The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 Tuesday October 25, 2016 mcr@sandelman.ca
   2   Summary for 4.8.1 tcpdump release
   3         Fix "-x" for Apple PKTAP and PPI packets
   4         Use PRIx64 to print a 64-bit number in hex.
   5         Printer for HNCP (RFCs 7787 and 7788).
   6         dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer.
   7         RSVP: Add bounds and length checks
   8         OSPF: Do more bounds checking
   9         Handle OpenSSL 1.1.x.
  10         Initial support for the REdis Serialization Protocol known as RESP.
  11         Add printing function for Generic Protocol Extension for VXLAN
  12             draft-ietf-nvo3-vxlan-gpe-01
  13         Network Service Header: draft-ietf-sfc-nsh-01
  14         Don't recompile the filter if the new file has the same DLT.
  15         Pass an adjusted struct pcap_pkthdr to the sub-printer.
  16         Add three test cases for already fixed CVEs
  17            CVE-2014-8767: OLSR
  18            CVE-2014-8768: Geonet
  19            CVE-2014-8769: AODV
  20         Don't do the DDP-over-UDP heuristic first: GitHub issue #499.
  21         Use the new debugging routines in libpcap.
  22         Harmonize TCP source or destination ports tests with UDP ones
  23         Introduce data types to use for integral values in packet structures.
  24         RSVP: Fix an infinite loop
  25         Support of Type 3 and Type 4 LISP packets.
  26         Don't require IPv6 library support in order to support IPv6 addresses.
  27         Many many changes to support libnetdissect usage.
  28         Add a test that makes unaligned accesses: GitHub issue #478.
  29         add a DNSSEC test case: GH #445 and GH #467.
  30         BGP: add decoding of ADD-PATH capability
  31         fixes to LLC header printing, and RFC948-style IP packets
  32
  33 Friday April 10, 2015 guy@alum.mit.edu
  34   Summary for 4.7.4 tcpdump release
  35         RPKI to Router Protocol: Fix Segmentation Faults and other problems
  36         RPKI to Router Protocol: print strings with fn_printn()
  37         wb: fix some bounds checks
  38
  39 Wednesday March 11, 2015 mcr@sandelman.ca
  40   Summary for 4.7.3 tcpdump release
  41         Capsicum fixes for FreeBSD 10
  42
  43 Tuesday March 10, 2015 mcr@sandelman.ca
  44   Summary for 4.7.2 tcpdump release
  45         DCCP: update Packet Types with RFC4340/IANA names
  46         fixes for CVE-2015-0261: IPv6 mobility header check issue
  47         fixes for CVE-2015-2153, 2154, 2155: kday packets
  48
  49 Friday Nov. 12, 2014 guy@alum.mit.edu
  50   Summary for 4.7.0 tcpdump release
  51         changes to hex printing of CDP packets
  52         Fix PPI printing
  53         Radius: update Packet Type Codes and Attribute Types with RFC/IANA names
  54         Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support.
  55         improvements to telnet printer, even if not -v
  56         omit length for bcp, print-tcp uses it
  57         formatting fixes for a bunch of protocols
  58         new bounds checks for a number of protocols
  59         split netflow 1,6, and 6 dissector up.
  60         added geneve dissector
  61         CVE-2014-9140 PPP dissector fixed.
  62
  63 Tuesday  Sep.  2, 2014 mcr@sandelman.ca
  64   Summary for 4.6.2 tcpdump release
  65         fix out-of-source-tree builds: find libpcap that is out of source
  66         better configure check for libsmi
  67
  68 Saturday Jul. 19, 2014 mcr@sandelman.ca
  69   Summary for 4.6.1 tcpdump release
  70         added FreeBSD capsicum
  71         add a short option '#', same as long option '--number'
  72
  73 Wednesday Jul. 2, 2014 mcr@sandelman.ca
  74   Summary for 4.6.0 tcpdump release
  75         all of tcpdump is now using the new "NDO" code base (Thanks Denis!)
  76         nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes
  77         M3UA decode added.
  78         many new test cases: 82 in 4.5.1 to 133 in 4.6.0
  79         many improvements to travis continuous integration system: OSX, and Coverity options
  80         cleaned up some unnecessary header files
  81         Added bittok2str().
  82         a number of unaligned access faults fixed
  83         -A flag does not consider CR to be printable anymore
  84         fx.lebail took over coverity baby sitting
  85         default snapshot size increased to 256K for accomodate USB captures
  86         WARNING: this release contains a lot of very worthwhile code churn.
  87
  88 Wednesday Jan. 15, 2014 guy@alum.mit.edu
  89   Summary for 4.5.2 tcpdump release
  90         Man page fix
  91         Fix crashes on SPARC
  92
  93 Monday Nov. 11, 2013 mcr@sandelman.ca
  94   Summary for 4.5.1 tcpdump release
  95         CREDITS file fixes
  96
  97 Thursday Nov. 7, 2013  mcr@sandelman.ca and guy@alum.mit.edu.
  98   Summary for 4.5.0 tcpdump release
  99         some NFSv4 fixes for printing
 100         fix printing of unknown TCP options, and tcp fast-open
 101         fixes for syslog parser
 102         some gcc-version-specific flag tuning
 103         adopt MacOS deprecation workarounds for openssl
 104         improvements to babel printing
 105         add OpenFlow 1.0 (no SSL) and test cases
 106         GeoNet printer.
 107         added STBC Rx support
 108         improvements to DHCPv6 decoder
 109         clarify which autoconf is needed
 110         Point users to the the-tcpdump-group repository on GitHub rather
 111             than the mcr repository
 112         Add MSDP printer.
 113         Fixed IPv6 check on Solaris and other OSes requiring extra
 114             networking libraries.
