The Tcpdump Group git mirrors - tcpdump/blob - CHANGES

   1 Sunday  July 24, 2011.  mcr@sandelman.ca.
   2   Summary for 4.2.+
   3         merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov
   4           at gmail dot com>
   5         updates to forces for new port numbers
   6         Use "-H", not "-h", for the 802.11s option. (-h always help)
   7         Better ICMPv6 checksum handling.
   8         add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12
   9         get rid of uuencoded pcap test files, git can do binary.
  10         sFlow changes for 64-bit counters.
  11         fixes for PPI packet header handling and printing.
  12         Add DCB Exchange protocol (DCBX) version 1.01.
  13         Babel dissector, from Juliusz Chroboczek and Grégoire Henry.
  14         improvements to radiotap for rate values > 127.
  15         Many improvements to ForCES decode, including fix SCTP TML port
  16         updated RPL type code to RPL-17 draft
  17         Improve printout of DHCPv6 options.
  18         added support and test case for QinQ (802.1q VLAN) packets
  19         Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4.
  20         Build fixes for Sparc and other machines with alignment restrictions.
  21         Merged changes from Debian package.
  22         PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options.
  23         Build fixes for OSX (Snow Leopard and others)
  24         Add support for IEEE 802.15.4 packets
  25
  26 Tue.    July 20, 2010.  guy@alum.mit.edu.
  27   Summary for 4.1.2 tcpdump release
  28         If -U is specified, flush the file after creating it, so it's
  29           not zero-length
  30         Fix TCP flags output description, and some typoes, in the man
  31           page
  32         Add a -h flag, and only attempt to recognize 802.11s mesh
  33           headers if it's set
  34         When printing the link-layer type list, send *all* output to
  35           stderr
  36         Include the CFLAGS setting when configure was run in the
  37           compiler flags
  38
  39 Thu.    April 1, 2010.  guy@alum.mit.edu.
  40   Summary for 4.1.1 tcpdump release
  41         Fix build on systems with PF, such as FreeBSD and OpenBSD.
  42         Don't blow up if a zero-length link-layer address is passed to
  43           linkaddr_string().
