The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 Mon.    December 21, 2009.  ken@netfunctional.ca.  Summary for 4.1 tcpdump release
   2         Make the default snapshot (-s) the maximum
   3         Print name of device (when -L is used)
   4         Support for OpenSolaris (and SXCE build 125 and later)
   5         Print new TCP flags
   6         Add support for RPL DIO
   7         Add support for TCP User Timeout (UTO)
   8         Add support for non-standard Ethertypes used by 3com PPPoE gear
   9         Add support for 802.11n and 802.11s
  10         Add support for Transparent Ethernet Bridge ethertype in GRE
  11         Add 4 byte AS support for BGP printer
  12         Add support for the MDT SAFI 66 BG printer
  13         Add basic IPv6 support to print-olsr
  14         Add USB printer
  15         Handle frames with an FCS
  16         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
  17         Fix TCP sequence number printing
  18         Report 802.2 packets as 802.2 instead of 802.3
  19         Don't include -L/usr/lib in LDFLAGS
  20         On x86_64 Linux, look in lib64 directory too
  21         Lots of code clean ups
  22         Autoconf clean ups
  23         Update testcases to make output changes
  24
  25 Mon.    December 8, 2008.  ken@netfunctional.ca.  Summary for 4.0.1 tcpdump release
  26         Fix compiling with/out smi (--with{,out}-smi)
  27         Fix compiling without IPv6 support (--disable-ipv6)
  28
  29 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
  30         Add support for Bluetooth Sniffing
  31         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
  32         Add support for 802.11 AVS
  33         Add support for SMB over TCP
  34         Add support for 4 byte BGP AS printing
  35         Add support for compiling on case-insensitive file systems
  36         Add support for ikev2 printing
  37         Update support for decoding AFS
  38         Update DHCPv6 printer
  39         Use newer libpcap API's (allows -B option on all platforms)
  40         Add -I to turn on monitor mode
  41         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
  42         Cleanup unused files and various cruft
  43
  44 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
  45         Rework ARP printer
  46         Rework OSPFv3 printer
  47         Add support for Frame-Relay ARP
  48         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
  49         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
  50         TLV: Add support for Juniper .pcap extensions
  51         Print EGP header in new-world-order style
  52         Converted print-isakmp.c to NETDISSECT
  53         Moved AF specific stuff into af.h
  54         Test subsystem now table driven, and saves outputs and diffs to one place
  55         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
  56          libpcap files on an OS other than where the file was generated
  57
  58
  59 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
  60
  61         NFS: Print unsigned values as such.
  62         RX: parse safely.
  63         BGP: fixes for IPv6-less builds.
  64         801.1ag: use standard codepoint.
  65         use /dev/bpf on systems with such a device.
  66         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
  67         smb: make sure that we haven't gone past the end of the captured data.
  68         smb: squelch an uninitialized complaint from coverity.
  69         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
  70                 if it got MSG_DENIED.
  71         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
  72         revised INSTALL.txt about libpcap dependancy.
  73
  74 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
  75         Update man page to reflect changes to libpcap
  76         Changes to both TCP and IP Printer Output
  77         Fix a potential buffer overflow in the 802.11 printer
  78         Print basic info about a few more Cisco LAN protocols.
  79         mDNS cleanup
  80         ICMP MPLS rework of the extension code
  81         bugfix: use the correct codepoint for the OSPF simple text auth token
  82          entry, and use safeputs to print the password.
