1Tuesday Sep. 2, 2014 mcr@sandelman.ca 2 fix out-of-source-tree builds: find libpcap that is out of source 3 better configure check for libsmi 4 5Saturday Jul. 19, 2014 mcr@sandelman.ca 6 Summary for 4.6.1 tcpdump release 7 added FreeBSD capsicum 8 add a short option '#', same as long option '--number' 9 10Wednesday Jul. 2, 2014 mcr@sandelman.ca 11 Summary for 4.6.0 tcpdump release 12 all of tcpdump is now using the new "NDO" code base (Thanks Denis!) 13 nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes 14 M3UA decode added. 15 many new test cases: 82 in 4.5.1 to 133 in 4.6.0 16 many improvements to travis continuous integration system: OSX, and Coverity options 17 cleaned up some unnecessary header files 18 Added bittok2str(). 19 a number of unaligned access faults fixed 20 -A flag does not consider CR to be printable anymore 21 fx.lebail took over coverity baby sitting 22 default snapshot size increased to 256K for accomodate USB captures 23 WARNING: this release contains a lot of very worthwhile code churn. 24 25Wednesday Jan. 15, 2014 guy@alum.mit.edu 26 Summary for 4.5.2 tcpdump release 27 Man page fix 28 Fix crashes on SPARC 29 30Monday Nov. 11, 2013 mcr@sandelman.ca 31 Summary for 4.5.1 tcpdump release 32 CREDITS file fixes 33 34Thursday Nov. 7, 2013 mcr@sandelman.ca and guy@alum.mit.edu. 35 Summary for 4.5.0 tcpdump release 36 some NFSv4 fixes for printing 37 fix printing of unknown TCP options, and tcp fast-open 38 fixes for syslog parser 39 some gcc-version-specific flag tuning 40 adopt MacOS deprecation workarounds for openssl 41 improvements to babel printing 42 add OpenFlow 1.0 (no SSL) and test cases 43 GeoNet printer. 44 added STBC Rx support 45 improvements to DHCPv6 decoder 46 clarify which autoconf is needed 47 Point users to the the-tcpdump-group repository on GitHub rather 48 than the mcr repository 49 Add MSDP printer. 50 Fixed IPv6 check on Solaris and other OSes requiring extra 51 networking libraries. 52 Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03), 53 and add "vxlan" as an option for -T. 54 Add support for OTV (draft-hasmit-otv-04). 55 fixes for DLT_IEEE802_11_RADIO datalink types 56 added MPTCP decoder 57 58Saturday April 6, 2013 guy@alum.mit.edu. 59 Summary for 4.4.0 tcpdump release 60 RPKI-RTR (RFC6810) is now official (TCP Port 323) 61 Fix detection of OpenSSL libcrypto. 62 Add DNSSL (RFC6106) support. 63 Add "radius" as an option for -T. 64 Update Action codes for handle_action function according to 65 802.11s amendment. 66 Decode DHCPv6 AFTR-Name option (RFC6334). 67 Updates for Babel. 68 Fix printing of infinite lifetime in ICMPv6. 69 Added support for SPB, SPBM Service Identifier, and Unicast 70 Address sub-TLV in ISIS. 71 Decode RIPv2 authentication up to RFC4822. 72 Fix RIP Request/full table decoding issues. 73 On Linux systems with cap-ng.h, drop root privileges 74 using Linux Capabilities. 75 Add support for reading multiple files. 76 Add MS NLB heartbeat printer. 77 Separate multiple nexthops in BGP. 78 79Wednesday November 28, 2012 guy@alum.mit.edu. 80 Summary for 4.3.1 tcpdump release 81 Print "LLDP, length N" for LLDP packets even when not in verbose 82 mode, so something is printed even if only the timestamp is 83 present 84 Document "-T carp" 85 Print NTP poll interval correctly (it's an exponent, so print 86 both its raw value and 2^value) 87 Document that "-e" is used to get MAC addresses 88 More clearly document that you need to escape or quote 89 backslashes in filter expressions on the command line 90 Fix some "the the" in the man page 91 Use the right maximum path length 92 Don't treat 192_1_2, when passed to -i, as an interface number 93 94Friday April 3, 2012. mcr@sandelman.ca. 95 Summary for 4.3.0 tcpdump release 96 fixes for forces: SPARSE data (per RFC 5810) 97 some more test cases added 98 updates to documentation on -l, -U and -w flags. 99 Fix printing of BGP optional headers. 100 Tried to include DLT_PFSYNC support, failed due to headers required. 101 added TIPC support. 102 Fix LLDP Network Policy bit definitions. 103 fixes for IGMPv3's Max Response Time: it is in units of 0.1 second. 104 SIGUSR1 can be used rather than SIGINFO for stats 105 permit -n flag to affect print-ip for protocol numbers 106 ND_OPT_ADVINTERVAL is in milliseconds, not seconds 107 Teach PPPoE parser about RFC 4638 108 109 110Friday December 9, 2011. guy@alum.mit.edu. 111 Summary for 4.2.1 tcpdump release 112 Only build the Babel printer if IPv6 is enabled. 113 Support Babel on port 6696 as well as 6697. 114 Include ppi.h in release tarball. 115 Include all the test files in the release tarball, and don't 116 "include" test files that no longer exist. 117 Don't assume we have <rpc/rpc.h> - check for it. 118 Support "-T carp" as a way of dissecting IP protocol 112 as CARP 119 rather than VRRP. 120 Support Hilscher NetAnalyzer link-layer header format. 121 Constify some pointers and fix compiler warnings. 122 Get rid of never-true test. 123 Fix an unintended fall-through in a case statement in the ARP 124 printer. 125 Fix several cases where sizeof(sizeof(XXX)) was used when just 126 sizeof(XXX) was intended. 127 Make stricter sanity checks in the ES-IS printer. 128 Get rid of some GCCisms that caused builds to fai with compilers 129 that don't support them. 130 Fix typo in man page. 131 Added length checks to Babel printer. 132 133Sunday July 24, 2011. mcr@sandelman.ca. 134 Summary for 4.2.