The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1   Summary for 4.2.+
   2         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
   3           at gmail dot com>
   4
   5 Tue.    July 20, 2010.  guy@alum.mit.edu.
   6   Summary for 4.1.2 tcpdump release
   7         If -U is specified, flush the file after creating it, so it's
   8           not zero-length
   9         Fix TCP flags output description, and some typoes, in the man
  10           page
  11         Add a -h flag, and only attempt to recognize 802.11s mesh
  12           headers if it's set
  13         When printing the link-layer type list, send *all* output to
  14           stderr
  15         Include the CFLAGS setting when configure was run in the
  16           compiler flags
  17
  18 Thu.    April 1, 2010.  guy@alum.mit.edu.
  19   Summary for 4.1.1 tcpdump release
  20         Fix build on systems with PF, such as FreeBSD and OpenBSD.
  21         Don't blow up if a zero-length link-layer address is passed to
  22           linkaddr_string().
  23
  24 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
  25   Summary for 4.1.0 tcpdump release
  26         Fix printing of MAC addresses for VLAN frames with a length
  27           field
  28         Add some additional bounds checks and use the EXTRACT_ macros
  29           more
  30         Add a -b flag to print the AS number in BGP packets in ASDOT
  31           notation rather than ASPLAIN notation
  32         Add ICMPv6 RFC 5006 support
  33         Decode the access flags in NFS access requests
  34         Handle the new DLT_ for memory-mapped USB captures on Linux
  35         Make the default snapshot (-s) the maximum
  36         Print name of device (when -L is used)
  37         Support for OpenSolaris (and SXCE build 125 and later)
  38         Print new TCP flags
  39         Add support for RPL DIO
  40         Add support for TCP User Timeout (UTO)
  41         Add support for non-standard Ethertypes used by 3com PPPoE gear
  42         Add support for 802.11n and 802.11s
  43         Add support for Transparent Ethernet Bridge ethertype in GRE
  44         Add 4 byte AS support for BGP printer
  45         Add support for the MDT SAFI 66 BG printer
  46         Add basic IPv6 support to print-olsr
  47         Add USB printer
  48         Add printer for ForCES
  49         Handle frames with an FCS
  50         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
  51         Fix TCP sequence number printing
  52         Report 802.2 packets as 802.2 instead of 802.3
  53         Don't include -L/usr/lib in LDFLAGS
  54         On x86_64 Linux, look in lib64 directory too
  55         Lots of code clean ups
  56         Autoconf clean ups
  57         Update testcases to make output changes
  58         Fix compiling with/out smi (--with{,out}-smi)
  59         Fix compiling without IPv6 support (--disable-ipv6)
  60
  61 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
  62         Add support for Bluetooth Sniffing
  63         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
  64         Add support for 802.11 AVS
  65         Add support for SMB over TCP
  66         Add support for 4 byte BGP AS printing
  67         Add support for compiling on case-insensitive file systems
  68         Add support for ikev2 printing
  69         Update support for decoding AFS
  70         Update DHCPv6 printer
  71         Use newer libpcap API's (allows -B option on all platforms)
  72         Add -I to turn on monitor mode
  73         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
  74         Cleanup unused files and various cruft
  75
  76 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
  77         Rework ARP printer
  78         Rework OSPFv3 printer
  79         Add support for Frame-Relay ARP
  80         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
  81         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
  82         TLV: Add support for Juniper .pcap extensions
  83         Print EGP header in new-world-order style
  84         Converted print-isakmp.c to NETDISSECT
  85         Moved AF specific stuff into af.h
  86         Test subsystem now table driven, and saves outputs and diffs to one place
  87         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
  88          libpcap files on an OS other than where the file was generated
  89
  90
  91 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
  92
  93         NFS: Print unsigned values as such.
  94         RX: parse safely.
  95         BGP: fixes for IPv6-less builds.
  96         801.1ag: use standard codepoint.
  97         use /dev/bpf on systems with such a device.
  98         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
  99         smb: make sure that we haven't gone past the end of the captured data.
 100         smb: squelch an uninitialized complaint from coverity.
 101         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 102                 if it got MSG_DENIED.
 103         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 104         revised INSTALL.txt about libpcap dependancy.