 115         Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03),
 116             and add "vxlan" as an option for -T.
 117         Add support for OTV (draft-hasmit-otv-04).
 118         fixes for DLT_IEEE802_11_RADIO datalink types
 119         added MPTCP decoder
 120
 121 Saturday April 6, 2013 guy@alum.mit.edu.
 122   Summary for 4.4.0 tcpdump release
 123         RPKI-RTR (RFC6810) is now official (TCP Port 323)
 124         Fix detection of OpenSSL libcrypto.
 125         Add DNSSL (RFC6106) support.
 126         Add "radius" as an option for -T.
 127         Update Action codes for handle_action function according to
 128             802.11s amendment.
 129         Decode DHCPv6 AFTR-Name option (RFC6334).
 130         Updates for Babel.
 131         Fix printing of infinite lifetime in ICMPv6.
 132         Added support for SPB, SPBM Service Identifier, and Unicast
 133             Address sub-TLV in ISIS.
 134         Decode RIPv2 authentication up to RFC4822.
 135         Fix RIP Request/full table decoding issues.
 136         On Linux systems with cap-ng.h, drop root privileges
 137             using Linux Capabilities.
 138         Add support for reading multiple files.
 139         Add MS NLB heartbeat printer.
 140         Separate multiple nexthops in BGP.
 141
 142 Wednesday  November 28, 2012 guy@alum.mit.edu.
 143   Summary for 4.3.1 tcpdump release
 144         Print "LLDP, length N" for LLDP packets even when not in verbose
 145             mode, so something is printed even if only the timestamp is
 146             present
 147         Document "-T carp"
 148         Print NTP poll interval correctly (it's an exponent, so print
 149             both its raw value and 2^value)
 150         Document that "-e" is used to get MAC addresses
 151         More clearly document that you need to escape or quote
 152             backslashes in filter expressions on the command line
 153         Fix some "the the" in the man page
 154         Use the right maximum path length
 155         Don't treat 192_1_2, when passed to -i, as an interface number
 156
 157 Friday  April 3, 2012.  mcr@sandelman.ca.
 158   Summary for 4.3.0 tcpdump release
 159         fixes for forces: SPARSE data (per RFC 5810)
 160         some more test cases added
 161         updates to documentation on -l, -U and -w flags.
 162         Fix printing of BGP optional headers.
 163         Tried to include DLT_PFSYNC support, failed due to headers required.
 164         added TIPC support.
 165         Fix LLDP Network Policy bit definitions.
 166         fixes for IGMPv3's Max Response Time: it is in units of 0.1 second.
 167         SIGUSR1 can be used rather than SIGINFO for stats
 168         permit -n flag to affect print-ip for protocol numbers
 169         ND_OPT_ADVINTERVAL is in milliseconds, not seconds
 170         Teach PPPoE parser about RFC 4638
 171
 172
 173 Friday  December 9, 2011.  guy@alum.mit.edu.
 174   Summary for 4.2.1 tcpdump release
 175         Only build the Babel printer if IPv6 is enabled.
 176         Support Babel on port 6696 as well as 6697.
 177         Include ppi.h in release tarball.
 178         Include all the test files in the release tarball, and don't
 179          "include" test files that no longer exist.
 180         Don't assume we have <rpc/rpc.h> - check for it.
 181         Support "-T carp" as a way of dissecting IP protocol 112 as CARP
 182          rather than VRRP.
 183         Support Hilscher NetAnalyzer link-layer header format.
 184         Constify some pointers and fix compiler warnings.
 185         Get rid of never-true test.
 186         Fix an unintended fall-through in a case statement in the ARP
 187          printer.
 188         Fix several cases where sizeof(sizeof(XXX)) was used when just
 189          sizeof(XXX) was intended.
 190         Make stricter sanity checks in the ES-IS printer.
 191         Get rid of some GCCisms that caused builds to fai with compilers
 192          that don't support them.
 193         Fix typo in man page.
 194         Added length checks to Babel printer.
 195
 196 Sunday  July 24, 2011.  mcr@sandelman.ca.
 197   Summary for 4.2.+
 198         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
 199           at gmail dot com>
 200         updates to forces for new port numbers
 201         Use "-H", not "-h", for the 802.11s option. (-h always help)
 202         Better ICMPv6 checksum handling.
 203         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
 204         get rid of uuencoded pcap test files, git can do binary.
 205         sFlow changes for 64-bit counters.
 206         fixes for PPI packet header handling and printing.
 207         Add DCB Exchange protocol (DCBX) version 1.01.
 208         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
 209         improvements to radiotap for rate values > 127.
 210         Many improvements to ForCES decode, including fix SCTP TML port
 211         updated RPL type code to RPL-17 draft
 212         Improve printout of DHCPv6 options.
 213         added support and test case for QinQ (802.1q VLAN) packets
 214         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
 215         Build fixes for Sparc and other machines with alignment restrictions.
 216         Merged changes from Debian package.
 217         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
 218         Build fixes for OSX (Snow Leopard and others)
 219         Add support for IEEE 802.15.4 packets
 220
 221 Tue.    July 20, 2010.  guy@alum.mit.edu.
 222   Summary for 4.1.2 tcpdump release
 223         If -U is specified, flush the file after creating it, so it's
 224           not zero-length
 225         Fix TCP flags output description, and some typoes, in the man
 226           page
 227         Add a -h flag, and only attempt to recognize 802.11s mesh
 228           headers if it's set
 229         When printing the link-layer type list, send *all* output to
 230           stderr
 231         Include the CFLAGS setting when configure was run in the
 232           compiler flags
 233
 234 Thu.    April 1, 2010.  guy@alum.mit.edu.
 235   Summary for 4.1.1 tcpdump release
 236         Fix build on systems with PF, such as FreeBSD and OpenBSD.
 237         Don't blow up if a zero-length link-layer address is passed to
 238           linkaddr_string().