+ 135 merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov 136 at gmail dot com> 137 updates to forces for new port numbers 138 Use "-H", not "-h", for the 802.11s option. (-h always help) 139 Better ICMPv6 checksum handling. 140 add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12 141 get rid of uuencoded pcap test files, git can do binary. 142 sFlow changes for 64-bit counters. 143 fixes for PPI packet header handling and printing. 144 Add DCB Exchange protocol (DCBX) version 1.01. 145 Babel dissector, from Juliusz Chroboczek and Grégoire Henry. 146 improvements to radiotap for rate values > 127. 147 Many improvements to ForCES decode, including fix SCTP TML port 148 updated RPL type code to RPL-17 draft 149 Improve printout of DHCPv6 options. 150 added support and test case for QinQ (802.1q VLAN) packets 151 Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4. 152 Build fixes for Sparc and other machines with alignment restrictions. 153 Merged changes from Debian package. 154 PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options. 155 Build fixes for OSX (Snow Leopard and others) 156 Add support for IEEE 802.15.4 packets 157 158Tue. July 20, 2010. guy@alum.mit.edu. 159 Summary for 4.1.2 tcpdump release 160 If -U is specified, flush the file after creating it, so it's 161 not zero-length 162 Fix TCP flags output description, and some typoes, in the man 163 page 164 Add a -h flag, and only attempt to recognize 802.11s mesh 165 headers if it's set 166 When printing the link-layer type list, send *all* output to 167 stderr 168 Include the CFLAGS setting when configure was run in the 169 compiler flags 170 171Thu. April 1, 2010. guy@alum.mit.edu. 172 Summary for 4.1.1 tcpdump release 173 Fix build on systems with PF, such as FreeBSD and OpenBSD. 174 Don't blow up if a zero-length link-layer address is passed to 175 linkaddr_string(). 176 177Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu. 178 Summary for 4.1.0 tcpdump release 179 Fix printing of MAC addresses for VLAN frames with a length 180 field 181 Add some additional bounds checks and use the EXTRACT_ macros 182 more 183 Add a -b flag to print the AS number in BGP packets in ASDOT 184 notation rather than ASPLAIN notation 185 Add ICMPv6 RFC 5006 support 186 Decode the access flags in NFS access requests 187 Handle the new DLT_ for memory-mapped USB captures on Linux 188 Make the default snapshot (-s) the maximum 189 Print name of device (when -L is used) 190 Support for OpenSolaris (and SXCE build 125 and later) 191 Print new TCP flags 192 Add support for RPL DIO 193 Add support for TCP User Timeout (UTO) 194 Add support for non-standard Ethertypes used by 3com PPPoE gear 195 Add support for 802.11n and 802.11s 196 Add support for Transparent Ethernet Bridge ethertype in GRE 197 Add 4 byte AS support for BGP printer 198 Add support for the MDT SAFI 66 BG printer 199 Add basic IPv6 support to print-olsr 200 Add USB printer 201 Add printer for ForCES 202 Handle frames with an FCS 203 Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames 204 Fix TCP sequence number printing 205 Report 802.2 packets as 802.2 instead of 802.3 206 Don't include -L/usr/lib in LDFLAGS 207 On x86_64 Linux, look in lib64 directory too 208 Lots of code clean ups 209 Autoconf clean ups 210 Update testcases to make output changes 211 Fix compiling with/out smi (--with{,out}-smi) 212 Fix compiling without IPv6 support (--disable-ipv6) 213 214Mon. October 27, 2008. ken@netfunctional.ca. Summary for 4.0.0 tcpdump release 215 Add support for Bluetooth Sniffing 216 Add support for Realtek Remote Control Protocol (openrrcp.org.ru) 217 Add support for 802.11 AVS 218 Add support for SMB over TCP 219 Add support for 4 byte BGP AS printing 220 Add support for compiling on case-insensitive file systems 221 Add support for ikev2 printing 222 Update support for decoding AFS 223 Update DHCPv6 printer 224 Use newer libpcap API's (allows -B option on all platforms) 225 Add -I to turn on monitor mode 226 Bugfixes in lldp, lspping, dccp, ESP, NFS printers 227 Cleanup unused files and various cruft 228 229Mon. September 10, 2007. ken@xelerance.com. Summary for 3.9.8 tcpdump release 230 Rework ARP printer 231 Rework OSPFv3 printer 232 Add support for Frame-Relay ARP 233 Decode DHCP Option 121 (RFC 3442 Classless Static Route) 234 Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121 235 TLV: Add support for Juniper .pcap extensions 236 Print EGP header in new-world-order style 237 Converted print-isakmp.c to NETDISSECT 238 Moved AF specific stuff into af.h 239 Test subsystem now table driven, and saves outputs and diffs to one place 240 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 241 libpcap files on an OS other than where the file was generated 242 243 244Wed. July 23, 2007. mcr@xelerance.com. Summary for 3.9.7 libpcap release 245 246 NFS: Print unsigned values as such. 247 RX: parse safely. 248 BGP: fixes for IPv6-less builds. 249 801.1ag: use standard codepoint. 250 use /dev/bpf on systems with such a device. 251 802.11: print QoS data, avoid dissect of no-data frame, ignore padding. 252 smb: make sure that we haven't gone past the end of the captured data. 253 smb: squelch an uninitialized complaint from coverity. 254 NFS: from NetBSD; don't interpret the reply as a possible NFS reply 255 if it got MSG_DENIED. 256 BGP: don't print TLV values that didn't fit, from www.digit-labs.org. 257 revised INSTALL.txt about libpcap dependancy. 