  44
  45 Thu.    March 11, 2010.  ken@netfunctional.ca/guy@alum.mit.edu.
  46   Summary for 4.1.0 tcpdump release
  47         Fix printing of MAC addresses for VLAN frames with a length
  48           field
  49         Add some additional bounds checks and use the EXTRACT_ macros
  50           more
  51         Add a -b flag to print the AS number in BGP packets in ASDOT
  52           notation rather than ASPLAIN notation
  53         Add ICMPv6 RFC 5006 support
  54         Decode the access flags in NFS access requests
  55         Handle the new DLT_ for memory-mapped USB captures on Linux
  56         Make the default snapshot (-s) the maximum
  57         Print name of device (when -L is used)
  58         Support for OpenSolaris (and SXCE build 125 and later)
  59         Print new TCP flags
  60         Add support for RPL DIO
  61         Add support for TCP User Timeout (UTO)
  62         Add support for non-standard Ethertypes used by 3com PPPoE gear
  63         Add support for 802.11n and 802.11s
  64         Add support for Transparent Ethernet Bridge ethertype in GRE
  65         Add 4 byte AS support for BGP printer
  66         Add support for the MDT SAFI 66 BG printer
  67         Add basic IPv6 support to print-olsr
  68         Add USB printer
  69         Add printer for ForCES
  70         Handle frames with an FCS
  71         Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames
  72         Fix TCP sequence number printing
  73         Report 802.2 packets as 802.2 instead of 802.3
  74         Don't include -L/usr/lib in LDFLAGS
  75         On x86_64 Linux, look in lib64 directory too
  76         Lots of code clean ups
  77         Autoconf clean ups
  78         Update testcases to make output changes
  79         Fix compiling with/out smi (--with{,out}-smi)
  80         Fix compiling without IPv6 support (--disable-ipv6)
  81
  82 Mon.    October 27, 2008.  ken@netfunctional.ca.  Summary for 4.0.0 tcpdump release
  83         Add support for Bluetooth Sniffing
  84         Add support for Realtek Remote Control Protocol (openrrcp.org.ru)
  85         Add support for 802.11 AVS
  86         Add support for SMB over TCP
  87         Add support for 4 byte BGP AS printing
  88         Add support for compiling on case-insensitive file systems
  89         Add support for ikev2 printing
  90         Update support for decoding AFS
  91         Update DHCPv6 printer
  92         Use newer libpcap API's (allows -B option on all platforms)
  93         Add -I to turn on monitor mode
  94         Bugfixes in lldp, lspping, dccp, ESP, NFS printers
  95         Cleanup unused files and various cruft
  96
  97 Mon.    September 10, 2007.  ken@xelerance.com.  Summary for 3.9.8 tcpdump release
  98         Rework ARP printer
  99         Rework OSPFv3 printer
 100         Add support for Frame-Relay ARP
 101         Decode DHCP Option 121 (RFC 3442 Classless Static Route)
 102         Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
 103         TLV: Add support for Juniper .pcap extensions
 104         Print EGP header in new-world-order style
 105         Converted print-isakmp.c to NETDISSECT
 106         Moved AF specific stuff into af.h
 107         Test subsystem now table driven, and saves outputs and diffs to one place
 108         Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
 109          libpcap files on an OS other than where the file was generated
 110
 111
 112 Wed.    July 23, 2007.  mcr@xelerance.com.  Summary for 3.9.7 libpcap release
 113
 114         NFS: Print unsigned values as such.
 115         RX: parse safely.
 116         BGP: fixes for IPv6-less builds.
 117         801.1ag: use standard codepoint.
 118         use /dev/bpf on systems with such a device.
 119         802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
 120         smb: make sure that we haven't gone past the end of the captured data.
 121         smb: squelch an uninitialized complaint from coverity.
 122         NFS: from NetBSD; don't interpret the reply as a possible NFS reply
 123                 if it got MSG_DENIED.
 124         BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
 125         revised INSTALL.txt about libpcap dependancy.
 126
 127 Wed.    April 25, 2007. ken@xelerance.com.  Summary for 3.9.6 tcpdump release
 128         Update man page to reflect changes to libpcap
 129         Changes to both TCP and IP Printer Output
 130         Fix a potential buffer overflow in the 802.11 printer
 131         Print basic info about a few more Cisco LAN protocols.
 132         mDNS cleanup
 133         ICMP MPLS rework of the extension code
 134         bugfix: use the correct codepoint for the OSPF simple text auth token
 135          entry, and use safeputs to print the password.
 136         Add support in pflog for additional values
 137         Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
 138         Add support for the Message-id NACK c-type.
 139         Add support for 802.3ah loopback ctrl msg
 140         Add support for Multiple-STP as per 802.1s
 141         Add support for rapid-SPT as per 802.1w
 142         Add support for CFM Link-trace msg, Link-trace-Reply msg,
 143          Sender-ID tlv, private tlv, port, interface status
 144         Add support for unidirectional link detection as per
 145          http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt
 146         Add support for the olsr protocol as per RFC 3626 plus the LQ
 147          extensions from olsr.org
 148         Add support for variable-length checksum in DCCP, as per section 9 of
 149          RFC 4340.
 150         Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
 151         Add support for Multiple-STP as per 802.1s
 152         Add support for the cisco propriatry 'dynamic trunking protocol'
 153         Add support for the cisco proprietary VTP protocol
 154         Update dhcp6 options table as per IETF standardization activities
 155
 156
 157 Tue.    September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
 158
 159         Fix compiling on AIX (, at end of ENUM)
 160         Updated list of DNS RR typecodes
 161         Use local Ethernet defs on WIN32
 162         Add support for Frame-Relay ARP
 163         Fixes for compiling under MSVC++
 164         Add support for parsing Juniper .pcap files
 165         Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
 166         Rework the OSPFv3 printer
 167         Fix printing for 4.4BSD/NetBSD NFS Filehandles
 168         Add support for Cisco style NLPID encapsulation
 169         Add cisco prop. eigrp related, extended communities
 170         Add support for BGP signaled VPLS
 171         Cleanup the bootp printer
 172         Add support for PPP over Frame-Relay
 173         Add some bounds checking to the IP options code, and clean up
 174          the options output a bit.
 175         Add additional modp groups to ISAKMP printer
 176         Add support for Address-Withdraw and Label-Withdraw Msgs
 177         Add support for the BFD Discriminator TLV
 178         Fixes for 64bit compiling
 179         Add support for PIMv2 checksum verification
 180         Add support for further dissection of the IPCP Compression Option
 181         Add support for Cisco's proposed VQP protocol
 182         Add basic support for keyed authentication TCP option
 183         Lots of minor cosmetic changes to output printers
 184
 185
 186 Mon.    September 19, 2005.  ken@xelerance.com. Summary for 3.9.4 tcpdump release
 187         Decoder support for more Juniper link-layer types
 188         Fix a potential buffer overflow (although it can't occur in
 189                 practice).
 190         Fix the handling of unknown management frame types in the 802.11
 191                 printer.
 192         Add FRF.16 support, fix various Frame Relay bugs.
 193         Add support for RSVP integrity objects, update fast-reroute
 194                 object printer to latest spec.
 195         Clean up documentation of vlan filter expression, document mpls
 196                 filter expression.