 239
 240 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
 241   Summary for 4.1.0 tcpdump release
 242         Fix printing of MAC addresses for VLAN frames with a length
 243           field
 244         Add some additional bounds checks and use the EXTRACT_ macros
 245           more
 246         Add a -b flag to print the AS number in BGP packets in ASDOT
 247           notation rather than ASPLAIN notation
 248         Add ICMPv6 RFC 5006 support
 249         Decode the access flags in NFS access requests
 250         Handle the new DLT_ for memory-mapped USB captures on Linux
 251         Make the default snapshot (-s) the maximum
 252         Print name of device (when -L is used)
 253         Support for OpenSolaris (and SXCE build 125 and later)
 254         Print new TCP flags
 255         Add support for RPL DIO
 256         Add support for TCP User Timeout (UTO)
 257         Add support for non-standard Ethertypes used by 3com PPPoE gear
 258         Add support for 802.11n and 802.11s
 259         Add support for Transparent Ethernet Bridge ethertype in GRE
 260         Add 4 byte AS support for BGP printer
 261         Add support for the MDT SAFI 66 BG printer
 262         Add basic IPv6 support to print-olsr
 263         Add USB printer
 264         Add printer for ForCES
 265         Handle frames with an FCS
 266         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
 267         Fix TCP sequence number printing
 268         Report 802.2 packets as 802.2 instead of 802.3
 269         Don't include -L/usr/lib in LDFLAGS
 270         On x86_64 Linux, look in lib64 directory too
 271         Lots of code clean ups
 272         Autoconf clean ups
 273         Update testcases to make output changes
 274         Fix compiling with/out smi (--with{,out}-smi)
 275         Fix compiling without IPv6 support (--disable-ipv6)
 276
 277 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
 278         Add support for Bluetooth Sniffing
 279         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
 280         Add support for 802.11 AVS
 281         Add support for SMB over TCP
 282         Add support for 4 byte BGP AS printing
 283         Add support for compiling on case-insensitive file systems
 284         Add support for ikev2 printing
 285         Update support for decoding AFS
 286         Update DHCPv6 printer
 287         Use newer libpcap API's (allows -B option on all platforms)
 288         Add -I to turn on monitor mode
 289         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
 290         Cleanup unused files and various cruft
 291
 292 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
 293         Rework ARP printer
 294         Rework OSPFv3 printer
 295         Add support for Frame-Relay ARP
 296         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
 297         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
 298         TLV: Add support for Juniper .pcap extensions
 299         Print EGP header in new-world-order style
 300         Converted print-isakmp.c to NETDISSECT
 301         Moved AF specific stuff into af.h
 302         Test subsystem now table driven, and saves outputs and diffs to one place
 303         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
 304          libpcap files on an OS other than where the file was generated
 305
 306
 307 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
 308
 309         NFS: Print unsigned values as such.
 310         RX: parse safely.
 311         BGP: fixes for IPv6-less builds.
 312         801.1ag: use standard codepoint.
 313         use /dev/bpf on systems with such a device.
 314         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
 315         smb: make sure that we haven't gone past the end of the captured data.
 316         smb: squelch an uninitialized complaint from coverity.
 317         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 318                 if it got MSG_DENIED.
 319         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 320         revised INSTALL.txt about libpcap dependancy.
 321
 322 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 323         Update man page to reflect changes to libpcap
 324         Changes to both TCP and IP Printer Output
 325         Fix a potential buffer overflow in the 802.11 printer
 326         Print basic info about a few more Cisco LAN protocols.
 327         mDNS cleanup
 328         ICMP MPLS rework of the extension code
 329         bugfix: use the correct codepoint for the OSPF simple text auth token
 330          entry, and use safeputs to print the password.
 331         Add support in pflog for additional values
 332         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 333         Add support for the Message-id NACK c-type.
 334         Add support for 802.3ah loopback ctrl msg
 335         Add support for Multiple-STP as per 802.1s
 336         Add support for rapid-SPT as per 802.1w
 337         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 338          Sender-ID tlv, private tlv, port, interface status
 339         Add support for unidirectional link detection as per
 340          http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt
 341         Add support for the olsr protocol as per RFC 3626 plus the LQ
 342          extensions from olsr.org
 343         Add support for variable-length checksum in DCCP, as per section 9 of
 344          RFC 4340.
 345         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 346         Add support for Multiple-STP as per 802.1s
 347         Add support for the cisco propriatry 'dynamic trunking protocol'
 348         Add support for the cisco proprietary VTP protocol
 349         Update dhcp6 options table as per IETF standardization activities
 350
 351
 352 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 353
 354         Fix compiling on AIX (, at end of ENUM)
 355         Updated list of DNS RR typecodes
 356         Use local Ethernet defs on WIN32
 357         Add support for Frame-Relay ARP
 358         Fixes for compiling under MSVC++
 359         Add support for parsing Juniper .pcap files
 360         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 361         Rework the OSPFv3 printer
 362         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 363         Add support for Cisco style NLPID encapsulation
 364         Add cisco prop. eigrp related, extended communities
 365         Add support for BGP signaled VPLS
 366         Cleanup the bootp printer
 367         Add support for PPP over Frame-Relay
 368         Add some bounds checking to the IP options code, and clean up
 369          the options output a bit.