  83         Add support in pflog for additional values
  84         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
  85         Add support for the Message-id NACK c-type.
  86         Add support for 802.3ah loopback ctrl msg
  87         Add support for Multiple-STP as per 802.1s
  88         Add support for rapid-SPT as per 802.1w
  89         Add support for CFM Link-trace msg, Link-trace-Reply msg,
  90          Sender-ID tlv, private tlv, port, interface status
  91         Add support for unidirectional link detection as per
  92          http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt
  93         Add support for the olsr protocol as per RFC 3626 plus the LQ
  94          extensions from olsr.org
  95         Add support for variable-length checksum in DCCP, as per section 9 of
  96          RFC 4340.
  97         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
  98         Add support for Multiple-STP as per 802.1s
  99         Add support for the cisco propriatry 'dynamic trunking protocol'
 100         Add support for the cisco proprietary VTP protocol
 101         Update dhcp6 options table as per IETF standardization activities
 102
 103
 104 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 105
 106         Fix compiling on AIX (, at end of ENUM)
 107         Updated list of DNS RR typecodes
 108         Use local Ethernet defs on WIN32
 109         Add support for Frame-Relay ARP
 110         Fixes for compiling under MSVC++
 111         Add support for parsing Juniper .pcap files
 112         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 113         Rework the OSPFv3 printer
 114         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 115         Add support for Cisco style NLPID encapsulation
 116         Add cisco prop. eigrp related, extended communities
 117         Add support for BGP signaled VPLS
 118         Cleanup the bootp printer
 119         Add support for PPP over Frame-Relay
 120         Add some bounds checking to the IP options code, and clean up
 121          the options output a bit.
 122         Add additional modp groups to ISAKMP printer
 123         Add support for Address-Withdraw and Label-Withdraw Msgs
 124         Add support for the BFD Discriminator TLV
 125         Fixes for 64bit compiling
 126         Add support for PIMv2 checksum verification
 127         Add support for further dissection of the IPCP Compression Option
 128         Add support for Cisco's proposed VQP protocol
 129         Add basic support for keyed authentication TCP option
 130         Lots of minor cosmetic changes to output printers
 131
 132
 133 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 134         Decoder support for more Juniper link-layer types
 135         Fix a potential buffer overflow (although it can't occur in
 136                 practice).
 137         Fix the handling of unknown management frame types in the 802.11
 138                 printer.
 139         Add FRF.16 support, fix various Frame Relay bugs.
 140         Add support for RSVP integrity objects, update fast-reroute
 141                 object printer to latest spec.
 142         Clean up documentation of vlan filter expression, document mpls
 143                 filter expression.
 144         Document new pppoed and pppoes filter expressions.
 145         Update diffserver-TE codepoints as per RFC 4124.
 146         Spelling fixes in ICMPv6.
 147         Don't require any fields other than flags to be present in IS-IS
 148                 restart signaling TLVs, and only print the system ID in
 149                 those TLVs as system IDs, not as node IDs.
 150         Support for DCCP.
 151
 152 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
 153
 154         Option to chroot() when dropping privs
 155         Fixes for compiling on nearly every platform,
 156                 including improved 64bit support
 157         Many new testcases
 158         Support for sending packets
 159         Many compliation fixes on most platforms
 160         Fixes for recent version of GCC to eliminate warnings
 161         Improved Unicode support
 162
 163         Decoders & DLT Changes, Updates and New:
 164                 AES ESP support
 165                 Juniper ATM, FRF.15, FRF.16, PPPoE,
 166                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
 167                         GGSN,ES,MONITOR,SERVICES
 168                 L2VPN
 169                 Axent Raptor/Symantec Firewall
 170                 TCP-MD5 (RFC 2385)
 171                 ESP-in-UDP (RFC 3948)
 172                 ATM OAM
 173                 LMP, LMP Service Discovery
 174                 IP over FC
 175                 IP over IEEE 1394
 176                 BACnet MS/TP
 177                 SS7
 178                 LDP over TCP
 179                 LACP, MARKER as per 802.3ad
 180                 PGM (RFC 3208)
 181                 LSP-PING
 182                 G.7041/Y.1303 Generic Framing Procedure
 183                 EIGRP-IP, EIGRP-IPX
 184                 ICMP6
 185                 Radio - via radiotap
 186                 DHCPv6
 187                 HDLC over PPP
 188
 189 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
 190
 191         No changes from 3.8.2. Version bumped only to maintain consistency
 192         with libpcap 0.8.3.
 193
 194 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
 195
 196         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
 197                              http://www.rapid7.com/advisories/R7-0017.html
 198         IP-over-IEEE1394 printing.
 199         some MINGW32 changes.
 200         updates for autoconf 2.5
 201         fixes for print-aodv.c - check for too short packets
 202         formatting changes to print-ascii for hex output.