 197         Document new pppoed and pppoes filter expressions.
 198         Update diffserver-TE codepoints as per RFC 4124.
 199         Spelling fixes in ICMPv6.
 200         Don't require any fields other than flags to be present in IS-IS
 201                 restart signaling TLVs, and only print the system ID in
 202                 those TLVs as system IDs, not as node IDs.
 203         Support for DCCP.
 204
 205 Tue.    July 5, 2005.  ken@xelerance.com. Summary for 3.9.3 tcpdump release
 206
 207         Option to chroot() when dropping privs
 208         Fixes for compiling on nearly every platform,
 209                 including improved 64bit support
 210         Many new testcases
 211         Support for sending packets
 212         Many compliation fixes on most platforms
 213         Fixes for recent version of GCC to eliminate warnings
 214         Improved Unicode support
 215
 216         Decoders & DLT Changes, Updates and New:
 217                 AES ESP support
 218                 Juniper ATM, FRF.15, FRF.16, PPPoE,
 219                         ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
 220                         GGSN,ES,MONITOR,SERVICES
 221                 L2VPN
 222                 Axent Raptor/Symantec Firewall
 223                 TCP-MD5 (RFC 2385)
 224                 ESP-in-UDP (RFC 3948)
 225                 ATM OAM
 226                 LMP, LMP Service Discovery
 227                 IP over FC
 228                 IP over IEEE 1394
 229                 BACnet MS/TP
 230                 SS7
 231                 LDP over TCP
 232                 LACP, MARKER as per 802.3ad
 233                 PGM (RFC 3208)
 234                 LSP-PING
 235                 G.7041/Y.1303 Generic Framing Procedure
 236                 EIGRP-IP, EIGRP-IPX
 237                 ICMP6
 238                 Radio - via radiotap
 239                 DHCPv6
 240                 HDLC over PPP
 241
 242 Tue.   March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
 243
 244         No changes from 3.8.2. Version bumped only to maintain consistency
 245         with libpcap 0.8.3.
 246
 247 Mon.   March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
 248
 249         Fixes for print-isakmp.c      CVE:    CAN-2004-0183, CAN-2004-0184
 250                              http://www.rapid7.com/advisories/R7-0017.html
 251         IP-over-IEEE1394 printing.
 252         some MINGW32 changes.
 253         updates for autoconf 2.5
 254         fixes for print-aodv.c - check for too short packets
 255         formatting changes to print-ascii for hex output.
 256         check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
 257                 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
 258                 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
 259                 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
 260         print-ether.c - better handling of unknown types.
 261         print-isoclns.c - additional decoding of types.
 262         print-llc.c - strings for LLC names added.
 263         print-pfloc.c - various enhancements
 264         print-radius.c - better decoding to strings.
 265
 266 Wed.   November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
 267
 268         changed syntax of -E argument so that multiple SAs can be decrypted
 269         fixes for Digital Unix headers and Documentation
 270         __attribute__ fixes
 271         CDP changes from Terry Kennedy <terry@tmk.com>.
 272         IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
 273         Fixes for ASN.1 decoder for 2.100.3 forms.
 274         Added a count of packets received and processed to clarify numbers.
 275         Incorporated WinDUMP patches for Win32 builds.
 276         PPPoE payload length headers.
 277         Fixes for HP C compiler builds.
 278         Use new pcap_breakloop() and pcap_findalldevs() if we can.
 279         BGP output split into multiple lines.
 280         Fixes to 802.11 decoding.
 281         Fixes to PIM decoder.
 282         SuperH is a CPU that can't handle unaligned access. Many fixes for
 283                 unaligned access work.
 284         Fixes to Frame-Relay decoder for Q.933/922 frames.
 285         Clarified when Solaris can do captures as non-root.
 286         Added tests/ subdir for examples/regression tests.
 287         New -U flag.    -flush stdout after every packet
 288         New -A flag     -print ascii only
 289         support for decoding IS-IS inside Cisco HDLC Frames
 290         more verbosity for tftp decoder
 291         mDNS decoder
 292         new BFD decoder
 293         cross compilation patches
 294         RFC 3561 AODV support.
 295         UDP/TCP pseudo-checksum properly for source-route options.
 296         sanitized all files to modified BSD license
 297         Add support for RFC 2625 IP-over-Fibre Channel.
 298         fixes for DECnet support.
 299         Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
 300         RFC 2684 encapsulation of BPDUs.
 301
 302 Tuesday, February 25, 2003. fenner@research.att.com.  3.7.2 release
 303
 304         Fixed infinite loop when parsing malformed isakmp packets.
 305          (reported by iDefense; already fixed in CVS)
 306         Fixed infinite loop when parsing malformed BGP packets.
 307         Fixed buffer overflow with certain malformed NFS packets.
 308         Pretty-print unprintable network names in 802.11 printer.
 309         Handle truncated nbp (appletalk) packets.
 310         Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
 311         Print IP protocol name even if we don't have a printer for it.
 312         Print IP protocol name or number for fragments.
 313         Print the whole MPLS label stack, not just the top label.
 314         Print request header and file handle for NFS v3 FSINFO and PATHCONF
 315          requests.