 105
 106 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 107         Update man page to reflect changes to libpcap
 108         Changes to both TCP and IP Printer Output
 109         Fix a potential buffer overflow in the 802.11 printer
 110         Print basic info about a few more Cisco LAN protocols.
 111         mDNS cleanup
 112         ICMP MPLS rework of the extension code
 113         bugfix: use the correct codepoint for the OSPF simple text auth token
 114          entry, and use safeputs to print the password.
 115         Add support in pflog for additional values
 116         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 117         Add support for the Message-id NACK c-type.
 118         Add support for 802.3ah loopback ctrl msg
 119         Add support for Multiple-STP as per 802.1s
 120         Add support for rapid-SPT as per 802.1w
 121         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 122          Sender-ID tlv, private tlv, port, interface status
 123         Add support for unidirectional link detection as per
 124          http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt
 125         Add support for the olsr protocol as per RFC 3626 plus the LQ
 126          extensions from olsr.org
 127         Add support for variable-length checksum in DCCP, as per section 9 of
 128          RFC 4340.
 129         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 130         Add support for Multiple-STP as per 802.1s
 131         Add support for the cisco propriatry 'dynamic trunking protocol'
 132         Add support for the cisco proprietary VTP protocol
 133         Update dhcp6 options table as per IETF standardization activities
 134
 135
 136 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 137
 138         Fix compiling on AIX (, at end of ENUM)
 139         Updated list of DNS RR typecodes
 140         Use local Ethernet defs on WIN32
 141         Add support for Frame-Relay ARP
 142         Fixes for compiling under MSVC++
 143         Add support for parsing Juniper .pcap files
 144         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 145         Rework the OSPFv3 printer
 146         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 147         Add support for Cisco style NLPID encapsulation
 148         Add cisco prop. eigrp related, extended communities
 149         Add support for BGP signaled VPLS
 150         Cleanup the bootp printer
 151         Add support for PPP over Frame-Relay
 152         Add some bounds checking to the IP options code, and clean up
 153          the options output a bit.
 154         Add additional modp groups to ISAKMP printer
 155         Add support for Address-Withdraw and Label-Withdraw Msgs
 156         Add support for the BFD Discriminator TLV
 157         Fixes for 64bit compiling
 158         Add support for PIMv2 checksum verification
 159         Add support for further dissection of the IPCP Compression Option
 160         Add support for Cisco's proposed VQP protocol
 161         Add basic support for keyed authentication TCP option
 162         Lots of minor cosmetic changes to output printers
 163
 164
 165 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 166         Decoder support for more Juniper link-layer types
 167         Fix a potential buffer overflow (although it can't occur in
 168                 practice).
 169         Fix the handling of unknown management frame types in the 802.11
 170                 printer.
 171         Add FRF.16 support, fix various Frame Relay bugs.
 172         Add support for RSVP integrity objects, update fast-reroute
 173                 object printer to latest spec.
 174         Clean up documentation of vlan filter expression, document mpls
 175                 filter expression.
 176         Document new pppoed and pppoes filter expressions.
 177         Update diffserver-TE codepoints as per RFC 4124.
 178         Spelling fixes in ICMPv6.
 179         Don't require any fields other than flags to be present in IS-IS
 180                 restart signaling TLVs, and only print the system ID in
 181                 those TLVs as system IDs, not as node IDs.
 182         Support for DCCP.
 183
 184 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
 185
 186         Option to chroot() when dropping privs
 187         Fixes for compiling on nearly every platform,
 188                 including improved 64bit support
 189         Many new testcases
 190         Support for sending packets
 191         Many compliation fixes on most platforms
 192         Fixes for recent version of GCC to eliminate warnings
 193         Improved Unicode support
 194
 195         Decoders & DLT Changes, Updates and New:
 196                 AES ESP support
 197                 Juniper ATM, FRF.15, FRF.16, PPPoE,
 198                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
 199                         GGSN,ES,MONITOR,SERVICES
 200                 L2VPN
 201                 Axent Raptor/Symantec Firewall
 202                 TCP-MD5 (RFC 2385)
 203                 ESP-in-UDP (RFC 3948)
 204                 ATM OAM
 205                 LMP, LMP Service Discovery
 206                 IP over FC
 207                 IP over IEEE 1394
 208                 BACnet MS/TP
 209                 SS7
 210                 LDP over TCP
 211                 LACP, MARKER as per 802.3ad
 212                 PGM (RFC 3208)
 213                 LSP-PING
 214                 G.7041/Y.1303 Generic Framing Procedure
 215                 EIGRP-IP, EIGRP-IPX
 216                 ICMP6
 217                 Radio - via radiotap
 218                 DHCPv6
 219                 HDLC over PPP
 220
 221 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
 222
 223         No changes from 3.8.2. Version bumped only to maintain consistency
 224         with libpcap 0.8.3.