 203         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
 204                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
 205                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
 206                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
 207         print-ether.c - better handling of unknown types.
 208         print-isoclns.c - additional decoding of types.
 209         print-llc.c - strings for LLC names added.
 210         print-pfloc.c - various enhancements
 211         print-radius.c - better decoding to strings.
 212
 213 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
 214
 215         changed syntax of -E argument so that multiple SAs can be decrypted
 216         fixes for Digital Unix headers and Documentation
 217         __attribute__ fixes
 218         CDP changes from Terry Kennedy <terry@tmk.com>.
 219         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
 220         Fixes for ASN.1 decoder for 2.100.3 forms.
 221         Added a count of packets received and processed to clarify numbers.
 222         Incorporated WinDUMP patches for Win32 builds.
 223         PPPoE payload length headers.
 224         Fixes for HP C compiler builds.
 225         Use new pcap_breakloop() and pcap_findalldevs() if we can.
 226         BGP output split into multiple lines.
 227         Fixes to 802.11 decoding.
 228         Fixes to PIM decoder.
 229         SuperH is a CPU that can't handle unaligned access. Many fixes for
 230                 unaligned access work.
 231         Fixes to Frame-Relay decoder for Q.933/922 frames.
 232         Clarified when Solaris can do captures as non-root.
 233         Added tests/ subdir for examples/regression tests.
 234         New -U flag.    -flush stdout after every packet
 235         New -A flag     -print ascii only
 236         support for decoding IS-IS inside Cisco HDLC Frames
 237         more verbosity for tftp decoder
 238         mDNS decoder
 239         new BFD decoder
 240         cross compilation patches
 241         RFC 3561 AODV support.
 242         UDP/TCP pseudo-checksum properly for source-route options.
 243         sanitized all files to modified BSD license
 244         Add support for RFC 2625 IP-over-Fibre Channel.
 245         fixes for DECnet support.
 246         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
 247         RFC 2684 encapsulation of BPDUs.
 248
 249 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
 250
 251         Fixed infinite loop when parsing malformed isakmp packets.
 252          (reported by iDefense; already fixed in CVS)
 253         Fixed infinite loop when parsing malformed BGP packets.
 254         Fixed buffer overflow with certain malformed NFS packets.
 255         Pretty-print unprintable network names in 802.11 printer.
 256         Handle truncated nbp (appletalk) packets.
 257         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
 258         Print IP protocol name even if we don't have a printer for it.
 259         Print IP protocol name or number for fragments.
 260         Print the whole MPLS label stack, not just the top label.
 261         Print request header and file handle for NFS v3 FSINFO and PATHCONF
 262          requests.
 263         Fix NFS packet truncation checks.
 264         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
 265         Handle unknown RADIUS attributes properly.
 266         Fix an ASN.1 parsing error that would cause e.g. the OID
 267          2.100.3 to be misrepresented as 4.20.3 .
 268
 269 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
 270 see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log.
 271         keyword "ipx" added.
 272         Better OSI/802.2 support on Linux.
 273         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
 274         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
 275         BXXP protocol was replaced by the BEEP protocol;
 276         improvements to SNAP demux.
 277         Changes to "any" interface documentation.
 278         Documentation on pcap_stats() counters.
 279         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
 280         Added MPLS encapsulation decoding per RFC3032.
 281         DNS dissector handles TKEY, TSIG and IXFR.
 282         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
 283         SMB printing has much improved bounds checks
 284         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
 285         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
 286         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
 287         IPX socket 0x85be is for Cisco EIGRP over IPX.
 288         Improvements to fragmented ESP handling.
 289         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
 290         Linux ARPHDR_ATM support fixed.
 291         Added a "netbeui" keyword, which selects NetBEUI packets.
 292         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
 293         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
 294         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
 295         Better Linux libc5 compat.
 296         BIND9 lwres dissector added.
 297         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
 298         Apple LocalTalk LINKTYPE_ reserved.
 299         New time stamp formats documented.
 300         DHCP6 updated to draft-22.txt spec.
 301         ICMP types/codes now accept symbolic names.
 302         Add SIGINFO handler from LBL
 303         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
 304         now we are -Wstrict-prototype clean.