 370         Add additional modp groups to ISAKMP printer
 371         Add support for Address-Withdraw and Label-Withdraw Msgs
 372         Add support for the BFD Discriminator TLV
 373         Fixes for 64bit compiling
 374         Add support for PIMv2 checksum verification
 375         Add support for further dissection of the IPCP Compression Option
 376         Add support for Cisco's proposed VQP protocol
 377         Add basic support for keyed authentication TCP option
 378         Lots of minor cosmetic changes to output printers
 379
 380
 381 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 382         Decoder support for more Juniper link-layer types
 383         Fix a potential buffer overflow (although it can't occur in
 384                 practice).
 385         Fix the handling of unknown management frame types in the 802.11
 386                 printer.
 387         Add FRF.16 support, fix various Frame Relay bugs.
 388         Add support for RSVP integrity objects, update fast-reroute
 389                 object printer to latest spec.
 390         Clean up documentation of vlan filter expression, document mpls
 391                 filter expression.
 392         Document new pppoed and pppoes filter expressions.
 393         Update diffserver-TE codepoints as per RFC 4124.
 394         Spelling fixes in ICMPv6.
 395         Don't require any fields other than flags to be present in IS-IS
 396                 restart signaling TLVs, and only print the system ID in
 397                 those TLVs as system IDs, not as node IDs.
 398         Support for DCCP.
 399
 400 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
 401
 402         Option to chroot() when dropping privs
 403         Fixes for compiling on nearly every platform,
 404                 including improved 64bit support
 405         Many new testcases
 406         Support for sending packets
 407         Many compliation fixes on most platforms
 408         Fixes for recent version of GCC to eliminate warnings
 409         Improved Unicode support
 410
 411         Decoders & DLT Changes, Updates and New:
 412                 AES ESP support
 413                 Juniper ATM, FRF.15, FRF.16, PPPoE,
 414                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
 415                         GGSN,ES,MONITOR,SERVICES
 416                 L2VPN
 417                 Axent Raptor/Symantec Firewall
 418                 TCP-MD5 (RFC 2385)
 419                 ESP-in-UDP (RFC 3948)
 420                 ATM OAM
 421                 LMP, LMP Service Discovery
 422                 IP over FC
 423                 IP over IEEE 1394
 424                 BACnet MS/TP
 425                 SS7
 426                 LDP over TCP
 427                 LACP, MARKER as per 802.3ad
 428                 PGM (RFC 3208)
 429                 LSP-PING
 430                 G.7041/Y.1303 Generic Framing Procedure
 431                 EIGRP-IP, EIGRP-IPX
 432                 ICMP6
 433                 Radio - via radiotap
 434                 DHCPv6
 435                 HDLC over PPP
 436
 437 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
 438
 439         No changes from 3.8.2. Version bumped only to maintain consistency
 440         with libpcap 0.8.3.
 441
 442 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
 443
 444         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
 445                              http://www.rapid7.com/advisories/R7-0017.html
 446         IP-over-IEEE1394 printing.
 447         some MINGW32 changes.
 448         updates for autoconf 2.5
 449         fixes for print-aodv.c - check for too short packets
 450         formatting changes to print-ascii for hex output.
 451         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
 452                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
 453                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
 454                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
 455         print-ether.c - better handling of unknown types.
 456         print-isoclns.c - additional decoding of types.
 457         print-llc.c - strings for LLC names added.
 458         print-pfloc.c - various enhancements
 459         print-radius.c - better decoding to strings.
 460
 461 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
 462
 463         changed syntax of -E argument so that multiple SAs can be decrypted
 464         fixes for Digital Unix headers and Documentation
 465         __attribute__ fixes
 466         CDP changes from Terry Kennedy <terry@tmk.com>.
 467         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
 468         Fixes for ASN.1 decoder for 2.100.3 forms.
 469         Added a count of packets received and processed to clarify numbers.
 470         Incorporated WinDUMP patches for Win32 builds.
 471         PPPoE payload length headers.
 472         Fixes for HP C compiler builds.
 473         Use new pcap_breakloop() and pcap_findalldevs() if we can.
 474         BGP output split into multiple lines.
 475         Fixes to 802.11 decoding.
 476         Fixes to PIM decoder.
 477         SuperH is a CPU that can't handle unaligned access. Many fixes for
 478                 unaligned access work.
 479         Fixes to Frame-Relay decoder for Q.933/922 frames.
 480         Clarified when Solaris can do captures as non-root.
 481         Added tests/ subdir for examples/regression tests.
 482         New -U flag.    -flush stdout after every packet
 483         New -A flag     -print ascii only
 484         support for decoding IS-IS inside Cisco HDLC Frames
 485         more verbosity for tftp decoder
 486         mDNS decoder
 487         new BFD decoder
 488         cross compilation patches
 489         RFC 3561 AODV support.
 490         UDP/TCP pseudo-checksum properly for source-route options.
 491         sanitized all files to modified BSD license
 492         Add support for RFC 2625 IP-over-Fibre Channel.
 493         fixes for DECnet support.
