS access requests
 891         Handle the new DLT_ for memory-mapped USB captures on Linux
 892         Make the default snapshot (-s) the maximum
 893         Print name of device (when -L is used)
 894         Support for OpenSolaris (and SXCE build 125 and later)
 895         Print new TCP flags
 896         Add support for RPL DIO
 897         Add support for TCP User Timeout (UTO)
 898         Add support for non-standard Ethertypes used by 3com PPPoE gear
 899         Add support for 802.11n and 802.11s
 900         Add support for Transparent Ethernet Bridge ethertype in GRE
 901         Add 4 byte AS support for BGP printer
 902         Add support for the MDT SAFI 66 BG printer
 903         Add basic IPv6 support to print-olsr
 904         Add USB printer
 905         Add printer for ForCES
 906         Handle frames with an FCS
 907         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
 908         Fix TCP sequence number printing
 909         Report 802.2 packets as 802.2 instead of 802.3
 910         Don't include -L/usr/lib in LDFLAGS
 911         On x86_64 Linux, look in lib64 directory too
 912         Lots of code clean ups
 913         Autoconf clean ups
 914         Update testcases to make output changes
 915         Fix compiling with/out smi (--with{,out}-smi)
 916         Fix compiling without IPv6 support (--disable-ipv6)
 917
 918 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
 919         Add support for Bluetooth Sniffing
 920         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
 921         Add support for 802.11 AVS
 922         Add support for SMB over TCP
 923         Add support for 4 byte BGP AS printing
 924         Add support for compiling on case-insensitive file systems
 925         Add support for ikev2 printing
 926         Update support for decoding AFS
 927         Update DHCPv6 printer
 928         Use newer libpcap API's (allows -B option on all platforms)
 929         Add -I to turn on monitor mode
 930         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
 931         Cleanup unused files and various cruft
 932
 933 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
 934         Rework ARP printer
 935         Rework OSPFv3 printer
 936         Add support for Frame-Relay ARP
 937         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
 938         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
 939         TLV: Add support for Juniper .pcap extensions
 940         Print EGP header in new-world-order style
 941         Converted print-isakmp.c to NETDISSECT
 942         Moved AF specific stuff into af.h
 943         Test subsystem now table driven, and saves outputs and diffs to one place
 944         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
 945          libpcap files on an OS other than where the file was generated
 946
 947
 948 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
 949
 950         NFS: Print unsigned values as such.
 951         RX: parse safely.
 952         BGP: fixes for IPv6-less builds.
 953         801.1ag: use standard codepoint.
 954         use /dev/bpf on systems with such a device.
 955         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
 956         smb: make sure that we haven't gone past the end of the captured data.
 957         smb: squelch an uninitialized complaint from coverity.
 958         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 959                 if it got MSG_DENIED.
 960         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 961         revised INSTALL.txt about libpcap dependency.
 962
 963 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 964         Update man page to reflect changes to libpcap
 965         Changes to both TCP and IP Printer Output
 966         Fix a potential buffer overflow in the 802.11 printer
 967         Print basic info about a few more Cisco LAN protocols.
 968         mDNS cleanup
 969         ICMP MPLS rework of the extension code
 970         bugfix: use the correct codepoint for the OSPF simple text auth token
 971          entry, and use safeputs to print the password.
 972         Add support in pflog for additional values
 973         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 974         Add support for the Message-id NACK c-type.
 975         Add support for 802.3ah loopback ctrl msg
 976         Add support for Multiple-STP as per 802.1s
 977         Add support for rapid-SPT as per 802.1w
 978         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 979          Sender-ID tlv, private tlv, port, interface status