 305         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
 306         PPPoE dissector cleaned up.
 307         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
 308         In dissector, now the caller prints the IP addresses rather than proto.
 309         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
 310         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
 311         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
 312         captures on the "any" device won't be done in promiscuous mode
 313         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
 314         ARCNet support, from NetBSD.
 315         HSRP dissector, from Julian Cowley <julian@lava.net>.
 316         Handle (GRE-encapsulated) PPTP
 317         added -C option to rotate save file every optarg * 1,000,000 bytes.
 318         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
 319         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
 320         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
 321         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
 322         ESP printing updated to RFC2406.
 323         HP-UX can now handle large number of PPAs.
 324         MSDP printer added.
 325         L2TP dissector improvements from Motonori Shindo.
 326
 327 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
 328         Cleaned up documentation.
 329         Promisc mode fixes for Linux
 330         IPsec changes/cleanups.
 331         Alignment fixes for picky architectures
 332
 333         Removed dependency on native headers for packet dissectors.
 334         Removed Linux specific headers that were shipped
 335
 336         libpcap changes provide for exchanging capture files between
 337           systems. Save files now have well known PACKET_ values instead of
 338           depending upon system dependant mappings of DLT_* types.
 339
 340         Support for computing/checking IP and UDP/TCP checksums.
 341
 342         Updated autoconf stock files.
 343
 344         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
 345
 346         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
 347                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
 348
 349         Added filtering support for: VLANs, ESIS, ISIS
 350
 351         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
 352                 L2TP, PPPoE
 353
 354         HP-UX 11.0 -- find the right dlpi device.
 355         Solaris 8 - IPv6 works
 356         Linux - Added support for an "any" device to capture on all interfaces
 357
 358         Security fixes: buffer overrun audit done. Strcpy replaced with
 359                 strlcpy, sprintf replaced with snprintf.
 360         Look for lex problems, and warn about them.
 361
 362
 363 v3.5 Fri Jan 28 18:00:00 PST 2000
 364
 365 Bill Fenner <fenner@research.att.com>
 366 - switch to config.h for autoconf
 367 - unify RCSID strings
 368 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
 369 - Really fix the RIP printer
 370 - Fix MAC address -> name translation.
 371 - some -Wall -Wformat fixes
 372 - update makemib to parse much of SMIv2
 373 - Print TCP sequence # with -vv even if you normally wouldn't
 374 - Print as much of IP/TCP/UDP headers as possible even if truncated.
 375
 376 itojun@iijlab.net
 377 - -X will make a ascii dump.  from netbsd.
 378 - telnet command sequence decoder (ff xx xx).  from netbsd.
 379 - print-bgp.c: improve options printing.  ugly code exists for
 380   unaligned option parsing (need some fix).
 381 - const poisoning in SMB decoder.
 382 - -Wall -Werror clean checks.
 383 - bring in KAME IPv6/IPsec decoding code.
 384
 385 Assar Westerlund  <assar@sics.se>
 386 - SNMPv2 and SNMPv3 printer
 387 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
 388   SNMP packets.
 389 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
 390 - portability fixes
 391 - permit building in different directories.
 392
 393 Ken Hornstein <kenh@cmf.nrl.navy.mil>
 394 - bring in code at
 395   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
 396   AFS3 packets
 397
 398 Andrew Tridgell <tridge@linuxcare.com>
 399 - SMB printing code
 400
 401 Love <lha@stacken.kth.se>
 402 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
 403   change date format to the right one.
 404
 405 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
 406 - Created tcpdump.org repository
 407
 408 v3.4 Sat Jul 25 12:40:55 PDT 1998
 409
 410 - Hardwire Linux slip support since it's too hard to detect.
 411
 412 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
 413   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
 414
 415 - Added -a which tries to translate network and broadcast addresses to
 416   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
 417
 418 - Added a configure option to disable gcc.
 419
 420 - Added a "raw" packet printer.
 421
 422 - Not having an interface address is no longer fatal. Requested by John
 423   Hawkinson.
 424
 425 - Rework signal setup to accommodate Linux.