 494         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
 495         RFC 2684 encapsulation of BPDUs.
 496
 497 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
 498
 499         Fixed infinite loop when parsing invalid isakmp packets.
 500          (reported by iDefense; already fixed in CVS)
 501         Fixed infinite loop when parsing invalid BGP packets.
 502         Fixed buffer overflow with certain invalid NFS packets.
 503         Pretty-print unprintable network names in 802.11 printer.
 504         Handle truncated nbp (appletalk) packets.
 505         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
 506         Print IP protocol name even if we don't have a printer for it.
 507         Print IP protocol name or number for fragments.
 508         Print the whole MPLS label stack, not just the top label.
 509         Print request header and file handle for NFS v3 FSINFO and PATHCONF
 510          requests.
 511         Fix NFS packet truncation checks.
 512         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
 513         Handle unknown RADIUS attributes properly.
 514         Fix an ASN.1 parsing error that would cause e.g. the OID
 515          2.100.3 to be misrepresented as 4.20.3 .
 516
 517 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
 518 see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log.
 519         keyword "ipx" added.
 520         Better OSI/802.2 support on Linux.
 521         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
 522         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
 523         BXXP protocol was replaced by the BEEP protocol;
 524         improvements to SNAP demux.
 525         Changes to "any" interface documentation.
 526         Documentation on pcap_stats() counters.
 527         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
 528         Added MPLS encapsulation decoding per RFC3032.
 529         DNS dissector handles TKEY, TSIG and IXFR.
 530         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
 531         SMB printing has much improved bounds checks
 532         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
 533         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
 534         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
 535         IPX socket 0x85be is for Cisco EIGRP over IPX.
 536         Improvements to fragmented ESP handling.
 537         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
 538         Linux ARPHDR_ATM support fixed.
 539         Added a "netbeui" keyword, which selects NetBEUI packets.
 540         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
 541         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
 542         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
 543         Better Linux libc5 compat.
 544         BIND9 lwres dissector added.
 545         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
 546         Apple LocalTalk LINKTYPE_ reserved.
 547         New time stamp formats documented.
 548         DHCP6 updated to draft-22.txt spec.
 549         ICMP types/codes now accept symbolic names.
 550         Add SIGINFO handler from LBL
 551         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
 552         now we are -Wstrict-prototype clean.
 553         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
 554         PPPoE dissector cleaned up.
 555         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
 556         In dissector, now the caller prints the IP addresses rather than proto.
 557         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
 558         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
 559         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
 560         captures on the "any" device won't be done in promiscuous mode
 561         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
 562         ARCNet support, from NetBSD.
 563         HSRP dissector, from Julian Cowley <julian@lava.net>.
 564         Handle (GRE-encapsulated) PPTP
 565         added -C option to rotate save file every optarg * 1,000,000 bytes.
 566         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
 567         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
 568         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
 569         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
 570         ESP printing updated to RFC2406.
 571         HP-UX can now handle large number of PPAs.
 572         MSDP printer added.
 573         L2TP dissector improvements from Motonori Shindo.
 574
 575 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
 576         Cleaned up documentation.
 577         Promisc mode fixes for Linux
 578         IPsec changes/cleanups.
 579         Alignment fixes for picky architectures
 580
 581         Removed dependency on native headers for packet dissectors.
 582         Removed Linux specific headers that were shipped
 583
 584         libpcap changes provide for exchanging capture files between
 585           systems. Save files now have well known PACKET_ values instead of
 586           depending upon system dependant mappings of DLT_* types.
 587
 588         Support for computing/checking IP and UDP/TCP checksums.
 589
 590         Updated autoconf stock files.
 591
 592         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
 593
 594         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
 595                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
 596
 597         Added filtering support for: VLANs, ESIS, ISIS
 598
 599         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
 600                 L2TP, PPPoE
 601
 602         HP-UX 11.0 -- find the right dlpi device.
 603         Solaris 8 - IPv6 works
 604         Linux - Added support for an "any" device to capture on all interfaces
 605
 606         Security fixes: buffer overrun audit done. Strcpy replaced with
 607                 strlcpy, sprintf replaced with snprintf.
 608         Look for lex problems, and warn about them.
 609
 610
 611 v3.5 Fri Jan 28 18:00:00 PST 2000
 612
 613 Bill Fenner <fenner@research.att.com>
 614 - switch to config.h for autoconf
 615 - unify RCSID strings
 616 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
 617 - Really fix the RIP printer
 618 - Fix MAC address -> name translation.
 619 - some -Wall -Wformat fixes
 620 - update makemib to parse much of SMIv2
 621 - Print TCP sequence # with -vv even if you normally wouldn't
 622 - Print as much of IP/TCP/UDP headers as possible even if truncated.
 623
 624 itojun@iijlab.net
 625 - -X will make a ascii dump.  from netbsd.
 626 - telnet command sequence decoder (ff xx xx).  from netbsd.
 627 - print-bgp.c: improve options printing.  ugly code exists for
 628   unaligned option parsing (need some fix).
 629 - const poisoning in SMB decoder.
 630 - -Wall -Werror clean checks.
 631 - bring in KAME IPv6/IPsec decoding code.
 632
 633 Assar Westerlund  <assar@sics.se>
 634 - SNMPv2 and SNMPv3 printer
 635 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
 636   SNMP packets.
 637 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
 638 - portability fixes
 639 - permit building in different directories.
 640
 641 Ken Hornstein <kenh@cmf.nrl.navy.mil>
 642 - bring in code at
 643   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
 644   AFS3 packets
 645
 646 Andrew Tridgell <tridge@linuxcare.com>
 647 - SMB printing code
 648
 649 Love <lha@stacken.kth.se>
 650 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
 651   change date format to the right one.
 652
 653 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
 654 - Created tcpdump.org repository
 655
 656 v3.4 Sat Jul 25 12:40:55 PDT 1998
 657
 658 - Hardwire Linux slip support since it's too hard to detect.