 316         Fix NFS packet truncation checks.
 317         Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
 318         Handle unknown RADIUS attributes properly.
 319         Fix an ASN.1 parsing error that would cause e.g. the OID
 320          2.100.3 to be misrepresented as 4.20.3 .
 321
 322 Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
 323 see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log.
 324         keyword "ipx" added.
 325         Better OSI/802.2 support on Linux.
 326         IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
 327         LLC SAP support for FDDI/token ring/RFC-1483 style ATM
 328         BXXP protocol was replaced by the BEEP protocol;
 329         improvements to SNAP demux.
 330         Changes to "any" interface documentation.
 331         Documentation on pcap_stats() counters.
 332         Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
 333         Added MPLS encapsulation decoding per RFC3032.
 334         DNS dissector handles TKEY, TSIG and IXFR.
 335         adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
 336         SMB printing has much improved bounds checks
 337         OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
 338         Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
 339         Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
 340         IPX socket 0x85be is for Cisco EIGRP over IPX.
 341         Improvements to fragmented ESP handling.
 342         SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
 343         Linux ARPHDR_ATM support fixed.
 344         Added a "netbeui" keyword, which selects NetBEUI packets.
 345         IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
 346         Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
 347         Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
 348         Better Linux libc5 compat.
 349         BIND9 lwres dissector added.
 350         MIPS and SPARC get strict alignment macros (affects print-bgp.c)
 351         Apple LocalTalk LINKTYPE_ reserved.
 352         New time stamp formats documented.
 353         DHCP6 updated to draft-22.txt spec.
 354         ICMP types/codes now accept symbolic names.
 355         Add SIGINFO handler from LBL
 356         encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
 357         now we are -Wstrict-prototype clean.
 358         NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
 359         PPPoE dissector cleaned up.
 360         Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
 361         In dissector, now the caller prints the IP addresses rather than proto.
 362         cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
 363         LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
 364         Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
 365         captures on the "any" device won't be done in promiscuous mode
 366         Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
 367         ARCNet support, from NetBSD.
 368         HSRP dissector, from Julian Cowley <julian@lava.net>.
 369         Handle (GRE-encapsulated) PPTP
 370         added -C option to rotate save file every optarg * 1,000,000 bytes.
 371         support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
 372         PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
 373         IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
 374         CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
 375         ESP printing updated to RFC2406.
 376         HP-UX can now handle large number of PPAs.
 377         MSDP printer added.
 378         L2TP dissector improvements from Motonori Shindo.
 379
 380 Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
 381         Cleaned up documentation.
 382         Promisc mode fixes for Linux
 383         IPsec changes/cleanups.
 384         Alignment fixes for picky architectures
 385
 386         Removed dependency on native headers for packet dissectors.
 387         Removed Linux specific headers that were shipped
 388
 389         libpcap changes provide for exchanging capture files between
 390           systems. Save files now have well known PACKET_ values instead of
 391           depending upon system dependant mappings of DLT_* types.
 392
 393         Support for computing/checking IP and UDP/TCP checksums.
 394
 395         Updated autoconf stock files.
 396
 397         IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
 398
 399         Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
 400                 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
 401
 402         Added filtering support for: VLANs, ESIS, ISIS
 403
 404         Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
 405                 L2TP, PPPoE
 406
 407         HP-UX 11.0 -- find the right dlpi device.
 408         Solaris 8 - IPv6 works
 409         Linux - Added support for an "any" device to capture on all interfaces
 410
 411         Security fixes: buffer overrun audit done. Strcpy replaced with
 412                 strlcpy, sprintf replaced with snprintf.
 413         Look for lex problems, and warn about them.
 414
 415
 416 v3.5 Fri Jan 28 18:00:00 PST 2000
 417
 418 Bill Fenner <fenner@research.att.com>
 419 - switch to config.h for autoconf
 420 - unify RCSID strings
 421 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
 422 - Really fix the RIP printer
 423 - Fix MAC address -> name translation.
 424 - some -Wall -Wformat fixes
 425 - update makemib to parse much of SMIv2
 426 - Print TCP sequence # with -vv even if you normally wouldn't
 427 - Print as much of IP/TCP/UDP headers as possible even if truncated.
 428
 429 itojun@iijlab.net
 430 - -X will make a ascii dump.  from netbsd.
 431 - telnet command sequence decoder (ff xx xx).  from netbsd.
 432 - print-bgp.c: improve options printing.  ugly code exists for
 433   unaligned option parsing (need some fix).