 980         Add support for unidirectional link detection as per
 981          https://tools.ietf.org/id/draft-foschiano-udld-02.txt
 982         Add support for the olsr protocol as per RFC 3626 plus the LQ
 983          extensions from olsr.org
 984         Add support for variable-length checksum in DCCP, as per section 9 of
 985          RFC 4340.
 986         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 987         Add support for Multiple-STP as per 802.1s
 988         Add support for the cisco proprietary 'dynamic trunking protocol'
 989         Add support for the cisco proprietary VTP protocol
 990         Update dhcp6 options table as per IETF standardization activities
 991
 992
 993 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 994
 995         Fix compiling on AIX (, at end of ENUM)
 996         Updated list of DNS RR typecodes
 997         Use local Ethernet defs on WIN32
 998         Add support for Frame-Relay ARP
 999         Fixes for compiling under MSVC++
1000         Add support for parsing Juniper .pcap files
1001         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
1002         Rework the OSPFv3 printer
1003         Fix printing for 4.4BSD/NetBSD NFS Filehandles
1004         Add support for Cisco style NLPID encapsulation
1005         Add cisco prop. eigrp related, extended communities
1006         Add support for BGP signaled VPLS
1007         Cleanup the bootp printer
1008         Add support for PPP over Frame-Relay
1009         Add some bounds checking to the IP options code, and clean up
1010          the options output a bit.
1011         Add additional modp groups to ISAKMP printer
1012         Add support for Address-Withdraw and Label-Withdraw Msgs
1013         Add support for the BFD Discriminator TLV
1014         Fixes for 64bit compiling
1015         Add support for PIMv2 checksum verification
1016         Add support for further dissection of the IPCP Compression Option
1017         Add support for Cisco's proposed VQP protocol
1018         Add basic support for keyed authentication TCP option
1019         Lots of minor cosmetic changes to output printers
1020
1021
1022 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
1023         Decoder support for more Juniper link-layer types
1024         Fix a potential buffer overflow (although it can't occur in
1025                 practice).
1026         Fix the handling of unknown management frame types in the 802.11
1027                 printer.
1028         Add FRF.16 support, fix various Frame Relay bugs.
1029         Add support for RSVP integrity objects, update fast-reroute
1030                 object printer to latest spec.
1031         Clean up documentation of vlan filter expression, document mpls
1032                 filter expression.
1033         Document new pppoed and pppoes filter expressions.
1034         Update diffserver-TE codepoints as per RFC 4124.
1035         Spelling fixes in ICMPv6.
1036         Don't require any fields other than flags to be present in IS-IS
1037                 restart signaling TLVs, and only print the system ID in
1038                 those TLVs as system IDs, not as node IDs.
1039         Support for DCCP.
1040
1041 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
1042
1043         Option to chroot() when dropping privs
1044         Fixes for compiling on nearly every platform,
1045                 including improved 64bit support
1046         Many new testcases
1047         Support for sending packets
1048         Many compilation fixes on most platforms
1049         Fixes for recent version of GCC to eliminate warnings
1050         Improved Unicode support
1051
1052         Decoders & DLT Changes, Updates and New:
1053                 AES ESP support
1054                 Juniper ATM, FRF.15, FRF.16, PPPoE,
1055                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
1056                         GGSN,ES,MONITOR,SERVICES
1057                 L2VPN
1058                 Axent Raptor/Symantec Firewall
1059                 TCP-MD5 (RFC 2385)
1060                 ESP-in-UDP (RFC 3948)
1061                 ATM OAM
1062                 LMP, LMP Service Discovery
1063                 IP over FC
1064                 IP over IEEE 1394
1065                 BACnet MS/TP
1066                 SS7
1067                 LDP over TCP
1068                 LACP, MARKER as per 802.3ad
1069                 PGM (RFC 3208)
1070                 LSP-PING
1071                 G.7041/Y.1303 Generic Framing Procedure
1072                 EIGRP-IP, EIGRP-IPX
1073                 ICMP6
1074                 Radio - via radiotap
1075                 DHCPv6
1076                 HDLC over PPP
1077
1078 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
1079
1080         No changes from 3.8.2. Version bumped only to maintain consistency
1081         with libpcap 0.8.3.
1082
1083 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
1084
1085         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
1086         https://web.archive.org/web/20160328035955/https://www.rapid7.com/resources/advisories/R7-0017.jsp
1087         IP-over-IEEE1394 printing.
1088         some MINGW32 changes.
1089         updates for autoconf 2.5
1090         fixes for print-aodv.c - check for too short packets
1091         formatting changes to print-ascii for hex output.