 659
 660 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
 661   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
 662
 663 - Added -a which tries to translate network and broadcast addresses to
 664   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
 665
 666 - Added a configure option to disable gcc.
 667
 668 - Added a "raw" packet printer.
 669
 670 - Not having an interface address is no longer fatal. Requested by John
 671   Hawkinson.
 672
 673 - Rework signal setup to accommodate Linux.
 674
 675 - OSPF truncation check fix. Also display the type of OSPF packets
 676   using MD5 authentication. Thanks to Brian Wellington
 677   (bwelling@tis.com)
 678
 679 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
 680   Peisach (epeisach@mit.edu)
 681
 682 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
 683   (plonka@mfa.com)
 684
 685 - Specify full install target as a way of detecting if install
 686   directory does not exist. Thanks to Dave Plonka.
 687
 688 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
 689   (paul@vix.com)
 690
 691 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
 692   Marty Leisner (leisner@sdsp.mc.xerox.com)
 693
 694 - Add a local autoconf macro to check for routines in libraries; the
 695   autoconf version is broken (it only puts the library name in the
 696   cache variable name). Thanks to John Hawkinson.
 697
 698 - Add a local autoconf macro to check for types; the autoconf version
 699   is broken (it uses grep instead of actually compiling a code fragment).
 700
 701 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
 702   formats.
 703
 704 - Extend OSF ip header workaround to versions 1 and 2.
 705
 706 - Fix some signed problems in the nfs printer. As reported by David
 707   Sacerdote (davids@silence.secnet.com)
 708
 709 - Detect group wheel and use it as the default since BSD/OS' install
 710   can't hack numeric groups. Reported by David Sacerdote.
 711
 712 - AIX needs special loader options. Thanks to Jonathan I. Kamens
 713   (jik@cam.ov.com)
 714
 715 - Fixed the nfs printer to print port numbers in decimal. Thanks to
 716   Kent Vander Velden (graphix@iastate.edu)
 717
 718 - Find installed libpcap in /usr/local/lib when not using gcc.
 719
 720 - Disallow network masks with non-network bits set.
 721
 722 - Attempt to detect "egcs" versions of gcc.
 723
 724 - Add missing closing double quotes when displaying bootp strings.
 725   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
 726
 727 v3.3 Sat Nov 30 20:56:27 PST 1996
 728
 729 - Added Linux support.
 730
 731 - GRE encapsulated packet printer thanks to John Hawkinson
 732   (jhawk@mit.edu)
 733
 734 - Rewrite gmt2local() to avoid problematic os dependencies.
 735
 736 - Suppress nfs truncation message on errors.
 737
 738 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
 739   Reported by Joachim Ott (ott@ardala.han.de)
 740
 741 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
 742
 743 - Print arp hardware type in host order. Thanks to Onno van der Linden
 744   (onno@simplex.nl)
 745
 746 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
 747   (barnett@grymoire.crd.ge.com)
 748
 749 - Fix rip printer to not print one more route than is actually in the
 750   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
 751   Bill Fenner (fenner@parc.xerox.com)
 752
 753 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
 754
 755 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
 756   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
 757
 758 - Rewrite ospf printer to improve truncation checks.
 759
 760 - Don't parse tcp options past the EOL. As noted by David Sacerdote
 761   (davids@secnet.com). Also, check tcp options to make sure they ar
 762   actually in the tcp header (in addition to the normal truncation
 763   checks). Fix the SACK code to print the N blocks (instead of the
 764   first block N times).
 765
 766 - Don't say really small UDP packets are truncated just because they
 767   aren't big enough to be a RPC. As noted by David Sacerdote.
 768
 769 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
 770
 771 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
 772   (martin@msp.se)
 773
 774 - Print mtu for icmp unreach need frag packets. Thanks to John
 775   Hawkinson (jhawk@mit.edu)
 776
 777 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
 778   (jch@bsdi.com)
 779
 780 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
 781   (kushida@trl.ibm.co.jp)
 782
 783 - Check igmp checksum if possible. Thanks to John Hawkinson.
 784
 785 - Made changes for SINIX. Thanks to Andrej Borsenkow
 786   (borsenkow.msk@sni.de)
 787
 788 - Use autoconf's idea of the top level directory in install targets.
 789   Thanks to John Hawkinson.
 790
 791 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
 792   Mogul (mogul@pa.dec.com)
 793
 794 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
 795   Thanks to John Hawkinson.
 796
 797 - Added some more packet truncation checks.
 798
 799 - On systems that have it, use sigset() instead of signal() since
 800   signal() has different semantics on these systems.
 801
 802 - Fixed some more alignment problems on the alpha.
 803
 804 - Add code to massage unprintable characters in the domain and ipx
 805   printers. Thanks to John Hawkinson.
 806
 807 - Added explicit netmask support. Thanks to Steve Nuchia
 808   (steve@research.oknet.com)
 809
 810 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
 811   Kennedy (terry@spcvxa.spc.edu)
 812
 813 - Add "atalk" keyword as suggested by John Hawkinson.
 814
 815 - Added an igrp printer. Thanks to Francis Dupont
 816   (francis.dupont@inria.fr)
 817
 818 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
 819   Kennedy (terry@spcvxa.spc.edu)
 820
 821 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
 822   (pascal.hennequin@hugo.int-evry.fr)
 823
 824 - Added some ETHERTYPEs missing on some systems.
 825
 826 - Added truncated packet macros and various checks.
 827
 828 - Fixed endian problems with the DECnet printer.