 426
 427 - OSPF truncation check fix. Also display the type of OSPF packets
 428   using MD5 authentication. Thanks to Brian Wellington
 429   (bwelling@tis.com)
 430
 431 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
 432   Peisach (epeisach@mit.edu)
 433
 434 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
 435   (plonka@mfa.com)
 436
 437 - Specify full install target as a way of detecting if install
 438   directory does not exist. Thanks to Dave Plonka.
 439
 440 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
 441   (paul@vix.com)
 442
 443 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
 444   Marty Leisner (leisner@sdsp.mc.xerox.com)
 445
 446 - Add a local autoconf macro to check for routines in libraries; the
 447   autoconf version is broken (it only puts the library name in the
 448   cache variable name). Thanks to John Hawkinson.
 449
 450 - Add a local autoconf macro to check for types; the autoconf version
 451   is broken (it uses grep instead of actually compiling a code fragment).
 452
 453 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
 454   formats.
 455
 456 - Extend OSF ip header workaround to versions 1 and 2.
 457
 458 - Fix some signed problems in the nfs printer. As reported by David
 459   Sacerdote (davids@silence.secnet.com)
 460
 461 - Detect group wheel and use it as the default since BSD/OS' install
 462   can't hack numeric groups. Reported by David Sacerdote.
 463
 464 - AIX needs special loader options. Thanks to Jonathan I. Kamens
 465   (jik@cam.ov.com)
 466
 467 - Fixed the nfs printer to print port numbers in decimal. Thanks to
 468   Kent Vander Velden (graphix@iastate.edu)
 469
 470 - Find installed libpcap in /usr/local/lib when not using gcc.
 471
 472 - Disallow network masks with non-network bits set.
 473
 474 - Attempt to detect "egcs" versions of gcc.
 475
 476 - Add missing closing double quotes when displaying bootp strings.
 477   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
 478
 479 v3.3 Sat Nov 30 20:56:27 PST 1996
 480
 481 - Added Linux support.
 482
 483 - GRE encapsulated packet printer thanks to John Hawkinson
 484   (jhawk@mit.edu)
 485
 486 - Rewrite gmt2local() to avoid problematic os dependencies.
 487
 488 - Suppress nfs truncation message on errors.
 489
 490 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
 491   Reported by Joachim Ott (ott@ardala.han.de)
 492
 493 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
 494
 495 - Print arp hardware type in host order. Thanks to Onno van der Linden
 496   (onno@simplex.nl)
 497
 498 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
 499   (barnett@grymoire.crd.ge.com)
 500
 501 - Fix rip printer to not print one more route than is actually in the
 502   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
 503   Bill Fenner (fenner@parc.xerox.com)
 504
 505 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
 506
 507 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
 508   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
 509
 510 - Rewrite ospf printer to improve truncation checks.
 511
 512 - Don't parse tcp options past the EOL. As noted by David Sacerdote
 513   (davids@secnet.com). Also, check tcp options to make sure they ar
 514   actually in the tcp header (in addition to the normal truncation
 515   checks). Fix the SACK code to print the N blocks (instead of the
 516   first block N times).
 517
 518 - Don't say really small UDP packets are truncated just because they
 519   aren't big enough to be a RPC. As noted by David Sacerdote.
 520
 521 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
 522
 523 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
 524   (martin@msp.se)
 525
 526 - Print mtu for icmp unreach need frag packets. Thanks to John
 527   Hawkinson (jhawk@mit.edu)
 528
 529 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
 530   (jch@bsdi.com)
 531
 532 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
 533   (kushida@trl.ibm.co.jp)
 534
 535 - Check igmp checksum if possible. Thanks to John Hawkinson.
 536
 537 - Made changes for SINIX. Thanks to Andrej Borsenkow
 538   (borsenkow.msk@sni.de)
 539
 540 - Use autoconf's idea of the top level directory in install targets.
 541   Thanks to John Hawkinson.
 542
 543 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
 544   Mogul (mogul@pa.dec.com)
 545
 546 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
 547   Thanks to John Hawkinson.
 548
 549 - Added some more packet truncation checks.