 434 - const poisoning in SMB decoder.
 435 - -Wall -Werror clean checks.
 436 - bring in KAME IPv6/IPsec decoding code.
 437
 438 Assar Westerlund  <assar@sics.se>
 439 - SNMPv2 and SNMPv3 printer
 440 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode
 441   SNMP packets.
 442 - Incorporate NFS parsing code from NetBSD.  Adds support for nfsv3.
 443 - portability fixes
 444 - permit building in different directories.
 445
 446 Ken Hornstein <kenh@cmf.nrl.navy.mil>
 447 - bring in code at
 448   /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
 449   AFS3 packets
 450
 451 Andrew Tridgell <tridge@linuxcare.com>
 452 - SMB printing code
 453
 454 Love <lha@stacken.kth.se>
 455 - print-rx.c: add code for printing MakeDir and StoreStatus.  Also
 456   change date format to the right one.
 457
 458 Michael C. Richardson  <mcr@sandelman.ottawa.on.ca>
 459 - Created tcpdump.org repository
 460
 461 v3.4 Sat Jul 25 12:40:55 PDT 1998
 462
 463 - Hardwire Linux slip support since it's too hard to detect.
 464
 465 - Redo configuration of "network" libraries (-lsocket and -lnsl) to
 466   deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
 467
 468 - Added -a which tries to translate network and broadcast addresses to
 469   names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
 470
 471 - Added a configure option to disable gcc.
 472
 473 - Added a "raw" packet printer.
 474
 475 - Not having an interface address is no longer fatal. Requested by John
 476   Hawkinson.
 477
 478 - Rework signal setup to accommodate Linux.
 479
 480 - OSPF truncation check fix. Also display the type of OSPF packets
 481   using MD5 authentication. Thanks to Brian Wellington
 482   (bwelling@tis.com)
 483
 484 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra
 485   Peisach (epeisach@mit.edu)
 486
 487 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
 488   (plonka@mfa.com)
 489
 490 - Specify full install target as a way of detecting if install
 491   directory does not exist. Thanks to Dave Plonka.
 492
 493 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
 494   (paul@vix.com)
 495
 496 - Fix off-by-one bug when testing size of ethernet packets. Thanks to
 497   Marty Leisner (leisner@sdsp.mc.xerox.com)
 498
 499 - Add a local autoconf macro to check for routines in libraries; the
 500   autoconf version is broken (it only puts the library name in the
 501   cache variable name). Thanks to John Hawkinson.
 502
 503 - Add a local autoconf macro to check for types; the autoconf version
 504   is broken (it uses grep instead of actually compiling a code fragment).
 505
 506 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
 507   formats.
 508
 509 - Extend OSF ip header workaround to versions 1 and 2.
 510
 511 - Fix some signed problems in the nfs printer. As reported by David
 512   Sacerdote (davids@silence.secnet.com)
 513
 514 - Detect group wheel and use it as the default since BSD/OS' install
 515   can't hack numeric groups. Reported by David Sacerdote.
 516
 517 - AIX needs special loader options. Thanks to Jonathan I. Kamens
 518   (jik@cam.ov.com)
 519
 520 - Fixed the nfs printer to print port numbers in decimal. Thanks to
 521   Kent Vander Velden (graphix@iastate.edu)
 522
 523 - Find installed libpcap in /usr/local/lib when not using gcc.
 524
 525 - Disallow network masks with non-network bits set.
 526
 527 - Attempt to detect "egcs" versions of gcc.
 528
 529 - Add missing closing double quotes when displaying bootp strings.
 530   Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
 531
 532 v3.3 Sat Nov 30 20:56:27 PST 1996
 533
 534 - Added Linux support.
 535
 536 - GRE encapsulated packet printer thanks to John Hawkinson
 537   (jhawk@mit.edu)
 538
 539 - Rewrite gmt2local() to avoid problematic os dependencies.
 540
 541 - Suppress nfs truncation message on errors.
 542
 543 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
 544   Reported by Joachim Ott (ott@ardala.han.de)
 545
 546 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
 547
 548 - Print arp hardware type in host order. Thanks to Onno van der Linden
 549   (onno@simplex.nl)
 550
 551 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
 552   (barnett@grymoire.crd.ge.com)
 553
 554 - Fix rip printer to not print one more route than is actually in the
 555   packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
 556   Bill Fenner (fenner@parc.xerox.com)
 557
 558 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
 559
 560 - Fix dvmrp printer truncation checks and add a dvmrp probe printer.
 561   Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
 562
 563 - Rewrite ospf printer to improve truncation checks.
 564
 565 - Don't parse tcp options past the EOL. As noted by David Sacerdote
 566   (davids@secnet.com). Also, check tcp options to make sure they ar
 567   actually in the tcp header (in addition to the normal truncation
 568   checks). Fix the SACK code to print the N blocks (instead of the
 569   first block N times).