 225
 226 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
 227
 228         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
 229                              http://www.rapid7.com/advisories/R7-0017.html
 230         IP-over-IEEE1394 printing.
 231         some MINGW32 changes.
 232         updates for autoconf 2.5
 233         fixes for print-aodv.c - check for too short packets
 234         formatting changes to print-ascii for hex output.
 235         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
 236                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
 237                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
 238                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
 239         print-ether.c - better handling of unknown types.
 240         print-isoclns.c - additional decoding of types.
 241         print-llc.c - strings for LLC names added.
 242         print-pfloc.c - various enhancements
 243         print-radius.c - better decoding to strings.
 244
 245 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
 246
 247         changed syntax of -E argument so that multiple SAs can be decrypted
 248         fixes for Digital Unix headers and Documentation
 249         __attribute__ fixes
 250         CDP changes from Terry Kennedy <terry@tmk.com>.
 251         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
 252         Fixes for ASN.1 decoder for 2.100.3 forms.
 253         Added a count of packets received and processed to clarify numbers.
 254         Incorporated WinDUMP patches for Win32 builds.
 255         PPPoE payload length headers.
 256         Fixes for HP C compiler builds.
 257         Use new pcap_breakloop() and pcap_findalldevs() if we can.
 258         BGP output split into multiple lines.
 259         Fixes to 802.11 decoding.
 260         Fixes to PIM decoder.
 261         SuperH is a CPU that can't handle unaligned access. Many fixes for
 262                 unaligned access work.
 263         Fixes to Frame-Relay decoder for Q.933/922 frames.
 264         Clarified when Solaris can do captures as non-root.
 265         Added tests/ subdir for examples/regression tests.
 266         New -U flag.    -flush stdout after every packet
 267         New -A flag     -print ascii only
 268         support for decoding IS-IS inside Cisco HDLC Frames
 269         more verbosity for tftp decoder
 270         mDNS decoder
 271         new BFD decoder
 272         cross compilation patches
 273         RFC 3561 AODV support.
 274         UDP/TCP pseudo-checksum properly for source-route options.
 275         sanitized all files to modified BSD license
 276         Add support for RFC 2625 IP-over-Fibre Channel.
 277         fixes for DECnet support.
 278         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
 279         RFC 2684 encapsulation of BPDUs.
 280
 281 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
 282
 283         Fixed infinite loop when parsing malformed isakmp packets.
 284          (reported by iDefense; already fixed in CVS)
 285         Fixed infinite loop when parsing malformed BGP packets.
 286         Fixed buffer overflow with certain malformed NFS packets.
 287         Pretty-print unprintable network names in 802.11 printer.
 288         Handle truncated nbp (appletalk) packets.
 289         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
 290         Print IP protocol name even if we don't have a printer for it.
 291         Print IP protocol name or number for fragments.
 292         Print the whole MPLS label stack, not just the top label.
 293         Print request header and file handle for NFS v3 FSINFO and PATHCONF
 294          requests.
 295         Fix NFS packet truncation checks.
 296         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
 297         Handle unknown RADIUS attributes properly.
 298         Fix an ASN.1 parsing error that would cause e.g. the OID
 299          2.100.3 to be misrepresented as 4.20.3 .
 300
 301 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
 302 see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log.
 303         keyword "ipx" added.
 304         Better OSI/802.2 support on Linux.
 305         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
 306         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
 307         BXXP protocol was replaced by the BEEP protocol;
 308         improvements to SNAP demux.