1092         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
1093                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
1094                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
1095                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
1096         print-ether.c - better handling of unknown types.
1097         print-isoclns.c - additional decoding of types.
1098         print-llc.c - strings for LLC names added.
1099         print-pfloc.c - various enhancements
1100         print-radius.c - better decoding to strings.
1101
1102 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
1103
1104         changed syntax of -E argument so that multiple SAs can be decrypted
1105         fixes for Digital Unix headers and Documentation
1106         __attribute__ fixes
1107         CDP changes from Terry Kennedy <terry@tmk.com>.
1108         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
1109         Fixes for ASN.1 decoder for 2.100.3 forms.
1110         Added a count of packets received and processed to clarify numbers.
1111         Incorporated WinDUMP patches for Win32 builds.
1112         PPPoE payload length headers.
1113         Fixes for HP C compiler builds.
1114         Use new pcap_breakloop() and pcap_findalldevs() if we can.
1115         BGP output split into multiple lines.
1116         Fixes to 802.11 decoding.
1117         Fixes to PIM decoder.
1118         SuperH is a CPU that can't handle unaligned access. Many fixes for
1119                 unaligned access work.
1120         Fixes to Frame-Relay decoder for Q.933/922 frames.
1121         Clarified when Solaris can do captures as non-root.
1122         Added tests/ subdir for examples/regression tests.
1123         New -U flag.    -flush stdout after every packet
1124         New -A flag     -print ascii only
1125         support for decoding IS-IS inside Cisco HDLC Frames
1126         more verbosity for tftp decoder
1127         mDNS decoder
1128         new BFD decoder
1129         cross compilation patches
1130         RFC 3561 AODV support.
1131         UDP/TCP pseudo-checksum properly for source-route options.
1132         sanitized all files to modified BSD license
1133         Add support for RFC 2625 IP-over-Fibre Channel.
1134         fixes for DECnet support.
1135         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
1136         RFC 2684 encapsulation of BPDUs.
1137
1138 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
1139
1140         Fixed infinite loop when parsing invalid isakmp packets.
1141          (reported by iDefense; already fixed in CVS)
1142         Fixed infinite loop when parsing invalid BGP packets.
1143         Fixed buffer overflow with certain invalid NFS packets.
1144         Pretty-print unprintable network names in 802.11 printer.
1145         Handle truncated nbp (appletalk) packets.
1146         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
1147         Print IP protocol name even if we don't have a printer for it.
1148         Print IP protocol name or number for fragments.
1149         Print the whole MPLS label stack, not just the top label.
1150         Print request header and file handle for NFS v3 FSINFO and PATHCONF
1151          requests.
1152         Fix NFS packet truncation checks.
1153         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
1154         Handle unknown RADIUS attributes properly.
1155         Fix an ASN.1 parsing error that would cause e.g. the OID
1156          2.100.3 to be misrepresented as 4.20.3 .
1157
1158 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
1159         keyword "ipx" added.
1160         Better OSI/802.2 support on Linux.
1161         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
1162         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
1163         BXXP protocol was replaced by the BEEP protocol;
1164         improvements to SNAP demux.
1165         Changes to "any" interface documentation.
1166         Documentation on pcap_stats() counters.
1167         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
1168         Added MPLS encapsulation decoding per RFC3032.
1169         DNS dissector handles TKEY, TSIG and IXFR.
1170         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
1171         SMB printing has much improved bounds checks
1172         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
1173         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
1174         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
1175         IPX socket 0x85be is for Cisco EIGRP over IPX.
1176         Improvements to fragmented ESP handling.
1177         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
1178         Linux ARPHDR_ATM support fixed.
1179         Added a "netbeui" keyword, which selects NetBEUI packets.
1180         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
1181         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
1182         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
1183         Better Linux libc5 compat.
1184         BIND9 lwres dissector added.
1185         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
1186         Apple LocalTalk LINKTYPE_ reserved.
1187         New time stamp formats documented.
1188         DHCP6 updated to draft-22.txt spec.
1189         ICMP types/codes now accept symbolic names.
1190         Add SIGINFO handler from LBL
1191         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
1192         now we are -Wstrict-prototype clean.