258 259Wed. April 25, 2007. ken@xelerance.com. Summary for 3.9.6 tcpdump release 260 Update man page to reflect changes to libpcap 261 Changes to both TCP and IP Printer Output 262 Fix a potential buffer overflow in the 802.11 printer 263 Print basic info about a few more Cisco LAN protocols. 264 mDNS cleanup 265 ICMP MPLS rework of the extension code 266 bugfix: use the correct codepoint for the OSPF simple text auth token 267 entry, and use safeputs to print the password. 268 Add support in pflog for additional values 269 Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects 270 Add support for the Message-id NACK c-type. 271 Add support for 802.3ah loopback ctrl msg 272 Add support for Multiple-STP as per 802.1s 273 Add support for rapid-SPT as per 802.1w 274 Add support for CFM Link-trace msg, Link-trace-Reply msg, 275 Sender-ID tlv, private tlv, port, interface status 276 Add support for unidirectional link detection as per 277 http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt 278 Add support for the olsr protocol as per RFC 3626 plus the LQ 279 extensions from olsr.org 280 Add support for variable-length checksum in DCCP, as per section 9 of 281 RFC 4340. 282 Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree 283 Add support for Multiple-STP as per 802.1s 284 Add support for the cisco propriatry 'dynamic trunking protocol' 285 Add support for the cisco proprietary VTP protocol 286 Update dhcp6 options table as per IETF standardization activities 287 288 289Tue. September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release 290 291 Fix compiling on AIX (, at end of ENUM) 292 Updated list of DNS RR typecodes 293 Use local Ethernet defs on WIN32 294 Add support for Frame-Relay ARP 295 Fixes for compiling under MSVC++ 296 Add support for parsing Juniper .pcap files 297 Add support for FRF.16 Multilink Frame-Relay (DLT_MFR) 298 Rework the OSPFv3 printer 299 Fix printing for 4.4BSD/NetBSD NFS Filehandles 300 Add support for Cisco style NLPID encapsulation 301 Add cisco prop. eigrp related, extended communities 302 Add support for BGP signaled VPLS 303 Cleanup the bootp printer 304 Add support for PPP over Frame-Relay 305 Add some bounds checking to the IP options code, and clean up 306 the options output a bit. 307 Add additional modp groups to ISAKMP printer 308 Add support for Address-Withdraw and Label-Withdraw Msgs 309 Add support for the BFD Discriminator TLV 310 Fixes for 64bit compiling 311 Add support for PIMv2 checksum verification 312 Add support for further dissection of the IPCP Compression Option 313 Add support for Cisco's proposed VQP protocol 314 Add basic support for keyed authentication TCP option 315 Lots of minor cosmetic changes to output printers 316 317 318Mon. September 19, 2005. ken@xelerance.com. Summary for 3.9.4 tcpdump release 319 Decoder support for more Juniper link-layer types 320 Fix a potential buffer overflow (although it can't occur in 321 practice). 322 Fix the handling of unknown management frame types in the 802.11 323 printer. 324 Add FRF.16 support, fix various Frame Relay bugs. 325 Add support for RSVP integrity objects, update fast-reroute 326 object printer to latest spec. 327 Clean up documentation of vlan filter expression, document mpls 328 filter expression. 329 Document new pppoed and pppoes filter expressions. 330 Update diffserver-TE codepoints as per RFC 4124. 331 Spelling fixes in ICMPv6. 332 Don't require any fields other than flags to be present in IS-IS 333 restart signaling TLVs, and only print the system ID in 334 those TLVs as system IDs, not as node IDs. 335 Support for DCCP. 336 337Tue. July 5, 2005. ken@xelerance.com. Summary for 3.9.3 tcpdump release 338 339 Option to chroot() when dropping privs 340 Fixes for compiling on nearly every platform, 341 including improved 64bit support 342 Many new testcases 343 Support for sending packets 344 Many compliation fixes on most platforms 345 Fixes for recent version of GCC to eliminate warnings 346 Improved Unicode support 347 348 Decoders & DLT Changes, Updates and New: 349 AES ESP support 350 Juniper ATM, FRF.15, FRF.16, PPPoE, 351 ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC 352 GGSN,ES,MONITOR,SERVICES 353 L2VPN 354 Axent Raptor/Symantec Firewall 355 TCP-MD5 (RFC 2385) 356 ESP-in-UDP (RFC 3948) 357 ATM OAM 358 LMP, LMP Service Discovery 359 IP over FC 360 IP over IEEE 1394 361 BACnet MS/TP 362 SS7 363 LDP over TCP 364 LACP, MARKER as per 802.3ad 365 PGM (RFC 3208) 366 LSP-PING 367 G.7041/Y.1303 Generic Framing Procedure 368 EIGRP-IP, EIGRP-IPX 369 ICMP6 370 Radio - via radiotap 371 DHCPv6 372 HDLC over PPP 373 374Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release 375 376 No changes from 3.8.2. Version bumped only to maintain consistency 377 with libpcap 0.8.3. 378 379Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release 380 381 Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184 382 http://www.rapid7.com/advisories/R7-0017.html 383 IP-over-IEEE1394 printing. 384 some MINGW32 changes. 385 updates for autoconf 2.5 386 fixes for print-aodv.c - check for too short packets 387 formatting changes to print-ascii for hex output. 388 check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c, 389 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c, 390 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c, 391 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c 392 print-ether.c - better handling of unknown types. 