 309         Changes to "any" interface documentation.
 310         Documentation on pcap_stats() counters.
 311         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
 312         Added MPLS encapsulation decoding per RFC3032.
 313         DNS dissector handles TKEY, TSIG and IXFR.
 314         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
 315         SMB printing has much improved bounds checks
 316         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
 317         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
 318         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
 319         IPX socket 0x85be is for Cisco EIGRP over IPX.
 320         Improvements to fragmented ESP handling.
 321         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
 322         Linux ARPHDR_ATM support fixed.
 323         Added a "netbeui" keyword, which selects NetBEUI packets.
 324         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
 325         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
 326         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
 327         Better Linux libc5 compat.
 328         BIND9 lwres dissector added.
 329         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
 330         Apple LocalTalk LINKTYPE_ reserved.
 331         New time stamp formats documented.
 332         DHCP6 updated to draft-22.txt spec.
 333         ICMP types/codes now accept symbolic names.
 334         Add SIGINFO handler from LBL
 335         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
 336         now we are -Wstrict-prototype clean.
 337         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
 338         PPPoE dissector cleaned up.
 339         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
 340         In dissector, now the caller prints the IP addresses rather than proto.
 341         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
 342         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
 343         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
 344         captures on the "any" device won't be done in promiscuous mode
 345         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
 346         ARCNet support, from NetBSD.
 347         HSRP dissector, from Julian Cowley <julian@lava.net>.
 348         Handle (GRE-encapsulated) PPTP
 349         added -C option to rotate save file every optarg * 1,000,000 bytes.
 350         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
 351         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
 352         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
 353         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
 354         ESP printing updated to RFC2406.
 355         HP-UX can now handle large number of PPAs.
 356         MSDP printer added.
 357         L2TP dissector improvements from Motonori Shindo.
 358
 359 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
 360         Cleaned up documentation.
 361         Promisc mode fixes for Linux
 362         IPsec changes/cleanups.
 363         Alignment fixes for picky architectures
 364
 365         Removed dependency on native headers for packet dissectors.
 366         Removed Linux specific headers that were shipped
 367
 368         libpcap changes provide for exchanging capture files between
 369           systems. Save files now have well known PACKET_ values instead of
 370           depending upon system dependant mappings of DLT_* types.
 371
 372         Support for computing/checking IP and UDP/TCP checksums.
 373
 374         Updated autoconf stock files.
 375
 376         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
 377
 378         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
 379                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
 380
 381         Added filtering support for: VLANs, ESIS, ISIS
 382
 383         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
 384                 L2TP, PPPoE
 385
 386         HP-UX 11.0 -- find the right dlpi device.
 387         Solaris 8 - IPv6 works
 388         Linux - Added support for an "any" device to capture on all interfaces
 389
 390         Security fixes: buffer overrun audit done. Strcpy replaced with
 391                 strlcpy, sprintf replaced with snprintf.
 392         Look for lex problems, and warn about them.
 393
 394
 395 v3.5 Fri Jan 28 18:00:00 PST 2000
 396
 397 Bill Fenner <fenner@research.att.com>
 398 - switch to config.h for autoconf
 399 - unify RCSID strings
 400 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
 401 - Really fix the RIP printer
 402 - Fix MAC address -> name translation.
 403 - some -Wall -Wformat fixes
 404 - update makemib to parse much of SMIv2
 405 - Print TCP sequence # with -vv even if you normally wouldn't
 406 - Print as much of IP/TCP/UDP headers as possible even if truncated.
 407
 408 itojun@iijlab.net
 409 - -X will make a ascii dump.  from netbsd.
 410 - telnet command sequence decoder (ff xx xx).  from netbsd.
 411 - print-bgp.c: improve options printing.  ugly code exists for
 412   unaligned option parsing (need some fix).
 413 - const poisoning in SMB decoder.
 414 - -Wall -Werror clean checks.
 415 - bring in KAME IPv6/IPsec decoding code.
 416
 417 Assar Westerlund  <assar@sics.se>
 418 - SNMPv2 and SNMPv3 printer
 419 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
 420   SNMP packets.
 421 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
 422 - portability fixes
 423 - permit building in different directories.
 424
 425 Ken Hornstein <kenh@cmf.nrl.navy.mil>
 426 - bring in code at
 427   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
 428   AFS3 packets
 429
 430 Andrew Tridgell <tridge@linuxcare.com>
 431 - SMB printing code
 432
 433 Love <lha@stacken.kth.se>
 434 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
 435   change date format to the right one.