1193         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
1194         PPPoE dissector cleaned up.
1195         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
1196         In dissector, now the caller prints the IP addresses rather than proto.
1197         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
1198         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
1199         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
1200         captures on the "any" device won't be done in promiscuous mode
1201         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
1202         ARCNet support, from NetBSD.
1203         HSRP dissector, from Julian Cowley <julian@lava.net>.
1204         Handle (GRE-encapsulated) PPTP
1205         added -C option to rotate save file every optarg * 1,000,000 bytes.
1206         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
1207         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
1208         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
1209         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
1210         ESP printing updated to RFC2406.
1211         HP-UX can now handle large number of PPAs.
1212         MSDP printer added.
1213         L2TP dissector improvements from Motonori Shindo.
1214
1215 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
1216         Cleaned up documentation.
1217         Promisc mode fixes for Linux
1218         IPsec changes/cleanups.
1219         Alignment fixes for picky architectures
1220
1221         Removed dependency on native headers for packet dissectors.
1222         Removed Linux specific headers that were shipped
1223
1224         libpcap changes provide for exchanging capture files between
1225           systems. Save files now have well known PACKET_ values instead of
1226           depending upon system dependent mappings of DLT_* types.
1227
1228         Support for computing/checking IP and UDP/TCP checksums.
1229
1230         Updated autoconf stock files.
1231
1232         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
1233
1234         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
1235                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
1236
1237         Added filtering support for: VLANs, ESIS, ISIS
1238
1239         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
1240                 L2TP, PPPoE
1241
1242         HP-UX 11.0 -- find the right dlpi device.
1243         Solaris 8 - IPv6 works
1244         Linux - Added support for an "any" device to capture on all interfaces
1245
1246         Security fixes: buffer overrun audit done. Strcpy replaced with
1247                 strlcpy, sprintf replaced with snprintf.
1248         Look for lex problems, and warn about them.
1249
1250
1251 v3.5 Fri Jan 28 18:00:00 PST 2000
1252
1253 Bill Fenner <fenner@research.att.com>
1254 - switch to config.h for autoconf
1255 - unify RCSID strings
1256 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
1257 - Really fix the RIP printer
1258 - Fix MAC address -> name translation.
1259 - some -Wall -Wformat fixes
1260 - update makemib to parse much of SMIv2
1261 - Print TCP sequence # with -vv even if you normally wouldn't
1262 - Print as much of IP/TCP/UDP headers as possible even if truncated.
1263
1264 itojun@iijlab.net
1265 - -X will make a ascii dump.  from netbsd.
1266 - telnet command sequence decoder (ff xx xx).  from netbsd.
1267 - print-bgp.c: improve options printing.  ugly code exists for
1268   unaligned option parsing (need some fix).
1269 - const poisoning in SMB decoder.
1270 - -Wall -Werror clean checks.
1271 - bring in KAME IPv6/IPsec decoding code.
1272
1273 Assar Westerlund  <assar@sics.se>
1274 - SNMPv2 and SNMPv3 printer
1275 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
1276   SNMP packets.
1277 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
1278 - portability fixes
1279 - permit building in different directories.
1280
1281 Ken Hornstein <kenh@cmf.nrl.navy.mil>
1282 - bring in code at
1283   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
1284   AFS3 packets
1285
1286 Andrew Tridgell <tridge@linuxcare.com>
1287 - SMB printing code
1288
1289 Love <lha@stacken.kth.se>
1290 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
1291   change date format to the right one.
1292
1293 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
1294 - Created tcpdump.org repository
1295
1296 v3.4 Sat Jul 25 12:40:55 PDT 1998
1297
1298 - Hardwire Linux slip support since it's too hard to detect.
1299
1300 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
1301   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
1302
1303 - Added -a which tries to translate network and broadcast addresses to
1304   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
1305
1306 - Added a configure option to disable gcc.
1307
1308 - Added a "raw" packet printer.
1309
1310 - Not having an interface address is no longer fatal. Requested by John
1311   Hawkinson.
1312
1313 - Rework signal setup to accommodate Linux.