 550
 551 - On systems that have it, use sigset() instead of signal() since
 552   signal() has different semantics on these systems.
 553
 554 - Fixed some more alignment problems on the alpha.
 555
 556 - Add code to massage unprintable characters in the domain and ipx
 557   printers. Thanks to John Hawkinson.
 558
 559 - Added explicit netmask support. Thanks to Steve Nuchia
 560   (steve@research.oknet.com)
 561
 562 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
 563   Kennedy (terry@spcvxa.spc.edu)
 564
 565 - Add "atalk" keyword as suggested by John Hawkinson.
 566
 567 - Added an igrp printer. Thanks to Francis Dupont
 568   (francis.dupont@inria.fr)
 569
 570 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
 571   Kennedy (terry@spcvxa.spc.edu)
 572
 573 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
 574   (pascal.hennequin@hugo.int-evry.fr)
 575
 576 - Added some ETHERTYPEs missing on some systems.
 577
 578 - Added truncated packet macros and various checks.
 579
 580 - Fixed endian problems with the DECnet printer.
 581
 582 - Use $CC when checking gcc version. Thanks to Carl Lindberg
 583   (carl_lindberg@blacksmith.com)
 584
 585 - Fixes for AIX (although this system is not yet supported). Thanks to
 586   John Hawkinson.
 587
 588 - Fix bugs in the autoconf misaligned accesses code fragment.
 589
 590 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
 591   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
 592
 593 v3.2 Sun Jun 23 02:28:10 PDT 1996
 594
 595 - Print new icmp unreachable codes as suggested by Martin Fredriksson
 596   (martin@msp.se). Also print code value when unknown for icmp redirect
 597   and time exceeded.
 598
 599 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
 600
 601 - Define "new" domain record types if not found in arpa/nameserv.h.
 602   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
 603   fixed an endian bug when printing mx record and added some new record
 604   types.
 605
 606 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
 607
 608 - Added T/TCP options printing. As suggested by Richard Stevens
 609   (rstevens@noao.edu)
 610
 611 - Use autoconf to detect architectures that can't handle misaligned
 612   accesses.
 613
 614 v3.1 Thu Jun 13 20:59:32 PDT 1996
 615
 616 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
 617   and bind (as suggested by Charles Hannum).
 618
 619 - Port to GNU autoconf.
 620
 621 - Add support for printing DVMRP and PIM traffic thanks to
 622   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
 623
 624 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
 625   define being referenced. Reported by Terry Kennedy.
 626
 627 - Minor fixes to the man page thanks to Mark Andrews.
 628
 629 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
 630   (bmah@cs.berkeley.edu).
 631
 632 - Added support for new dns types, thanks to Rainer Orth.
 633
 634 - Fixed tftp_print() to print the block number for ACKs.
 635
 636 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
 637   (cslater@imatek.com).
 638
 639 - Check return status from malloc/calloc/etc.
 640
 641 - Check return status from pcap_loop() so we can print an error and
 642   exit with a bad status if there were problems.
 643
 644 - Bail if ip option length is <= 0. Resulted from a bug report from
 645   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
 646
 647 - Print out a little more information for sun rpc packets.
 648
 649 - Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
 650
 651 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
 652   wrong on little endian machines).
 653
 654 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
 655   (crawdad@fnal.gov).
 656
 657 - Fix ntp_print() to not print garbage when the stratum is
 658   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
 659
 660 - Rewrote tcp options printer code to check for truncation. Added
 661   selective acknowledgment case.
 662
 663 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
 664   (jch@bsdi.com)
 665
 666 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
 667   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
 668   (toku@dit.co.jp)
 669
 670 - Don't checksum ip header if we don't have all of it. Thanks to John
 671   Hawkinson (jhawk@mit.edu).
 672
 673 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
 674   Honig (jhc@bsdi.com)
 675
 676
 677 v3.1a1 Wed May  3 19:21:11 PDT 1995
 678
 679 - Include time.h when SVR4 is defined to avoid problems under Solaris
 680   2.3.