 436
 437 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
 438 - Created tcpdump.org repository
 439
 440 v3.4 Sat Jul 25 12:40:55 PDT 1998
 441
 442 - Hardwire Linux slip support since it's too hard to detect.
 443
 444 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
 445   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
 446
 447 - Added -a which tries to translate network and broadcast addresses to
 448   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
 449
 450 - Added a configure option to disable gcc.
 451
 452 - Added a "raw" packet printer.
 453
 454 - Not having an interface address is no longer fatal. Requested by John
 455   Hawkinson.
 456
 457 - Rework signal setup to accommodate Linux.
 458
 459 - OSPF truncation check fix. Also display the type of OSPF packets
 460   using MD5 authentication. Thanks to Brian Wellington
 461   (bwelling@tis.com)
 462
 463 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
 464   Peisach (epeisach@mit.edu)
 465
 466 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
 467   (plonka@mfa.com)
 468
 469 - Specify full install target as a way of detecting if install
 470   directory does not exist. Thanks to Dave Plonka.
 471
 472 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
 473   (paul@vix.com)
 474
 475 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
 476   Marty Leisner (leisner@sdsp.mc.xerox.com)
 477
 478 - Add a local autoconf macro to check for routines in libraries; the
 479   autoconf version is broken (it only puts the library name in the
 480   cache variable name). Thanks to John Hawkinson.
 481
 482 - Add a local autoconf macro to check for types; the autoconf version
 483   is broken (it uses grep instead of actually compiling a code fragment).
 484
 485 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
 486   formats.
 487
 488 - Extend OSF ip header workaround to versions 1 and 2.
 489
 490 - Fix some signed problems in the nfs printer. As reported by David
 491   Sacerdote (davids@silence.secnet.com)
 492
 493 - Detect group wheel and use it as the default since BSD/OS' install
 494   can't hack numeric groups. Reported by David Sacerdote.
 495
 496 - AIX needs special loader options. Thanks to Jonathan I. Kamens
 497   (jik@cam.ov.com)
 498
 499 - Fixed the nfs printer to print port numbers in decimal. Thanks to
 500   Kent Vander Velden (graphix@iastate.edu)
 501
 502 - Find installed libpcap in /usr/local/lib when not using gcc.
 503
 504 - Disallow network masks with non-network bits set.
 505
 506 - Attempt to detect "egcs" versions of gcc.
 507
 508 - Add missing closing double quotes when displaying bootp strings.
 509   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
 510
 511 v3.3 Sat Nov 30 20:56:27 PST 1996
 512
 513 - Added Linux support.
 514
 515 - GRE encapsulated packet printer thanks to John Hawkinson
 516   (jhawk@mit.edu)
 517
 518 - Rewrite gmt2local() to avoid problematic os dependencies.
 519
 520 - Suppress nfs truncation message on errors.
 521
 522 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
 523   Reported by Joachim Ott (ott@ardala.han.de)
 524
 525 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
 526
 527 - Print arp hardware type in host order. Thanks to Onno van der Linden
 528   (onno@simplex.nl)
 529
 530 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
 531   (barnett@grymoire.crd.ge.com)
 532
 533 - Fix rip printer to not print one more route than is actually in the
 534   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
 535   Bill Fenner (fenner@parc.xerox.com)
 536
 537 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
 538
 539 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
 540   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
 541
 542 - Rewrite ospf printer to improve truncation checks.
 543
 544 - Don't parse tcp options past the EOL. As noted by David Sacerdote
 545   (davids@secnet.com). Also, check tcp options to make sure they ar
 546   actually in the tcp header (in addition to the normal truncation
 547   checks). Fix the SACK code to print the N blocks (instead of the
 548   first block N times).
 549
 550 - Don't say really small UDP packets are truncated just because they
 551   aren't big enough to be a RPC. As noted by David Sacerdote.
 552
 553 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
 554
 555 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
 556   (martin@msp.se)
 557
 558 - Print mtu for icmp unreach need frag packets. Thanks to John
 559   Hawkinson (jhawk@mit.edu)
 560
 561 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
 562   (jch@bsdi.com)
 563
 564 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
 565   (kushida@trl.ibm.co.jp)
 566
 567 - Check igmp checksum if possible. Thanks to John Hawkinson.