1314
1315 - OSPF truncation check fix. Also display the type of OSPF packets
1316   using MD5 authentication. Thanks to Brian Wellington
1317   (bwelling@tis.com)
1318
1319 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
1320   Peisach (epeisach@mit.edu)
1321
1322 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
1323   (plonka@mfa.com)
1324
1325 - Specify full install target as a way of detecting if install
1326   directory does not exist. Thanks to Dave Plonka.
1327
1328 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
1329   (paul@vix.com)
1330
1331 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
1332   Marty Leisner (leisner@sdsp.mc.xerox.com)
1333
1334 - Add a local autoconf macro to check for routines in libraries; the
1335   autoconf version is broken (it only puts the library name in the
1336   cache variable name). Thanks to John Hawkinson.
1337
1338 - Add a local autoconf macro to check for types; the autoconf version
1339   is broken (it uses grep instead of actually compiling a code fragment).
1340
1341 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
1342   formats.
1343
1344 - Extend OSF ip header workaround to versions 1 and 2.
1345
1346 - Fix some signed problems in the nfs printer. As reported by David
1347   Sacerdote (davids@silence.secnet.com)
1348
1349 - Detect group wheel and use it as the default since BSD/OS' install
1350   can't hack numeric groups. Reported by David Sacerdote.
1351
1352 - AIX needs special loader options. Thanks to Jonathan I. Kamens
1353   (jik@cam.ov.com)
1354
1355 - Fixed the nfs printer to print port numbers in decimal. Thanks to
1356   Kent Vander Velden (graphix@iastate.edu)
1357
1358 - Find installed libpcap in /usr/local/lib when not using gcc.
1359
1360 - Disallow network masks with non-network bits set.
1361
1362 - Attempt to detect "egcs" versions of gcc.
1363
1364 - Add missing closing double quotes when displaying bootp strings.
1365   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
1366
1367 v3.3 Sat Nov 30 20:56:27 PST 1996
1368
1369 - Added Linux support.
1370
1371 - GRE encapsulated packet printer thanks to John Hawkinson
1372   (jhawk@mit.edu)
1373
1374 - Rewrite gmt2local() to avoid problematic os dependencies.
1375
1376 - Suppress nfs truncation message on errors.
1377
1378 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
1379   Reported by Joachim Ott (ott@ardala.han.de)
1380
1381 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
1382
1383 - Print arp hardware type in host order. Thanks to Onno van der Linden
1384   (onno@simplex.nl)
1385
1386 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
1387   (barnett@grymoire.crd.ge.com)
1388
1389 - Fix rip printer to not print one more route than is actually in the
1390   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
1391   Bill Fenner (fenner@parc.xerox.com)
1392
1393 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
1394
1395 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
1396   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
1397
1398 - Rewrite ospf printer to improve truncation checks.
1399
1400 - Don't parse tcp options past the EOL. As noted by David Sacerdote
1401   (davids@secnet.com). Also, check tcp options to make sure they ar
1402   actually in the tcp header (in addition to the normal truncation
1403   checks). Fix the SACK code to print the N blocks (instead of the
1404   first block N times).
1405
1406 - Don't say really small UDP packets are truncated just because they
1407   aren't big enough to be a RPC. As noted by David Sacerdote.
1408
1409 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
1410
1411 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
1412   (martin@msp.se)
1413
1414 - Print mtu for icmp unreach need frag packets. Thanks to John
1415   Hawkinson (jhawk@mit.edu)
1416
1417 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
1418   (jch@bsdi.com)
1419
1420 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
1421   (kushida@trl.ibm.co.jp)
1422
1423 - Check igmp checksum if possible. Thanks to John Hawkinson.
1424
1425 - Made changes for SINIX. Thanks to Andrej Borsenkow
1426   (borsenkow.msk@sni.de)
1427
1428 - Use autoconf's idea of the top level directory in install targets.
1429   Thanks to John Hawkinson.
1430
1431 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
1432   Mogul (mogul@pa.dec.com)
1433
1434 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
1435   Thanks to John Hawkinson.
1436
1437 - Added some more packet truncation checks.