 570
 571 - Don't say really small UDP packets are truncated just because they
 572   aren't big enough to be a RPC. As noted by David Sacerdote.
 573
 574 v3.2.1 Sun Jul 14 03:02:26 PDT 1996
 575
 576 - Added rfc1716 icmp codes as suggested by Martin Fredriksson
 577   (martin@msp.se)
 578
 579 - Print mtu for icmp unreach need frag packets. Thanks to John
 580   Hawkinson (jhawk@mit.edu)
 581
 582 - Decode icmp router discovery messages. Thanks to Jeffrey Honig
 583   (jch@bsdi.com)
 584
 585 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
 586   (kushida@trl.ibm.co.jp)
 587
 588 - Check igmp checksum if possible. Thanks to John Hawkinson.
 589
 590 - Made changes for SINIX. Thanks to Andrej Borsenkow
 591   (borsenkow.msk@sni.de)
 592
 593 - Use autoconf's idea of the top level directory in install targets.
 594   Thanks to John Hawkinson.
 595
 596 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
 597   Mogul (mogul@pa.dec.com)
 598
 599 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
 600   Thanks to John Hawkinson.
 601
 602 - Added some more packet truncation checks.
 603
 604 - On systems that have it, use sigset() instead of signal() since
 605   signal() has different semantics on these systems.
 606
 607 - Fixed some more alignment problems on the alpha.
 608
 609 - Add code to massage unprintable characters in the domain and ipx
 610   printers. Thanks to John Hawkinson.
 611
 612 - Added explicit netmask support. Thanks to Steve Nuchia
 613   (steve@research.oknet.com)
 614
 615 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
 616   Kennedy (terry@spcvxa.spc.edu)
 617
 618 - Add "atalk" keyword as suggested by John Hawkinson.
 619
 620 - Added an igrp printer. Thanks to Francis Dupont
 621   (francis.dupont@inria.fr)
 622
 623 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
 624   Kennedy (terry@spcvxa.spc.edu)
 625
 626 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
 627   (pascal.hennequin@hugo.int-evry.fr)
 628
 629 - Added some ETHERTYPEs missing on some systems.
 630
 631 - Added truncated packet macros and various checks.
 632
 633 - Fixed endian problems with the DECnet printer.
 634
 635 - Use $CC when checking gcc version. Thanks to Carl Lindberg
 636   (carl_lindberg@blacksmith.com)
 637
 638 - Fixes for AIX (although this system is not yet supported). Thanks to
 639   John Hawkinson.
 640
 641 - Fix bugs in the autoconf misaligned accesses code fragment.
 642
 643 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
 644   Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
 645
 646 v3.2 Sun Jun 23 02:28:10 PDT 1996
 647
 648 - Print new icmp unreachable codes as suggested by Martin Fredriksson
 649   (martin@msp.se). Also print code value when unknown for icmp redirect
 650   and time exceeded.
 651
 652 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
 653
 654 - Define "new" domain record types if not found in arpa/nameserv.h.
 655   Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
 656   fixed an endian bug when printing mx record and added some new record
 657   types.
 658
 659 - Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
 660
 661 - Added T/TCP options printing. As suggested by Richard Stevens
 662   (rstevens@noao.edu)
 663
 664 - Use autoconf to detect architectures that can't handle misaligned
 665   accesses.
 666
 667 v3.1 Thu Jun 13 20:59:32 PDT 1996
 668
 669 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
 670   and bind (as suggested by Charles Hannum).
 671
 672 - Port to GNU autoconf.
 673
 674 - Add support for printing DVMRP and PIM traffic thanks to
 675   Havard Eidnes (Havard.Eidnes@runit.sintef.no).
 676
 677 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
 678   define being referenced. Reported by Terry Kennedy.
 679
 680 - Minor fixes to the man page thanks to Mark Andrews.
 681
 682 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
 683   (bmah@cs.berkeley.edu).
 684
 685 - Added support for new dns types, thanks to Rainer Orth.
 686
 687 - Fixed tftp_print() to print the block number for ACKs.
 688
 689 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater
 690   (cslater@imatek.com).
 691
 692 - Check return status from malloc/calloc/etc.
 693
 694 - Check return status from pcap_loop() so we can print an error and
 695   exit with a bad status if there were problems.
 696
 697 - Bail if ip option length is <= 0. Resulted from a bug report from
 698   Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
 699
 700 - Print out a little more information for sun rpc packets.
 701
 702 - Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
 703
 704 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
 705   wrong on little endian machines).
 706
 707 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
 708   (crawdad@fnal.gov).
 709
 710 - Fix ntp_print() to not print garbage when the stratum is
 711   "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
 712
 713 - Rewrote tcp options printer code to check for truncation. Added
 714   selective acknowledgment case.