393 print-isoclns.c - additional decoding of types. 394 print-llc.c - strings for LLC names added. 395 print-pfloc.c - various enhancements 396 print-radius.c - better decoding to strings. 397 398Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release 399 400 changed syntax of -E argument so that multiple SAs can be decrypted 401 fixes for Digital Unix headers and Documentation 402 __attribute__ fixes 403 CDP changes from Terry Kennedy <terry@tmk.com>. 404 IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com> 405 Fixes for ASN.1 decoder for 2.100.3 forms. 406 Added a count of packets received and processed to clarify numbers. 407 Incorporated WinDUMP patches for Win32 builds. 408 PPPoE payload length headers. 409 Fixes for HP C compiler builds. 410 Use new pcap_breakloop() and pcap_findalldevs() if we can. 411 BGP output split into multiple lines. 412 Fixes to 802.11 decoding. 413 Fixes to PIM decoder. 414 SuperH is a CPU that can't handle unaligned access. Many fixes for 415 unaligned access work. 416 Fixes to Frame-Relay decoder for Q.933/922 frames. 417 Clarified when Solaris can do captures as non-root. 418 Added tests/ subdir for examples/regression tests. 419 New -U flag. -flush stdout after every packet 420 New -A flag -print ascii only 421 support for decoding IS-IS inside Cisco HDLC Frames 422 more verbosity for tftp decoder 423 mDNS decoder 424 new BFD decoder 425 cross compilation patches 426 RFC 3561 AODV support. 427 UDP/TCP pseudo-checksum properly for source-route options. 428 sanitized all files to modified BSD license 429 Add support for RFC 2625 IP-over-Fibre Channel. 430 fixes for DECnet support. 431 Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI. 432 RFC 2684 encapsulation of BPDUs. 433 434Tuesday, February 25, 2003. fenner@research.att.com. 3.7.2 release 435 436 Fixed infinite loop when parsing malformed isakmp packets. 437 (reported by iDefense; already fixed in CVS) 438 Fixed infinite loop when parsing malformed BGP packets. 439 Fixed buffer overflow with certain malformed NFS packets. 440 Pretty-print unprintable network names in 802.11 printer. 441 Handle truncated nbp (appletalk) packets. 442 Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt 443 Print IP protocol name even if we don't have a printer for it. 444 Print IP protocol name or number for fragments. 445 Print the whole MPLS label stack, not just the top label. 446 Print request header and file handle for NFS v3 FSINFO and PATHCONF 447 requests. 448 Fix NFS packet truncation checks. 449 Handle "old" DR-Priority and Bidir-Capable PIM HELLO options. 450 Handle unknown RADIUS attributes properly. 451 Fix an ASN.1 parsing error that would cause e.g. the OID 452 2.100.3 to be misrepresented as 4.20.3 . 453 454Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release 455see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log. 456 keyword "ipx" added. 457 Better OSI/802.2 support on Linux. 458 IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net. 459 LLC SAP support for FDDI/token ring/RFC-1483 style ATM 460 BXXP protocol was replaced by the BEEP protocol; 461 improvements to SNAP demux. 462 Changes to "any" interface documentation. 463 Documentation on pcap_stats() counters. 464 Fix a memory leak found by Miklos Szeredi - pcap_ether_aton(). 465 Added MPLS encapsulation decoding per RFC3032. 466 DNS dissector handles TKEY, TSIG and IXFR. 467 adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org> 468 SMB printing has much improved bounds checks 469 OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging 470 Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>. 471 Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net> 472 IPX socket 0x85be is for Cisco EIGRP over IPX. 473 Improvements to fragmented ESP handling. 474 SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu> 475 Linux ARPHDR_ATM support fixed. 476 Added a "netbeui" keyword, which selects NetBEUI packets. 477 IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option. 478 Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>. 479 Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm" 480 Better Linux libc5 compat. 481 BIND9 lwres dissector added. 482 MIPS and SPARC get strict alignment macros (affects print-bgp.c) 483 Apple LocalTalk LINKTYPE_ reserved. 484 New time stamp formats documented. 485 DHCP6 updated to draft-22.txt spec. 486 ICMP types/codes now accept symbolic names. 487 Add SIGINFO handler from LBL 488 encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>. 489 now we are -Wstrict-prototype clean. 490 NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>. 491 PPPoE dissector cleaned up. 492 Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>. 493 In dissector, now the caller prints the IP addresses rather than proto. 494 cjclark@alum.mit.edu: print the IP proto for non-initial fragments. 495 LLC frames with a DSAP and LSAP of 0xe0 are IPX frames. 496 Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX. 497 captures on the "any" device won't be done in promiscuous mode 498 Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl> 499 ARCNet support, from NetBSD. 500 HSRP dissector, from Julian Cowley <julian@lava.net>. 501 Handle (GRE-encapsulated) PPTP 502 added -C option to rotate save file every optarg * 1,000,000 bytes. 503 support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>. 504 PPTP support, from Motonori Shindo <mshindo@mshindo.net>. 