1438
1439 - On systems that have it, use sigset() instead of signal() since
1440   signal() has different semantics on these systems.
1441
1442 - Fixed some more alignment problems on the alpha.
1443
1444 - Add code to massage unprintable characters in the domain and ipx
1445   printers. Thanks to John Hawkinson.
1446
1447 - Added explicit netmask support. Thanks to Steve Nuchia
1448   (steve@research.oknet.com)
1449
1450 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
1451   Kennedy (terry@spcvxa.spc.edu)
1452
1453 - Add "atalk" keyword as suggested by John Hawkinson.
1454
1455 - Added an igrp printer. Thanks to Francis Dupont
1456   (francis.dupont@inria.fr)
1457
1458 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
1459   Kennedy (terry@spcvxa.spc.edu)
1460
1461 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
1462   (pascal.hennequin@hugo.int-evry.fr)
1463
1464 - Added some ETHERTYPEs missing on some systems.
1465
1466 - Added truncated packet macros and various checks.
1467
1468 - Fixed endian problems with the DECnet printer.
1469
1470 - Use $CC when checking gcc version. Thanks to Carl Lindberg
1471   (carl_lindberg@blacksmith.com)
1472
1473 - Fixes for AIX (although this system is not yet supported). Thanks to
1474   John Hawkinson.
1475
1476 - Fix bugs in the autoconf misaligned accesses code fragment.
1477
1478 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
1479   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
1480
1481 v3.2 Sun Jun 23 02:28:10 PDT 1996
1482
1483 - Print new icmp unreachable codes as suggested by Martin Fredriksson
1484   (martin@msp.se). Also print code value when unknown for icmp redirect
1485   and time exceeded.
1486
1487 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
1488
1489 - Define "new" domain record types if not found in arpa/nameserv.h.
1490   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
1491   fixed an endian bug when printing mx record and added some new record
1492   types.
1493
1494 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
1495
1496 - Added T/TCP options printing. As suggested by Richard Stevens
1497   (rstevens@noao.edu)
1498
1499 - Use autoconf to detect architectures that can't handle misaligned
1500   accesses.
1501
1502 v3.1 Thu Jun 13 20:59:32 PDT 1996
1503
1504 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
1505   and bind (as suggested by Charles Hannum).
1506
1507 - Port to GNU autoconf.
1508
1509 - Add support for printing DVMRP and PIM traffic thanks to
1510   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
1511
1512 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
1513   define being referenced. Reported by Terry Kennedy.
1514
1515 - Minor fixes to the man page thanks to Mark Andrews.
1516
1517 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
1518   (bmah@cs.berkeley.edu).
1519
1520 - Added support for new dns types, thanks to Rainer Orth.
1521
1522 - Fixed tftp_print() to print the block number for ACKs.
1523
1524 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
1525   (cslater@imatek.com).
1526
1527 - Check return status from malloc/calloc/etc.
1528
1529 - Check return status from pcap_loop() so we can print an error and
1530   exit with a bad status if there were problems.
1531
1532 - Bail if ip option length is <= 0. Resulted from a bug report from
1533   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
1534
1535 - Print out a little more information for sun rpc packets.
1536
1537 - Add support for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
1538
1539 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
1540   wrong on little endian machines).
1541
1542 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
1543   (crawdad@fnal.gov).
1544
1545 - Fix ntp_print() to not print garbage when the stratum is
1546   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
1547
1548 - Rewrote tcp options printer code to check for truncation. Added
1549   selective acknowledgment case.
1550
1551 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
1552   (jch@bsdi.com)
1553
1554 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
1555   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
1556   (toku@dit.co.jp)
1557
1558 - Don't checksum ip header if we don't have all of it. Thanks to John
1559   Hawkinson (jhawk@mit.edu).
1560
1561 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
1562   Honig (jhc@bsdi.com)
1563
1564
1565 v3.1a1 Wed May  3 19:21:11 PDT 1995
1566
1567 - Include time.h when SVR4 is defined to avoid problems under Solaris
1568   2.3.