 568
 569 - Made changes for SINIX. Thanks to Andrej Borsenkow
 570   (borsenkow.msk@sni.de)
 571
 572 - Use autoconf's idea of the top level directory in install targets.
 573   Thanks to John Hawkinson.
 574
 575 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
 576   Mogul (mogul@pa.dec.com)
 577
 578 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
 579   Thanks to John Hawkinson.
 580
 581 - Added some more packet truncation checks.
 582
 583 - On systems that have it, use sigset() instead of signal() since
 584   signal() has different semantics on these systems.
 585
 586 - Fixed some more alignment problems on the alpha.
 587
 588 - Add code to massage unprintable characters in the domain and ipx
 589   printers. Thanks to John Hawkinson.
 590
 591 - Added explicit netmask support. Thanks to Steve Nuchia
 592   (steve@research.oknet.com)
 593
 594 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
 595   Kennedy (terry@spcvxa.spc.edu)
 596
 597 - Add "atalk" keyword as suggested by John Hawkinson.
 598
 599 - Added an igrp printer. Thanks to Francis Dupont
 600   (francis.dupont@inria.fr)
 601
 602 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
 603   Kennedy (terry@spcvxa.spc.edu)
 604
 605 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
 606   (pascal.hennequin@hugo.int-evry.fr)
 607
 608 - Added some ETHERTYPEs missing on some systems.
 609
 610 - Added truncated packet macros and various checks.
 611
 612 - Fixed endian problems with the DECnet printer.
 613
 614 - Use $CC when checking gcc version. Thanks to Carl Lindberg
 615   (carl_lindberg@blacksmith.com)
 616
 617 - Fixes for AIX (although this system is not yet supported). Thanks to
 618   John Hawkinson.
 619
 620 - Fix bugs in the autoconf misaligned accesses code fragment.
 621
 622 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
 623   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
 624
 625 v3.2 Sun Jun 23 02:28:10 PDT 1996
 626
 627 - Print new icmp unreachable codes as suggested by Martin Fredriksson
 628   (martin@msp.se). Also print code value when unknown for icmp redirect
 629   and time exceeded.
 630
 631 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
 632
 633 - Define "new" domain record types if not found in arpa/nameserv.h.
 634   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
 635   fixed an endian bug when printing mx record and added some new record
 636   types.
 637
 638 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
 639
 640 - Added T/TCP options printing. As suggested by Richard Stevens
 641   (rstevens@noao.edu)
 642
 643 - Use autoconf to detect architectures that can't handle misaligned
 644   accesses.
 645
 646 v3.1 Thu Jun 13 20:59:32 PDT 1996
 647
 648 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
 649   and bind (as suggested by Charles Hannum).
 650
 651 - Port to GNU autoconf.
 652
 653 - Add support for printing DVMRP and PIM traffic thanks to
 654   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
 655
 656 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
 657   define being referenced. Reported by Terry Kennedy.
 658
 659 - Minor fixes to the man page thanks to Mark Andrews.
 660
 661 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
 662   (bmah@cs.berkeley.edu).
 663
 664 - Added support for new dns types, thanks to Rainer Orth.
 665
 666 - Fixed tftp_print() to print the block number for ACKs.
 667
 668 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
 669   (cslater@imatek.com).
 670
 671 - Check return status from malloc/calloc/etc.
 672
 673 - Check return status from pcap_loop() so we can print an error and
 674   exit with a bad status if there were problems.
 675
 676 - Bail if ip option length is <= 0. Resulted from a bug report from
 677   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
 678
 679 - Print out a little more information for sun rpc packets.
 680
 681 - Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
 682
 683 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
 684   wrong on little endian machines).
 685
 686 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
 687   (crawdad@fnal.gov).
 688
 689 - Fix ntp_print() to not print garbage when the stratum is
 690   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
 691
 692 - Rewrote tcp options printer code to check for truncation. Added
 693   selective acknowledgment case.
 694
 695 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
 696   (jch@bsdi.com)
 697
 698 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
 699   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
 700   (toku@dit.co.jp)
 701
 702 - Don't checksum ip header if we don't have all of it. Thanks to John
 703   Hawkinson (jhawk@mit.edu).
 704
 705 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
 706   Honig (jhc@bsdi.com)
 707
 708
 709 v3.1a1 Wed May  3 19:21:11 PDT 1995
 710
 711 - Include time.h when SVR4 is defined to avoid problems under Solaris
 712   2.3.