505 IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>. 506 CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>. 507 ESP printing updated to RFC2406. 508 HP-UX can now handle large number of PPAs. 509 MSDP printer added. 510 L2TP dissector improvements from Motonori Shindo. 511 512Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release 513 Cleaned up documentation. 514 Promisc mode fixes for Linux 515 IPsec changes/cleanups. 516 Alignment fixes for picky architectures 517 518 Removed dependency on native headers for packet dissectors. 519 Removed Linux specific headers that were shipped 520 521 libpcap changes provide for exchanging capture files between 522 systems. Save files now have well known PACKET_ values instead of 523 depending upon system dependant mappings of DLT_* types. 524 525 Support for computing/checking IP and UDP/TCP checksums. 526 527 Updated autoconf stock files. 528 529 IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6, 530 531 Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp, 532 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk 533 534 Added filtering support for: VLANs, ESIS, ISIS 535 536 Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP, 537 L2TP, PPPoE 538 539 HP-UX 11.0 -- find the right dlpi device. 540 Solaris 8 - IPv6 works 541 Linux - Added support for an "any" device to capture on all interfaces 542 543 Security fixes: buffer overrun audit done. Strcpy replaced with 544 strlcpy, sprintf replaced with snprintf. 545 Look for lex problems, and warn about them. 546 547 548v3.5 Fri Jan 28 18:00:00 PST 2000 549 550Bill Fenner <fenner@research.att.com> 551- switch to config.h for autoconf 552- unify RCSID strings 553- Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser 554- Really fix the RIP printer 555- Fix MAC address -> name translation. 556- some -Wall -Wformat fixes 557- update makemib to parse much of SMIv2 558- Print TCP sequence # with -vv even if you normally wouldn't 559- Print as much of IP/TCP/UDP headers as possible even if truncated. 560 561itojun@iijlab.net 562- -X will make a ascii dump. from netbsd. 563- telnet command sequence decoder (ff xx xx). from netbsd. 564- print-bgp.c: improve options printing. ugly code exists for 565 unaligned option parsing (need some fix). 566- const poisoning in SMB decoder. 567- -Wall -Werror clean checks. 568- bring in KAME IPv6/IPsec decoding code. 569 570Assar Westerlund <assar@sics.se> 571- SNMPv2 and SNMPv3 printer 572- If compiled with libsmi, tcpdump can load MIBs on the fly to decode 573 SNMP packets. 574- Incorporate NFS parsing code from NetBSD. Adds support for nfsv3. 575- portability fixes 576- permit building in different directories. 577 578Ken Hornstein <kenh@cmf.nrl.navy.mil> 579- bring in code at 580 /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing 581 AFS3 packets 582 583Andrew Tridgell <tridge@linuxcare.com> 584- SMB printing code 585 586Love <lha@stacken.kth.se> 587- print-rx.c: add code for printing MakeDir and StoreStatus. Also 588 change date format to the right one. 589 590Michael C. Richardson <mcr@sandelman.ottawa.on.ca> 591- Created tcpdump.org repository 592 593v3.4 Sat Jul 25 12:40:55 PDT 1998 594 595- Hardwire Linux slip support since it's too hard to detect. 596 597- Redo configuration of "network" libraries (-lsocket and -lnsl) to 598 deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu) 599 600- Added -a which tries to translate network and broadcast addresses to 601 names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl) 602 603- Added a configure option to disable gcc. 604 605- Added a "raw" packet printer. 606 607- Not having an interface address is no longer fatal. Requested by John 608 Hawkinson. 609 610- Rework signal setup to accommodate Linux. 611 612- OSPF truncation check fix. Also display the type of OSPF packets 613 using MD5 authentication. Thanks to Brian Wellington 614 (bwelling@tis.com) 615 616- Fix truncation check bugs in the Kerberos printer. Reported by Ezra 617 Peisach (epeisach@mit.edu) 618 619- Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka 620 (plonka@mfa.com) 621 622- Specify full install target as a way of detecting if install 623 directory does not exist. Thanks to Dave Plonka. 624 625- Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie 626 (paul@vix.com) 627 628- Fix off-by-one bug when testing size of ethernet packets. Thanks to 629 Marty Leisner (leisner@sdsp.mc.xerox.com) 630 631- Add a local autoconf macro to check for routines in libraries; the 632 autoconf version is broken (it only puts the library name in the 633 cache variable name). Thanks to John Hawkinson. 634 635- Add a local autoconf macro to check for types; the autoconf version 636 is broken (it uses grep instead of actually compiling a code fragment). 637 638- Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 639 formats. 640 641- Extend OSF ip header workaround to versions 1 and 2. 642 643- Fix some signed problems in the nfs printer. As reported by David 644 Sacerdote (davids@silence.secnet.com) 645 646- Detect group wheel and use it as the default since BSD/OS' install 647 can't hack numeric groups. Reported by David Sacerdote. 648 649- AIX needs special loader options. Thanks to Jonathan I. Kamens 650 (jik@cam.ov.com) 651 652- Fixed the nfs printer to print port numbers in decimal. Thanks to 653 Kent Vander Velden (graphix@iastate.edu) 654 655- Find installed libpcap in /usr/local/lib when not using gcc. 656 657- Disallow network masks with non-network bits set. 658 659- Attempt to detect "egcs" versions of gcc. 660 661- Add missing closing double quotes when displaying bootp strings. 