1569
1570 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
1571   strings, not the local buffer. Thanks to Stefan Petri
1572   (petri@ibr.cs.tu-bs.de).
1573
1574 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
1575   that the selected value was not used. Thanks to Pascal Hennequin
1576   (Pascal.Hennequin@hugo.int-evry.fr).
1577
1578 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
1579
1580 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
1581
1582 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
1583
1584 - Although there never was a 3.0.3 release, the linux boys cleverly
1585   "released" one in late 1995.
1586
1587 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
1588
1589 - Change configuration to not use gcc v2 flags with gcc v1.
1590
1591 - Redo gmt2local() so that it works under BSDI (which seems to return
1592   an empty timezone struct from gettimeofday()). Based on report from
1593   Terry Kennedy (terry@spcvxa.spc.edu).
1594
1595 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
1596   on report from Mark Andrews (mandrews@alias.com).
1597
1598 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
1599   Orth (ro@techfak.uni-bielefeld.de).
1600
1601 - Fixed printout of connection id for uncompressed tcp slip packets.
1602   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
1603
1604 - Hack around deficiency in Ultrix's make.
1605
1606 - Add ETHERTYPE_TRAIL define which is missing from irix5.
1607
1608 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
1609
1610 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
1611
1612 v3.0 Mon Jun 20 19:23:27 PDT 1994
1613
1614 - Added support for printing tcp option timestamps thanks to
1615   Mark Andrews (mandrews@alias.com).
1616
1617 - Reorganize protocol dumpers to take const pointers to packets so they
1618   never change the contents (i.e., they used to do endian conversions
1619   in place).  Previously, whenever more than one pass was taken over
1620   the packet, the packet contents would be dumped incorrectly (i.e.,
1621   the output form -x would be wrong on little endian machines because
1622   the protocol dumpers would modify the data).  Thanks to Charles Hannum
1623   (mycroft@gnu.ai.mit.edu) for reporting this problem.
1624
1625 - Added support for decnet protocol dumping thanks to Jeff Mogul
1626   (mogul@pa.dec.com).
1627
1628 - Fix bug that caused length of packet to be incorrectly printed
1629   (off by ether header size) for unknown ethernet types thanks
1630   to Greg Miller (gmiller@kayak.mitre.org).
1631
1632 - Added support for IPX protocol dumping thanks to Brad Parker
1633   (brad@fcr.com).
1634
1635 - Added check to verify IP header checksum under -v thanks to
1636   Brad Parker (brad@fcr.com).
1637
1638 - Move packet capture code to new libpcap library (which is
1639   packaged separately).
1640
1641 - Prototype everything and assume an ansi compiler.
1642
1643 - print-arp.c: Print hardware ethernet addresses if they're not
1644   what we expect.
1645
1646 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
1647   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
1648
1649 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
1650   (mogul@pa.dec.com).
1651
1652 - print-icmp.c: Byte swap netmask before printing. Thanks to
1653   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
1654
1655 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
1656   By default, only the inner packet is dumped, appended with the token
1657   "(encap)".  Under -v, both the inner and output packets are dumped
1658   (on the same line).  Note that the filter applies to the original packet,
1659   not the encapsulated packet.  So if you run tcpdump on a net with an
1660   IP Multicast tunnel, you cannot filter out the datagrams using the
1661   conventional syntax.  (You can filter away all the ip-in-ip traffic
1662   with "not ip proto 4".)
1663
1664 - print-nfs.c: Keep pending rpc's in circular table. Add generic
1665   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
1666
1667 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
1668
1669 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
1670   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
1671   Add && and || operators
1672
1673 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
1674
1675 - Fix bug with -c flag.
1676
1677 v2.2 Fri May 22 17:19:41 PDT 1992
1678
1679 - savefile.c: Remove hack that shouldn't have been exported. Add
1680   truncate checks.
1681
1682 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
1683   matches non-echo/reply ICMP packets.
1684
1685 - Many improvements to filter code optimizer.
1686
1687 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
1688   so that protocol qualifications are allowed. For example, "ip broadcast"
1689   and "ether multicast" are valid filters.
1690
1691 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
1692   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
1693   patches to netinet/if_loop.c.