 829
 830 - Use $CC when checking gcc version. Thanks to Carl Lindberg
 831   (carl_lindberg@blacksmith.com)
 832
 833 - Fixes for AIX (although this system is not yet supported). Thanks to
 834   John Hawkinson.
 835
 836 - Fix bugs in the autoconf misaligned accesses code fragment.
 837
 838 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
 839   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
 840
 841 v3.2 Sun Jun 23 02:28:10 PDT 1996
 842
 843 - Print new icmp unreachable codes as suggested by Martin Fredriksson
 844   (martin@msp.se). Also print code value when unknown for icmp redirect
 845   and time exceeded.
 846
 847 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
 848
 849 - Define "new" domain record types if not found in arpa/nameserv.h.
 850   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
 851   fixed an endian bug when printing mx record and added some new record
 852   types.
 853
 854 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
 855
 856 - Added T/TCP options printing. As suggested by Richard Stevens
 857   (rstevens@noao.edu)
 858
 859 - Use autoconf to detect architectures that can't handle misaligned
 860   accesses.
 861
 862 v3.1 Thu Jun 13 20:59:32 PDT 1996
 863
 864 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
 865   and bind (as suggested by Charles Hannum).
 866
 867 - Port to GNU autoconf.
 868
 869 - Add support for printing DVMRP and PIM traffic thanks to
 870   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
 871
 872 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
 873   define being referenced. Reported by Terry Kennedy.
 874
 875 - Minor fixes to the man page thanks to Mark Andrews.
 876
 877 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
 878   (bmah@cs.berkeley.edu).
 879
 880 - Added support for new dns types, thanks to Rainer Orth.
 881
 882 - Fixed tftp_print() to print the block number for ACKs.
 883
 884 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
 885   (cslater@imatek.com).
 886
 887 - Check return status from malloc/calloc/etc.
 888
 889 - Check return status from pcap_loop() so we can print an error and
 890   exit with a bad status if there were problems.
 891
 892 - Bail if ip option length is <= 0. Resulted from a bug report from
 893   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
 894
 895 - Print out a little more information for sun rpc packets.
 896
 897 - Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
 898
 899 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
 900   wrong on little endian machines).
 901
 902 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
 903   (crawdad@fnal.gov).
 904
 905 - Fix ntp_print() to not print garbage when the stratum is
 906   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
 907
 908 - Rewrote tcp options printer code to check for truncation. Added
 909   selective acknowledgment case.
 910
 911 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
 912   (jch@bsdi.com)
 913
 914 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
 915   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
 916   (toku@dit.co.jp)
 917
 918 - Don't checksum ip header if we don't have all of it. Thanks to John
 919   Hawkinson (jhawk@mit.edu).
 920
 921 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
 922   Honig (jhc@bsdi.com)
 923
 924
 925 v3.1a1 Wed May  3 19:21:11 PDT 1995
 926
 927 - Include time.h when SVR4 is defined to avoid problems under Solaris
 928   2.3.
 929
 930 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
 931   strings, not the local buffer. Thanks to Stefan Petri
 932   (petri@ibr.cs.tu-bs.de).
 933
 934 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
 935   that the selected value was not used. Thanks to Pascal Hennequin
 936   (Pascal.Hennequin@hugo.int-evry.fr).
 937
 938 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
 939
 940 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
 941
 942 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
 943
 944 - Although there never was a 3.0.3 release, the linux boys cleverly
 945   "released" one in late 1995.
 946
 947 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
 948
 949 - Change configuration to not use gcc v2 flags with gcc v1.
 950
 951 - Redo gmt2local() so that it works under BSDI (which seems to return
 952   an empty timezone struct from gettimeofday()). Based on report from
 953   Terry Kennedy (terry@spcvxa.spc.edu).
 954
 955 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
 956   on report from Mark Andrews (mandrews@alias.com).
 957
 958 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
 959   Orth (ro@techfak.uni-bielefeld.de).
 960
 961 - Fixed printout of connection id for uncompressed tcp slip packets.
 962   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
 963
 964 - Hack around deficiency in Ultrix's make.
 965
 966 - Add ETHERTYPE_TRAIL define which is missing from irix5.
 967
 968 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
 969
 970 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
 971
 972 v3.0 Mon Jun 20 19:23:27 PDT 1994
 973
 974 - Added support for printing tcp option timestamps thanks to
 975   Mark Andrews (mandrews@alias.com).
 976
 977 - Reorganize protocol dumpers to take const pointers to packets so they
 978   never change the contents (i.e., they used to do endian conversions
 979   in place).  Previously, whenever more than one pass was taken over
 980   the packet, the packet contents would be dumped incorrectly (i.e.,
 981   the output form -x would be wrong on little endian machines because
 982   the protocol dumpers would modify the data).  Thanks to Charles Hannum
 983   (mycroft@gnu.ai.mit.edu) for reporting this problem.
 984
 985 - Added support for decnet protocol dumping thanks to Jeff Mogul
 986   (mogul@pa.dec.com).
 987
 988 - Fix bug that caused length of packet to be incorrectly printed
 989   (off by ether header size) for unknown ethernet types thanks
 990   to Greg Miller (gmiller@kayak.mitre.org).
 991
 992 - Added support for IPX protocol dumping thanks to Brad Parker
 993   (brad@fcr.com).
 994
 995 - Added check to verify IP header checksum under -v thanks to
 996   Brad Parker (brad@fcr.com).
 997
 998 - Move packet capture code to new libpcap library (which is
 999   packaged separately).
1000
1001 - Prototype everything and assume an ansi compiler.