662 Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca) 663 664v3.3 Sat Nov 30 20:56:27 PST 1996 665 666- Added Linux support. 667 668- GRE encapsulated packet printer thanks to John Hawkinson 669 (jhawk@mit.edu) 670 671- Rewrite gmt2local() to avoid problematic os dependencies. 672 673- Suppress nfs truncation message on errors. 674 675- Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro. 676 Reported by Joachim Ott (ott@ardala.han.de) 677 678- Enable "ip_hl vs. ip_vhl" workaround for OSF4 too. 679 680- Print arp hardware type in host order. Thanks to Onno van der Linden 681 (onno@simplex.nl) 682 683- Avoid solaris compiler warnings. Thanks to Bruce Barnett 684 (barnett@grymoire.crd.ge.com) 685 686- Fix rip printer to not print one more route than is actually in the 687 packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and 688 Bill Fenner (fenner@parc.xerox.com) 689 690- Use autoconf endian detection since BYTE_ORDER isn't defined on all systems. 691 692- Fix dvmrp printer truncation checks and add a dvmrp probe printer. 693 Thanks to Danny J. Mitzel (mitzel@ipsilon.com) 694 695- Rewrite ospf printer to improve truncation checks. 696 697- Don't parse tcp options past the EOL. As noted by David Sacerdote 698 (davids@secnet.com). Also, check tcp options to make sure they ar 699 actually in the tcp header (in addition to the normal truncation 700 checks). Fix the SACK code to print the N blocks (instead of the 701 first block N times). 702 703- Don't say really small UDP packets are truncated just because they 704 aren't big enough to be a RPC. As noted by David Sacerdote. 705 706v3.2.1 Sun Jul 14 03:02:26 PDT 1996 707 708- Added rfc1716 icmp codes as suggested by Martin Fredriksson 709 (martin@msp.se) 710 711- Print mtu for icmp unreach need frag packets. Thanks to John 712 Hawkinson (jhawk@mit.edu) 713 714- Decode icmp router discovery messages. Thanks to Jeffrey Honig 715 (jch@bsdi.com) 716 717- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida 718 (kushida@trl.ibm.co.jp) 719 720- Check igmp checksum if possible. Thanks to John Hawkinson. 721 722- Made changes for SINIX. Thanks to Andrej Borsenkow 723 (borsenkow.msk@sni.de) 724 725- Use autoconf's idea of the top level directory in install targets. 726 Thanks to John Hawkinson. 727 728- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey 729 Mogul (mogul@pa.dec.com) 730 731- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop. 732 Thanks to John Hawkinson. 733 734- Added some more packet truncation checks. 735 736- On systems that have it, use sigset() instead of signal() since 737 signal() has different semantics on these systems. 738 739- Fixed some more alignment problems on the alpha. 740 741- Add code to massage unprintable characters in the domain and ipx 742 printers. Thanks to John Hawkinson. 743 744- Added explicit netmask support. Thanks to Steve Nuchia 745 (steve@research.oknet.com) 746 747- Add "sca" keyword (for DEC cluster services) as suggested by Terry 748 Kennedy (terry@spcvxa.spc.edu) 749 750- Add "atalk" keyword as suggested by John Hawkinson. 751 752- Added an igrp printer. Thanks to Francis Dupont 753 (francis.dupont@inria.fr) 754 755- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry 756 Kennedy (terry@spcvxa.spc.edu) 757 758- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin 759 (pascal.hennequin@hugo.int-evry.fr) 760 761- Added some ETHERTYPEs missing on some systems. 762 763- Added truncated packet macros and various checks. 764 765- Fixed endian problems with the DECnet printer. 766 767- Use $CC when checking gcc version. Thanks to Carl Lindberg 768 (carl_lindberg@blacksmith.com) 769 770- Fixes for AIX (although this system is not yet supported). Thanks to 771 John Hawkinson. 772 773- Fix bugs in the autoconf misaligned accesses code fragment. 774 775- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to 776 Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp) 777 778v3.2 Sun Jun 23 02:28:10 PDT 1996 779 780- Print new icmp unreachable codes as suggested by Martin Fredriksson 781 (martin@msp.se). Also print code value when unknown for icmp redirect 782 and time exceeded. 783 784- Fix an alignment endian bug in getname(). Thanks to John Hawkinson. 785 786- Define "new" domain record types if not found in arpa/nameserv.h. 787 Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also 788 fixed an endian bug when printing mx record and added some new record 789 types. 790 791- Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com) 792 793- Added T/TCP options printing. As suggested by Richard Stevens 794 (rstevens@noao.edu) 795 796- Use autoconf to detect architectures that can't handle misaligned 797 accesses. 798 799v3.1 Thu Jun 13 20:59:32 PDT 1996 800 801- Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd 802 and bind (as suggested by Charles Hannum). 803 804- Port to GNU autoconf. 805 806- Add support for printing DVMRP and PIM traffic thanks to 807 Havard Eidnes (Havard.Eidnes@runit.sintef.no). 808 809- Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian 810 define being referenced. Reported by Terry Kennedy. 811 812- Minor fixes to the man page thanks to Mark Andrews. 813 814- Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah 815 (bmah@cs.berkeley.edu). 