 713
 714 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
 715   strings, not the local buffer. Thanks to Stefan Petri
 716   (petri@ibr.cs.tu-bs.de).
 717
 718 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
 719   that the selected value was not used. Thanks to Pascal Hennequin
 720   (Pascal.Hennequin@hugo.int-evry.fr).
 721
 722 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
 723
 724 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
 725
 726 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
 727
 728 - Although there never was a 3.0.3 release, the linux boys cleverly
 729   "released" one in late 1995.
 730
 731 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
 732
 733 - Change configuration to not use gcc v2 flags with gcc v1.
 734
 735 - Redo gmt2local() so that it works under BSDI (which seems to return
 736   an empty timezone struct from gettimeofday()). Based on report from
 737   Terry Kennedy (terry@spcvxa.spc.edu).
 738
 739 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
 740   on report from Mark Andrews (mandrews@alias.com).
 741
 742 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
 743   Orth (ro@techfak.uni-bielefeld.de).
 744
 745 - Fixed printout of connection id for uncompressed tcp slip packets.
 746   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
 747
 748 - Hack around deficiency in Ultrix's make.
 749
 750 - Add ETHERTYPE_TRAIL define which is missing from irix5.
 751
 752 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
 753
 754 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
 755
 756 v3.0 Mon Jun 20 19:23:27 PDT 1994
 757
 758 - Added support for printing tcp option timestamps thanks to
 759   Mark Andrews (mandrews@alias.com).
 760
 761 - Reorganize protocol dumpers to take const pointers to packets so they
 762   never change the contents (i.e., they used to do endian conversions
 763   in place).  Previously, whenever more than one pass was taken over
 764   the packet, the packet contents would be dumped incorrectly (i.e.,
 765   the output form -x would be wrong on little endian machines because
 766   the protocol dumpers would modify the data).  Thanks to Charles Hannum
 767   (mycroft@gnu.ai.mit.edu) for reporting this problem.
 768
 769 - Added support for decnet protocol dumping thanks to Jeff Mogul
 770   (mogul@pa.dec.com).
 771
 772 - Fix bug that caused length of packet to be incorrectly printed
 773   (off by ether header size) for unknown ethernet types thanks
 774   to Greg Miller (gmiller@kayak.mitre.org).
 775
 776 - Added support for IPX protocol dumping thanks to Brad Parker
 777   (brad@fcr.com).
 778
 779 - Added check to verify IP header checksum under -v thanks to
 780   Brad Parker (brad@fcr.com).
 781
 782 - Move packet capture code to new libpcap library (which is
 783   packaged separately).
 784
 785 - Prototype everything and assume an ansi compiler.
 786
 787 - print-arp.c: Print hardware ethernet addresses if they're not
 788   what we expect.
 789
 790 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
 791   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
 792
 793 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
 794   (mogul@pa.dec.com).
 795
 796 - print-icmp.c: Byte swap netmask before printing. Thanks to
 797   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
 798
 799 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
 800   By default, only the inner packet is dumped, appended with the token
 801   "(encap)".  Under -v, both the inner and output packets are dumped
 802   (on the same line).  Note that the filter applies to the original packet,
 803   not the encapsulated packet.  So if you run tcpdump on a net with an
 804   IP Multicast tunnel, you cannot filter out the datagrams using the
 805   conventional syntax.  (You can filter away all the ip-in-ip traffic
 806   with "not ip proto 4".)
 807
 808 - print-nfs.c: Keep pending rpc's in circular table. Add generic
 809   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
 810
 811 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
 812
 813 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
 814   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
 815   Add && and || operators
 816
 817 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
 818
 819 - Fix bug with -c flag.
 820
 821 v2.2 Fri May 22 17:19:41 PDT 1992
 822
 823 - savefile.c: Remove hack that shouldn't have been exported. Add
 824   truncate checks.
 825
 826 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
 827   matches non-echo/reply ICMP packets.
 828
 829 - Many improvements to filter code optimizer.