 681
 682 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
 683   strings, not the local buffer. Thanks to Stefan Petri
 684   (petri@ibr.cs.tu-bs.de).
 685
 686 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
 687   that the selected value was not used. Thanks to Pascal Hennequin
 688   (Pascal.Hennequin@hugo.int-evry.fr).
 689
 690 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
 691
 692 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
 693
 694 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
 695
 696 - Although there never was a 3.0.3 release, the linux boys cleverly
 697   "released" one in late 1995.
 698
 699 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
 700
 701 - Change configuration to not use gcc v2 flags with gcc v1.
 702
 703 - Redo gmt2local() so that it works under BSDI (which seems to return
 704   an empty timezone struct from gettimeofday()). Based on report from
 705   Terry Kennedy (terry@spcvxa.spc.edu).
 706
 707 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
 708   on report from Mark Andrews (mandrews@alias.com).
 709
 710 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
 711   Orth (ro@techfak.uni-bielefeld.de).
 712
 713 - Fixed printout of connection id for uncompressed tcp slip packets.
 714   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
 715
 716 - Hack around deficiency in Ultrix's make.
 717
 718 - Add ETHERTYPE_TRAIL define which is missing from irix5.
 719
 720 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
 721
 722 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
 723
 724 v3.0 Mon Jun 20 19:23:27 PDT 1994
 725
 726 - Added support for printing tcp option timestamps thanks to
 727   Mark Andrews (mandrews@alias.com).
 728
 729 - Reorganize protocol dumpers to take const pointers to packets so they
 730   never change the contents (i.e., they used to do endian conversions
 731   in place).  Previously, whenever more than one pass was taken over
 732   the packet, the packet contents would be dumped incorrectly (i.e.,
 733   the output form -x would be wrong on little endian machines because
 734   the protocol dumpers would modify the data).  Thanks to Charles Hannum
 735   (mycroft@gnu.ai.mit.edu) for reporting this problem.
 736
 737 - Added support for decnet protocol dumping thanks to Jeff Mogul
 738   (mogul@pa.dec.com).
 739
 740 - Fix bug that caused length of packet to be incorrectly printed
 741   (off by ether header size) for unknown ethernet types thanks
 742   to Greg Miller (gmiller@kayak.mitre.org).
 743
 744 - Added support for IPX protocol dumping thanks to Brad Parker
 745   (brad@fcr.com).
 746
 747 - Added check to verify IP header checksum under -v thanks to
 748   Brad Parker (brad@fcr.com).
 749
 750 - Move packet capture code to new libpcap library (which is
 751   packaged separately).
 752
 753 - Prototype everything and assume an ansi compiler.
 754
 755 - print-arp.c: Print hardware ethernet addresses if they're not
 756   what we expect.
 757
 758 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
 759   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
 760
 761 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
 762   (mogul@pa.dec.com).
 763
 764 - print-icmp.c: Byte swap netmask before printing. Thanks to
 765   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
 766
 767 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
 768   By default, only the inner packet is dumped, appended with the token
 769   "(encap)".  Under -v, both the inner and output packets are dumped
 770   (on the same line).  Note that the filter applies to the original packet,
 771   not the encapsulated packet.  So if you run tcpdump on a net with an
 772   IP Multicast tunnel, you cannot filter out the datagrams using the
 773   conventional syntax.  (You can filter away all the ip-in-ip traffic
 774   with "not ip proto 4".)
 775
 776 - print-nfs.c: Keep pending rpc's in circular table. Add generic
 777   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
 778
 779 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
 780
 781 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
 782   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
 783   Add && and || operators
 784
 785 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
 786
 787 - Fix bug with -c flag.
 788
 789 v2.2 Fri May 22 17:19:41 PDT 1992
 790
 791 - savefile.c: Remove hack that shouldn't have been exported. Add
 792   truncate checks.
 793
 794 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
 795   matches non-echo/reply ICMP packets.
 796
 797 - Many improvements to filter code optimizer.
 798
 799 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
 800   so that protocol qualifications are allowed. For example, "ip broadcast"
 801   and "ether multicast" are valid filters.