 715
 716 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
 717   (jch@bsdi.com)
 718
 719 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
 720   octet for the sa_family member. Thanks to Yoshitaka Tokugawa
 721   (toku@dit.co.jp)
 722
 723 - Don't checksum ip header if we don't have all of it. Thanks to John
 724   Hawkinson (jhawk@mit.edu).
 725
 726 - Print out hostnames if possible in egp printer. Thanks to Jeffrey
 727   Honig (jhc@bsdi.com)
 728
 729
 730 v3.1a1 Wed May  3 19:21:11 PDT 1995
 731
 732 - Include time.h when SVR4 is defined to avoid problems under Solaris
 733   2.3.
 734
 735 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved
 736   strings, not the local buffer. Thanks to Stefan Petri
 737   (petri@ibr.cs.tu-bs.de).
 738
 739 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning
 740   that the selected value was not used. Thanks to Pascal Hennequin
 741   (Pascal.Hennequin@hugo.int-evry.fr).
 742
 743 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
 744
 745 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
 746
 747 v3.0.3 Sun Oct  1 18:35:00 GMT 1995
 748
 749 - Although there never was a 3.0.3 release, the linux boys cleverly
 750   "released" one in late 1995.
 751
 752 v3.0.2 Thu Apr 20 21:28:16 PDT 1995
 753
 754 - Change configuration to not use gcc v2 flags with gcc v1.
 755
 756 - Redo gmt2local() so that it works under BSDI (which seems to return
 757   an empty timezone struct from gettimeofday()). Based on report from
 758   Terry Kennedy (terry@spcvxa.spc.edu).
 759
 760 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
 761   on report from Mark Andrews (mandrews@alias.com).
 762
 763 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer
 764   Orth (ro@techfak.uni-bielefeld.de).
 765
 766 - Fixed printout of connection id for uncompressed tcp slip packets.
 767   Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
 768
 769 - Hack around deficiency in Ultrix's make.
 770
 771 - Add ETHERTYPE_TRAIL define which is missing from irix5.
 772
 773 v3.0.1 Wed Aug 31 22:42:26 PDT 1994
 774
 775 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
 776
 777 v3.0 Mon Jun 20 19:23:27 PDT 1994
 778
 779 - Added support for printing tcp option timestamps thanks to
 780   Mark Andrews (mandrews@alias.com).
 781
 782 - Reorganize protocol dumpers to take const pointers to packets so they
 783   never change the contents (i.e., they used to do endian conversions
 784   in place).  Previously, whenever more than one pass was taken over
 785   the packet, the packet contents would be dumped incorrectly (i.e.,
 786   the output form -x would be wrong on little endian machines because
 787   the protocol dumpers would modify the data).  Thanks to Charles Hannum
 788   (mycroft@gnu.ai.mit.edu) for reporting this problem.
 789
 790 - Added support for decnet protocol dumping thanks to Jeff Mogul
 791   (mogul@pa.dec.com).
 792
 793 - Fix bug that caused length of packet to be incorrectly printed
 794   (off by ether header size) for unknown ethernet types thanks
 795   to Greg Miller (gmiller@kayak.mitre.org).
 796
 797 - Added support for IPX protocol dumping thanks to Brad Parker
 798   (brad@fcr.com).
 799
 800 - Added check to verify IP header checksum under -v thanks to
 801   Brad Parker (brad@fcr.com).
 802
 803 - Move packet capture code to new libpcap library (which is
 804   packaged separately).
 805
 806 - Prototype everything and assume an ansi compiler.
 807
 808 - print-arp.c: Print hardware ethernet addresses if they're not
 809   what we expect.
 810
 811 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
 812   Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
 813
 814 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul
 815   (mogul@pa.dec.com).
 816
 817 - print-icmp.c: Byte swap netmask before printing. Thanks to
 818   Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
 819
 820 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
 821   By default, only the inner packet is dumped, appended with the token
 822   "(encap)".  Under -v, both the inner and output packets are dumped
 823   (on the same line).  Note that the filter applies to the original packet,
 824   not the encapsulated packet.  So if you run tcpdump on a net with an
 825   IP Multicast tunnel, you cannot filter out the datagrams using the
 826   conventional syntax.  (You can filter away all the ip-in-ip traffic
 827   with "not ip proto 4".)
 828
 829 - print-nfs.c: Keep pending rpc's in circular table. Add generic
 830   nfs header and remove os dependences. Thanks to Jeffrey Mogul.
 831
 832 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
 833
 834 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
 835   (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
 836   Add && and || operators
 837
 838 v2.2.1 Tue Jun 6 17:57:22 PDT 1992
 839
 840 - Fix bug with -c flag.