 830
 831 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
 832   so that protocol qualifications are allowed. For example, "ip broadcast"
 833   and "ether multicast" are valid filters.
 834
 835 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
 836   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
 837   patches to netinet/if_loop.c.
 838
 839 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
 840   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
 841
 842 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
 843
 844 v2.1 Tue Jan 28 11:00:14 PST 1992
 845
 846 - Internal release (never publically exported).
 847
 848 v2.0.1 Sun Jan 26 21:10:10 PDT
 849
 850 - Various byte ordering fixes.
 851
 852 - Add truncation checks.
 853
 854 - inet.c: Support BSD style SIOCGIFCONF.
 855
 856 - nametoaddr.c: Handle multi addresses for single host.
 857
 858 - optimize.c: Rewritten.
 859
 860 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
 861   for broadcast nets.
 862
 863 - print-atal.c: Fix an alignment bug (thanks to
 864   stanonik@nprdc.navy.mil) Add missing printf() argument.
 865
 866 - print-bootp.c: First attempt at decoding the vendor buffer.
 867
 868 - print-domain.c: Fix truncation checks.
 869
 870 - print-icmp.c: Calculate length of packets from the ip header.
 871
 872 - print-ip.c: Print frag id in decimal (so it's easier to match up
 873   with non-frags). Add support for ospf, egp and igmp.
 874
 875 - print-nfs.c: Lots of changes.
 876
 877 - print-ntp.c: Make some verbose output depend on -v.
 878
 879 - print-snmp.c: New version from John LoVerso.
 880
 881 - print-tcp.c: Print rfc1072 tcp options.
 882
 883 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
 884   (microseconds) worth of precision. Fix uid bugs.
 885
 886 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
 887   With this option, you can create an architecture independent binary
 888   trace file in real time, without the overhead of the packet printer.
 889   At a later time, the packets can be filtered (again) and printed.
 890
 891 - BSD is supported.  You must have BPF in your kernel.
 892   Since the filtering is now done in the kernel, fewer packets are
 893   dropped.  In fact, with BPF and the packet dumper option, a measly
 894   Sun 3/50 can keep up with a busy network.
 895
 896 - Compressed SLIP packets can now be dumped, provided you use our
 897   SLIP software and BPF.  These packets are dumped as any other IP
 898   packet; the compressed headers are dumped with the '-e' option.
 899
 900 - Machines with little-endian byte ordering are supported (thanks to
 901   Jeff Mogul).
 902
 903 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
 904
 905 - IBM RT and Stanford Enetfilter support has been added by
 906   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
 907   both the vanilla Enetfilter interface, and the extended interface
 908   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
 909
 910 - TFTP packets are now printed (requests only).
 911
 912 - BOOTP packets are now printed.
 913
 914 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
 915
 916 - Sparc architectures, including the Sparcstation-1, are now
 917   supported thanks to Steve McCanne and Craig Leres.
 918
 919 - SunOS 4 is now supported thanks to Micky Liu of Columbia
 920   University (micky@cunixc.cc.columbia.edu).
 921
 922 - IP options are now printed.
 923
 924 - RIP packets are now printed.
 925
 926 - There's a -v flag that prints out more information than the
 927   default (e.g., it will enable printing of IP ttl, tos and id)
 928   and -q flag that prints out less (e.g., it will disable
 929   interpretation of AppleTalk-in-UDP).
 930
 931 - The grammar has undergone substantial changes (if you have an
 932   earlier version of tcpdump, you should re-read the manual
 933   entry).
 934
 935   The most useful change is the addition of an expression
 936   syntax that lets you filter on arbitrary fields or values in the
 937   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
 938   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
 939   packets.
 940
 941   The most painful change is that concatenation no longer means
 942   "and" -- e.g., you have to say "host foo and port bar" instead
 943   of "host foo port bar".  The up side to this down is that
 944   repeated qualifiers can be omitted, making most filter
 945   expressions shorter.  E.g., you can now say "ip host foo and
 946   (bar or baz)" to look at ip traffic between hosts foo and bar or
 947   between hosts foo and baz.  [The old way of saying this was "ip
 948   host foo and (ip host bar or ip host baz)".]
 949
 950 v2.0 Sun Jan 13 12:20:40 PST 1991
 951
 952 - Initial public release.