1694
1695 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
1696   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
1697
1698 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
1699
1700 v2.1 Tue Jan 28 11:00:14 PST 1992
1701
1702 - Internal release (never publicly exported).
1703
1704 v2.0.1 Sun Jan 26 21:10:10 PDT
1705
1706 - Various byte ordering fixes.
1707
1708 - Add truncation checks.
1709
1710 - inet.c: Support BSD style SIOCGIFCONF.
1711
1712 - nametoaddr.c: Handle multi addresses for single host.
1713
1714 - optimize.c: Rewritten.
1715
1716 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
1717   for broadcast nets.
1718
1719 - print-atal.c: Fix an alignment bug (thanks to
1720   stanonik@nprdc.navy.mil) Add missing printf() argument.
1721
1722 - print-bootp.c: First attempt at decoding the vendor buffer.
1723
1724 - print-domain.c: Fix truncation checks.
1725
1726 - print-icmp.c: Calculate length of packets from the ip header.
1727
1728 - print-ip.c: Print frag id in decimal (so it's easier to match up
1729   with non-frags). Add support for ospf, egp and igmp.
1730
1731 - print-nfs.c: Lots of changes.
1732
1733 - print-ntp.c: Make some verbose output depend on -v.
1734
1735 - print-snmp.c: New version from John LoVerso.
1736
1737 - print-tcp.c: Print rfc1072 tcp options.
1738
1739 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
1740   (microseconds) worth of precision. Fix uid bugs.
1741
1742 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
1743   With this option, you can create an architecture independent binary
1744   trace file in real time, without the overhead of the packet printer.
1745   At a later time, the packets can be filtered (again) and printed.
1746
1747 - BSD is supported.  You must have BPF in your kernel.
1748   Since the filtering is now done in the kernel, fewer packets are
1749   dropped.  In fact, with BPF and the packet dumper option, a measly
1750   Sun 3/50 can keep up with a busy network.
1751
1752 - Compressed SLIP packets can now be dumped, provided you use our
1753   SLIP software and BPF.  These packets are dumped as any other IP
1754   packet; the compressed headers are dumped with the '-e' option.
1755
1756 - Machines with little-endian byte ordering are supported (thanks to
1757   Jeff Mogul).
1758
1759 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
1760
1761 - IBM RT and Stanford Enetfilter support has been added by
1762   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
1763   both the vanilla Enetfilter interface, and the extended interface
1764   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
1765
1766 - TFTP packets are now printed (requests only).
1767
1768 - BOOTP packets are now printed.
1769
1770 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
1771
1772 - Sparc architectures, including the Sparcstation-1, are now
1773   supported thanks to Steve McCanne and Craig Leres.
1774
1775 - SunOS 4 is now supported thanks to Micky Liu of Columbia
1776   University (micky@cunixc.cc.columbia.edu).
1777
1778 - IP options are now printed.
1779
1780 - RIP packets are now printed.
1781
1782 - There's a -v flag that prints out more information than the
1783   default (e.g., it will enable printing of IP ttl, tos and id)
1784   and -q flag that prints out less (e.g., it will disable
1785   interpretation of AppleTalk-in-UDP).
1786
1787 - The grammar has undergone substantial changes (if you have an
1788   earlier version of tcpdump, you should re-read the manual
1789   entry).
1790
1791   The most useful change is the addition of an expression
1792   syntax that lets you filter on arbitrary fields or values in the
1793   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
1794   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
1795   packets.
1796
1797   The most painful change is that concatenation no longer means
1798   "and" -- e.g., you have to say "host foo and port bar" instead
1799   of "host foo port bar".  The up side to this down is that
1800   repeated qualifiers can be omitted, making most filter
1801   expressions shorter.  E.g., you can now say "ip host foo and
1802   (bar or baz)" to look at ip traffic between hosts foo and bar or
1803   between hosts foo and baz.  [The old way of saying this was "ip
1804   host foo and (ip host bar or ip host baz)".]
1805
1806 v2.0 Sun Jan 13 12:20:40 PST 1991
1807
1808 - Initial public release.