 841
 842 v2.2 Fri May 22 17:19:41 PDT 1992
 843
 844 - savefile.c: Remove hack that shouldn't have been exported. Add
 845   truncate checks.
 846
 847 - Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
 848   matches non-echo/reply ICMP packets.
 849
 850 - Many improvements to filter code optimizer.
 851
 852 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be
 853   so that protocol qualifications are allowed. For example, "ip broadcast"
 854   and "ether multicast" are valid filters.
 855
 856 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
 857   Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
 858   patches to netinet/if_loop.c.
 859
 860 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
 861   Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
 862
 863 - Added EGP and OSPF printers, thanks to Jeffrey Honig.
 864
 865 v2.1 Tue Jan 28 11:00:14 PST 1992
 866
 867 - Internal release (never publically exported).
 868
 869 v2.0.1 Sun Jan 26 21:10:10 PDT
 870
 871 - Various byte ordering fixes.
 872
 873 - Add truncation checks.
 874
 875 - inet.c: Support BSD style SIOCGIFCONF.
 876
 877 - nametoaddr.c: Handle multi addresses for single host.
 878
 879 - optimize.c: Rewritten.
 880
 881 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
 882   for broadcast nets.
 883
 884 - print-atal.c: Fix an alignment bug (thanks to
 885   stanonik@nprdc.navy.mil) Add missing printf() argument.
 886
 887 - print-bootp.c: First attempt at decoding the vendor buffer.
 888
 889 - print-domain.c: Fix truncation checks.
 890
 891 - print-icmp.c: Calculate length of packets from the ip header.
 892
 893 - print-ip.c: Print frag id in decimal (so it's easier to match up
 894   with non-frags). Add support for ospf, egp and igmp.
 895
 896 - print-nfs.c: Lots of changes.
 897
 898 - print-ntp.c: Make some verbose output depend on -v.
 899
 900 - print-snmp.c: New version from John LoVerso.
 901
 902 - print-tcp.c: Print rfc1072 tcp options.
 903
 904 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
 905   (microseconds) worth of precision. Fix uid bugs.
 906
 907 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
 908   With this option, you can create an architecture independent binary
 909   trace file in real time, without the overhead of the packet printer.
 910   At a later time, the packets can be filtered (again) and printed.
 911
 912 - BSD is supported.  You must have BPF in your kernel.
 913   Since the filtering is now done in the kernel, fewer packets are
 914   dropped.  In fact, with BPF and the packet dumper option, a measly
 915   Sun 3/50 can keep up with a busy network.
 916
 917 - Compressed SLIP packets can now be dumped, provided you use our
 918   SLIP software and BPF.  These packets are dumped as any other IP
 919   packet; the compressed headers are dumped with the '-e' option.
 920
 921 - Machines with little-endian byte ordering are supported (thanks to
 922   Jeff Mogul).
 923
 924 - Ultrix 4.0 is supported (also thanks to Jeff Mogul).
 925
 926 - IBM RT and Stanford Enetfilter support has been added by
 927   Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
 928   both the vanilla Enetfilter interface, and the extended interface
 929   (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
 930
 931 - TFTP packets are now printed (requests only).
 932
 933 - BOOTP packets are now printed.
 934
 935 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
 936
 937 - Sparc architectures, including the Sparcstation-1, are now
 938   supported thanks to Steve McCanne and Craig Leres.
 939
 940 - SunOS 4 is now supported thanks to Micky Liu of Columbia
 941   University (micky@cunixc.cc.columbia.edu).
 942
 943 - IP options are now printed.
 944
 945 - RIP packets are now printed.
 946
 947 - There's a -v flag that prints out more information than the
 948   default (e.g., it will enable printing of IP ttl, tos and id)
 949   and -q flag that prints out less (e.g., it will disable
 950   interpretation of AppleTalk-in-UDP).
 951
 952 - The grammar has undergone substantial changes (if you have an
 953   earlier version of tcpdump, you should re-read the manual
 954   entry).
 955
 956   The most useful change is the addition of an expression
 957   syntax that lets you filter on arbitrary fields or values in the
 958   packet.  E.g., "ip[0] > 0x45" would print only packets with IP
 959   options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
 960   packets.
 961
 962   The most painful change is that concatenation no longer means
 963   "and" -- e.g., you have to say "host foo and port bar" instead
 964   of "host foo port bar".  The up side to this down is that
 965   repeated qualifiers can be omitted, making most filter
 966   expressions shorter.  E.g., you can now say "ip host foo and
 967   (bar or baz)" to look at ip traffic between hosts foo and bar or
 968   between hosts foo and baz.  [The old way of saying this was "ip
 969   host foo and (ip host bar or ip host baz)".]
 970
 971 v2.0 Sun Jan 13 12:20:40 PST 1991
 972
 973 - Initial public release.