816 817- Added support for new dns types, thanks to Rainer Orth. 818 819- Fixed tftp_print() to print the block number for ACKs. 820 821- Document -dd and -ddd. Resulted from a bug report from Charlie Slater 822 (cslater@imatek.com). 823 824- Check return status from malloc/calloc/etc. 825 826- Check return status from pcap_loop() so we can print an error and 827 exit with a bad status if there were problems. 828 829- Bail if ip option length is <= 0. Resulted from a bug report from 830 Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au). 831 832- Print out a little more information for sun rpc packets. 833 834- Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu). 835 836- Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were 837 wrong on little endian machines). 838 839- Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford 840 (crawdad@fnal.gov). 841 842- Fix ntp_print() to not print garbage when the stratum is 843 "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com). 844 845- Rewrote tcp options printer code to check for truncation. Added 846 selective acknowledgment case. 847 848- Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig 849 (jch@bsdi.com) 850 851- Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one 852 octet for the sa_family member. Thanks to Yoshitaka Tokugawa 853 (toku@dit.co.jp) 854 855- Don't checksum ip header if we don't have all of it. Thanks to John 856 Hawkinson (jhawk@mit.edu). 857 858- Print out hostnames if possible in egp printer. Thanks to Jeffrey 859 Honig (jhc@bsdi.com) 860 861 862v3.1a1 Wed May 3 19:21:11 PDT 1995 863 864- Include time.h when SVR4 is defined to avoid problems under Solaris 865 2.3. 866 867- Fix etheraddr_string() in the ETHER_SERVICE to return the saved 868 strings, not the local buffer. Thanks to Stefan Petri 869 (petri@ibr.cs.tu-bs.de). 870 871- Detect when pcap raises the snaplen (e.g. with snit). Print a warning 872 that the selected value was not used. Thanks to Pascal Hennequin 873 (Pascal.Hennequin@hugo.int-evry.fr). 874 875- Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin. 876 877- BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu). 878 879v3.0.3 Sun Oct 1 18:35:00 GMT 1995 880 881- Although there never was a 3.0.3 release, the linux boys cleverly 882 "released" one in late 1995. 883 884v3.0.2 Thu Apr 20 21:28:16 PDT 1995 885 886- Change configuration to not use gcc v2 flags with gcc v1. 887 888- Redo gmt2local() so that it works under BSDI (which seems to return 889 an empty timezone struct from gettimeofday()). Based on report from 890 Terry Kennedy (terry@spcvxa.spc.edu). 891 892- Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based 893 on report from Mark Andrews (mandrews@alias.com). 894 895- Don't pass cc flags to gcc. Resulted from a bug report from Rainer 896 Orth (ro@techfak.uni-bielefeld.de). 897 898- Fixed printout of connection id for uncompressed tcp slip packets. 899 Resulted from a bug report from Richard Stevens (rstevens@noao.edu). 900 901- Hack around deficiency in Ultrix's make. 902 903- Add ETHERTYPE_TRAIL define which is missing from irix5. 904 905v3.0.1 Wed Aug 31 22:42:26 PDT 1994 906 907- Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4. 908 909v3.0 Mon Jun 20 19:23:27 PDT 1994 910 911- Added support for printing tcp option timestamps thanks to 912 Mark Andrews (mandrews@alias.com). 913 914- Reorganize protocol dumpers to take const pointers to packets so they 915 never change the contents (i.e., they used to do endian conversions 916 in place). Previously, whenever more than one pass was taken over 917 the packet, the packet contents would be dumped incorrectly (i.e., 918 the output form -x would be wrong on little endian machines because 919 the protocol dumpers would modify the data). Thanks to Charles Hannum 920 (mycroft@gnu.ai.mit.edu) for reporting this problem. 921 922- Added support for decnet protocol dumping thanks to Jeff Mogul 923 (mogul@pa.dec.com). 924 925- Fix bug that caused length of packet to be incorrectly printed 926 (off by ether header size) for unknown ethernet types thanks 927 to Greg Miller (gmiller@kayak.mitre.org). 928 929- Added support for IPX protocol dumping thanks to Brad Parker 930 (brad@fcr.com). 931 932- Added check to verify IP header checksum under -v thanks to 933 Brad Parker (brad@fcr.com). 934 935- Move packet capture code to new libpcap library (which is 936 packaged separately). 937 938- Prototype everything and assume an ansi compiler. 939 940- print-arp.c: Print hardware ethernet addresses if they're not 941 what we expect. 942 943- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags. 944 Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com). 945 946- print-fddi.c: Improvements. Thanks to Jeffrey Mogul 947 (mogul@pa.dec.com). 948 949- print-icmp.c: Byte swap netmask before printing. Thanks to 950 Richard Stevens (rstevens@noao.edu). Print icmp type when unknown. 951 952- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets. 953 By default, only the inner packet is dumped, appended with the token 954 "(encap)". Under -v, both the inner and output packets are dumped 955 (on the same line). Note that the filter applies to the original packet, 956 not the encapsulated packet. So if you run tcpdump on a net with an 957 IP Multicast tunnel, you cannot filter out the datagrams using the 958 conventional syntax. (You can filter away all the ip-in-ip traffic 959 with "not ip proto 4".) 