1002
1003 - print-arp.c: Print hardware ethernet addresses if they're not
1004   what we expect.
1005
1006 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
1007   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
1008
1009 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
1010   (mogul@pa.dec.com).
1011
1012 - print-icmp.c: Byte swap netmask before printing. Thanks to
1013   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
1014
1015 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
1016   By default, only the inner packet is dumped, appended with the token
1017   "(encap)".  Under -v, both the inner and output packets are dumped
1018   (on the same line).  Note that the filter applies to the original packet,
1019   not the encapsulated packet.  So if you run tcpdump on a net with an
1020   IP Multicast tunnel, you cannot filter out the datagrams using the
1021   conventional syntax.  (You can filter away all the ip-in-ip traffic
1022   with "not ip proto 4".)
1023
1024 - print-nfs.c: Keep pending rpc's in circular table. Add generic
1025   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
1026
1027 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
1028
1029 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
1030   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
1031   Add && and || operators
1032
1033 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
1034
1035 - Fix bug with -c flag.
1036
1037 v2.2 Fri May 22 17:19:41 PDT 1992
1038
1039 - savefile.c: Remove hack that shouldn't have been exported. Add
1040   truncate checks.
1041
1042 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
1043   matches non-echo/reply ICMP packets.
1044
1045 - Many improvements to filter code optimizer.
1046
1047 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
1048   so that protocol qualifications are allowed. For example, "ip broadcast"
1049   and "ether multicast" are valid filters.
1050
1051 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
1052   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
1053   patches to netinet/if_loop.c.
1054
1055 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
1056   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
1057
1058 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
1059
1060 v2.1 Tue Jan 28 11:00:14 PST 1992
1061
1062 - Internal release (never publically exported).
1063
1064 v2.0.1 Sun Jan 26 21:10:10 PDT
1065
1066 - Various byte ordering fixes.
1067
1068 - Add truncation checks.
1069
1070 - inet.c: Support BSD style SIOCGIFCONF.
1071
1072 - nametoaddr.c: Handle multi addresses for single host.
1073
1074 - optimize.c: Rewritten.
1075
1076 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
1077   for broadcast nets.
1078
1079 - print-atal.c: Fix an alignment bug (thanks to
1080   stanonik@nprdc.navy.mil) Add missing printf() argument.
1081
1082 - print-bootp.c: First attempt at decoding the vendor buffer.
1083
1084 - print-domain.c: Fix truncation checks.
1085
1086 - print-icmp.c: Calculate length of packets from the ip header.
1087
1088 - print-ip.c: Print frag id in decimal (so it's easier to match up
1089   with non-frags). Add support for ospf, egp and igmp.
1090
1091 - print-nfs.c: Lots of changes.
1092
1093 - print-ntp.c: Make some verbose output depend on -v.
1094
1095 - print-snmp.c: New version from John LoVerso.
1096
1097 - print-tcp.c: Print rfc1072 tcp options.
1098
1099 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
1100   (microseconds) worth of precision. Fix uid bugs.
1101
1102 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
1103   With this option, you can create an architecture independent binary
1104   trace file in real time, without the overhead of the packet printer.
1105   At a later time, the packets can be filtered (again) and printed.
1106
1107 - BSD is supported.  You must have BPF in your kernel.
1108   Since the filtering is now done in the kernel, fewer packets are
1109   dropped.  In fact, with BPF and the packet dumper option, a measly
1110   Sun 3/50 can keep up with a busy network.
1111
1112 - Compressed SLIP packets can now be dumped, provided you use our
1113   SLIP software and BPF.  These packets are dumped as any other IP
1114   packet; the compressed headers are dumped with the '-e' option.
1115
1116 - Machines with little-endian byte ordering are supported (thanks to
1117   Jeff Mogul).
1118
1119 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
1120
1121 - IBM RT and Stanford Enetfilter support has been added by
1122   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
1123   both the vanilla Enetfilter interface, and the extended interface
1124   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
1125
1126 - TFTP packets are now printed (requests only).
1127
1128 - BOOTP packets are now printed.
1129
1130 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
1131
1132 - Sparc architectures, including the Sparcstation-1, are now
1133   supported thanks to Steve McCanne and Craig Leres.
1134
1135 - SunOS 4 is now supported thanks to Micky Liu of Columbia
1136   University (micky@cunixc.cc.columbia.edu).
1137
1138 - IP options are now printed.
1139
1140 - RIP packets are now printed.
1141
1142 - There's a -v flag that prints out more information than the
1143   default (e.g., it will enable printing of IP ttl, tos and id)
1144   and -q flag that prints out less (e.g., it will disable
1145   interpretation of AppleTalk-in-UDP).
1146
1147 - The grammar has undergone substantial changes (if you have an
1148   earlier version of tcpdump, you should re-read the manual
1149   entry).
1150
1151   The most useful change is the addition of an expression
1152   syntax that lets you filter on arbitrary fields or values in the
1153   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
1154   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
1155   packets.
1156
1157   The most painful change is that concatenation no longer means
1158   "and" -- e.g., you have to say "host foo and port bar" instead
1159   of "host foo port bar".  The up side to this down is that
1160   repeated qualifiers can be omitted, making most filter
1161   expressions shorter.  E.g., you can now say "ip host foo and
1162   (bar or baz)" to look at ip traffic between hosts foo and bar or
1163   between hosts foo and baz.  [The old way of saying this was "ip
1164   host foo and (ip host bar or ip host baz)".]
1165
1166 v2.0 Sun Jan 13 12:20:40 PST 1991
1167
1168 - Initial public release.