 802
 803 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
 804   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
 805   patches to netinet/if_loop.c.
 806
 807 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
 808   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
 809
 810 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
 811
 812 v2.1 Tue Jan 28 11:00:14 PST 1992
 813
 814 - Internal release (never publically exported).
 815
 816 v2.0.1 Sun Jan 26 21:10:10 PDT
 817
 818 - Various byte ordering fixes.
 819
 820 - Add truncation checks.
 821
 822 - inet.c: Support BSD style SIOCGIFCONF.
 823
 824 - nametoaddr.c: Handle multi addresses for single host.
 825
 826 - optimize.c: Rewritten.
 827
 828 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
 829   for broadcast nets.
 830
 831 - print-atal.c: Fix an alignment bug (thanks to
 832   stanonik@nprdc.navy.mil) Add missing printf() argument.
 833
 834 - print-bootp.c: First attempt at decoding the vendor buffer.
 835
 836 - print-domain.c: Fix truncation checks.
 837
 838 - print-icmp.c: Calculate length of packets from the ip header.
 839
 840 - print-ip.c: Print frag id in decimal (so it's easier to match up
 841   with non-frags). Add support for ospf, egp and igmp.
 842
 843 - print-nfs.c: Lots of changes.
 844
 845 - print-ntp.c: Make some verbose output depend on -v.
 846
 847 - print-snmp.c: New version from John LoVerso.
 848
 849 - print-tcp.c: Print rfc1072 tcp options.
 850
 851 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
 852   (microseconds) worth of precision. Fix uid bugs.
 853
 854 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
 855   With this option, you can create an architecture independent binary
 856   trace file in real time, without the overhead of the packet printer.
 857   At a later time, the packets can be filtered (again) and printed.
 858
 859 - BSD is supported.  You must have BPF in your kernel.
 860   Since the filtering is now done in the kernel, fewer packets are
 861   dropped.  In fact, with BPF and the packet dumper option, a measly
 862   Sun 3/50 can keep up with a busy network.
 863
 864 - Compressed SLIP packets can now be dumped, provided you use our
 865   SLIP software and BPF.  These packets are dumped as any other IP
 866   packet; the compressed headers are dumped with the '-e' option.
 867
 868 - Machines with little-endian byte ordering are supported (thanks to
 869   Jeff Mogul).
 870
 871 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
 872
 873 - IBM RT and Stanford Enetfilter support has been added by
 874   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
 875   both the vanilla Enetfilter interface, and the extended interface
 876   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
 877
 878 - TFTP packets are now printed (requests only).
 879
 880 - BOOTP packets are now printed.
 881
 882 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
 883
 884 - Sparc architectures, including the Sparcstation-1, are now
 885   supported thanks to Steve McCanne and Craig Leres.
 886
 887 - SunOS 4 is now supported thanks to Micky Liu of Columbia
 888   University (micky@cunixc.cc.columbia.edu).
 889
 890 - IP options are now printed.
 891
 892 - RIP packets are now printed.
 893
 894 - There's a -v flag that prints out more information than the
 895   default (e.g., it will enable printing of IP ttl, tos and id)
 896   and -q flag that prints out less (e.g., it will disable
 897   interpretation of AppleTalk-in-UDP).
 898
 899 - The grammar has undergone substantial changes (if you have an
 900   earlier version of tcpdump, you should re-read the manual
 901   entry).
 902
 903   The most useful change is the addition of an expression
 904   syntax that lets you filter on arbitrary fields or values in the
 905   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
 906   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
 907   packets.
 908
 909   The most painful change is that concatenation no longer means
 910   "and" -- e.g., you have to say "host foo and port bar" instead
 911   of "host foo port bar".  The up side to this down is that
 912   repeated qualifiers can be omitted, making most filter
 913   expressions shorter.  E.g., you can now say "ip host foo and
 914   (bar or baz)" to look at ip traffic between hosts foo and bar or
 915   between hosts foo and baz.  [The old way of saying this was "ip
 916   host foo and (ip host bar or ip host baz)".]
 917
 918 v2.0 Sun Jan 13 12:20:40 PST 1991
 919
 920 - Initial public release.