960 961- print-nfs.c: Keep pending rpc's in circular table. Add generic 962 nfs header and remove os dependences. Thanks to Jeffrey Mogul. 963 964- print-ospf.c: Improvements. Thanks to Jeffrey Mogul. 965 966- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc" 967 (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords 968 Add && and || operators 969 970v2.2.1 Tue Jun 6 17:57:22 PDT 1992 971 972- Fix bug with -c flag. 973 974v2.2 Fri May 22 17:19:41 PDT 1992 975 976- savefile.c: Remove hack that shouldn't have been exported. Add 977 truncate checks. 978 979- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0' 980 matches non-echo/reply ICMP packets. 981 982- Many improvements to filter code optimizer. 983 984- Added 'multicast' keyword and extended the 'broadcast' keyword can now be 985 so that protocol qualifications are allowed. For example, "ip broadcast" 986 and "ether multicast" are valid filters. 987 988- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo'). 989 Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel 990 patches to netinet/if_loop.c. 991 992- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS. 993 Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs. 994 995- Added EGP and OSPF printers, thanks to Jeffrey Honig. 996 997v2.1 Tue Jan 28 11:00:14 PST 1992 998 999- Internal release (never publically exported). 1000 1001v2.0.1 Sun Jan 26 21:10:10 PDT 1002 1003- Various byte ordering fixes. 1004 1005- Add truncation checks. 1006 1007- inet.c: Support BSD style SIOCGIFCONF. 1008 1009- nametoaddr.c: Handle multi addresses for single host. 1010 1011- optimize.c: Rewritten. 1012 1013- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous 1014 for broadcast nets. 1015 1016- print-atal.c: Fix an alignment bug (thanks to 1017 stanonik@nprdc.navy.mil) Add missing printf() argument. 1018 1019- print-bootp.c: First attempt at decoding the vendor buffer. 1020 1021- print-domain.c: Fix truncation checks. 1022 1023- print-icmp.c: Calculate length of packets from the ip header. 1024 1025- print-ip.c: Print frag id in decimal (so it's easier to match up 1026 with non-frags). Add support for ospf, egp and igmp. 1027 1028- print-nfs.c: Lots of changes. 1029 1030- print-ntp.c: Make some verbose output depend on -v. 1031 1032- print-snmp.c: New version from John LoVerso. 1033 1034- print-tcp.c: Print rfc1072 tcp options. 1035 1036- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits 1037 (microseconds) worth of precision. Fix uid bugs. 1038 1039- A packet dumper has been added (thanks to Jeff Mogul of DECWRL). 1040 With this option, you can create an architecture independent binary 1041 trace file in real time, without the overhead of the packet printer. 1042 At a later time, the packets can be filtered (again) and printed. 1043 1044- BSD is supported. You must have BPF in your kernel. 1045 Since the filtering is now done in the kernel, fewer packets are 1046 dropped. In fact, with BPF and the packet dumper option, a measly 1047 Sun 3/50 can keep up with a busy network. 1048 1049- Compressed SLIP packets can now be dumped, provided you use our 1050 SLIP software and BPF. These packets are dumped as any other IP 1051 packet; the compressed headers are dumped with the '-e' option. 1052 1053- Machines with little-endian byte ordering are supported (thanks to 1054 Jeff Mogul). 1055 1056- Ultrix 4.0 is supported (also thanks to Jeff Mogul). 1057 1058- IBM RT and Stanford Enetfilter support has been added by 1059 Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under 1060 both the vanilla Enetfilter interface, and the extended interface 1061 (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter. 1062 1063- TFTP packets are now printed (requests only). 1064 1065- BOOTP packets are now printed. 1066 1067- SNMP packets are now printed. (thanks to John LoVerso of Xylogics). 1068 1069- Sparc architectures, including the Sparcstation-1, are now 1070 supported thanks to Steve McCanne and Craig Leres. 1071 1072- SunOS 4 is now supported thanks to Micky Liu of Columbia 1073 University (micky@cunixc.cc.columbia.edu). 1074 1075- IP options are now printed. 1076 1077- RIP packets are now printed. 1078 1079- There's a -v flag that prints out more information than the 1080 default (e.g., it will enable printing of IP ttl, tos and id) 1081 and -q flag that prints out less (e.g., it will disable 1082 interpretation of AppleTalk-in-UDP). 1083 1084- The grammar has undergone substantial changes (if you have an 1085 earlier version of tcpdump, you should re-read the manual 1086 entry). 1087 1088 The most useful change is the addition of an expression 1089 syntax that lets you filter on arbitrary fields or values in the 1090 packet. E.g., "ip[0] > 0x45" would print only packets with IP 1091 options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN 1092 packets. 1093 1094 The most painful change is that concatenation no longer means 1095 "and" -- e.g., you have to say "host foo and port bar" instead 1096 of "host foo port bar". The up side to this down is that 1097 repeated qualifiers can be omitted, making most filter 1098 expressions shorter. E.g., you can now say "ip host foo and 1099 (bar or baz)" to look at ip traffic between hosts foo and bar or 1100 between hosts foo and baz. [The old way of saying this was "ip 1101 host foo and (ip host bar or ip host baz)".] 1102 1103v2.0 Sun Jan 13 12:20:40 PST 1991 1104 1105- Initial public release. 1106