1Thursday, January 12, 2023 / The Tcpdump Group 2 Summary for 1.10.3 libpcap release 3 Source code: 4 Sort the PUBHDR variable in Makefile.in in "ls" order. 5 Fix typo in comment in pflog.h. 6 Remove two no-longer-present files from .gitignore. 7 Update code and comments for handling failure to set promiscuous 8 mode based on new information. 9 Building and testing: 10 install: Fixed not to install the non-public pcap-util.h header. 11 pcap-config: add a --version flag. 12 Makefile.in: Add some missing files in the distclean target. 13 14Saturday, December 31, 2022 / The Tcpdump Group 15 Summary for 1.10.2 libpcap release 16 Source code: 17 Use __builtin_unreachable() in PCAP_UNREACHABLE. 18 Use AS_HELP_STRING macro instead of AC_HELP_STRING in the 19 configure scripts, to avoid deprecation warnings. 20 Change availability tags in pcap.h to make it easier to 21 arrange for it to be used in Darwin releases. 22 Use AS_HELP_STRING for --enable-remote. 23 Fix some formatting string issues found by cppcheck. 24 Various small code and comment cleanups. 25 Use PCAP_ERROR (defined as -1) rather than explicit -1 for 26 functions the documentation says return PCAP_ERROR. 27 Remove unused code from the filter compiler. 28 Use _declspec(deprecated(msg)) rather than __pragma(deprecated) 29 for Windows deprecation warnings, so the message that was 30 specified shows up. 31 diag-control.h: define PCAP_DO_PRAGMA() iff we're going to use it. 32 Use "%d" to print some signed ints. 33 Use the Wayback Machine for a removed document in a comment. 34 Add some const qualifiers. 35 RDMA: Use PRIu64 to print a uint64_t. 36 "Dead" pcap_ts from pcap_open_dead() and ..._with_tstamp_precision(): 37 Don't crash if pcap_breakloop() is called. 38 Savefiles: 39 Fix pcap_dispatch() to return number of packets processed, rather 40 than 0, even at EOF. 41 If we get an error writing the packet header, don't write the 42 packet data. 43 Put PFLOG UID and PID values in the header into host byte order 44 when reading a LINKTYPE_PFLOG file. 45 Put CAN ID field in CAN pseudo-headers for LINUX_SLL2, as we do 46 for LINUX_SLL. 47 Fix inorrectly-computed "real" length for isochronous USB 48 transfers when reading savefiles. 49 Don't crash if pcap_can_set_rfmon() is called. 50 Fix pcap_offline_read() loop. 51 Capture: 52 Never process more than INT_MAX packets in a pcap_dispatch() call, 53 to avoid integer overflow (issue #1087). 54 Improve error messages for "no such device" and "permission 55 denied" errors. 56 SITA: Fix a typo in a variable name. 57 Packet filtering: 58 Get PFLOG header length from the length value in the header. 59 Support all the direction, reason, and action types supported by 60 all systems that support PFLOG. 61 Don't require PFLOG support on the target machine in order to 62 support PFLOG filtering (also fixes issue #1076). 63 Expand abbreviations into "proto X" properly. 64 gencode.c: Update a comment about the VLAN TPID test. 65 Add the minimum and maximum matching DLTs to an error message. 66 Linux: 67 Fix memory leak in capture device open (pull request #1038). 68 Fix detection of CAN/CAN FD packets in direction check (issue 69 #1051). 70 Fix double-free crashes on errors such as running on a kernel with 71 CONFIG_PACKET_MMAP not configured (issue #1054). 72 Use DLT_CAN_SOCKETCAN for CANbus interfaces (issue #1052; includes 73 changes from pull request #1035). 74 Make sure the CANFD_FDF can be relied on to indicate whether a 75 CANbus packet is a CAN frame or a CAN FD frame 76 Improve error message for "out of memory" errors for kernel 77 filters (see issue #1089). 78 Fix pcap_findalldevs() to find usbmon devices. 79 Fix handling of VLAN tagged packets if the link-layer type is 80 changed from DLT_LINUX_SLL to DLT_LINUX_SLL2 (see issue #1105). 81 Always turn on PACKET_AUXDATA (see issue #1105). 82 We require 2.6.27 or later, so PACKET_RESERVE is available. 83 Make sure there's reserved space for a DLT_LINUX_SLL2 header 84 when capturing. 85 Correctly compute the "real" length for isochronous USB transfers. 86 Don't have an eventfd descriptor open in non-blocking mode, so as 87 not to waste descriptors. 88 netfilter: Squelch a narrowing warning (To be look at before 2038). 89 BPF capture (*BSD, macOS, AIX, Solaris 11): 90 Fix case where a device open might fail, rather than falling back 91 to a smaller buffer size, when the initial buffer size is too 92 big. 93 Use an unsigned device number to iterate over BPF devices, to 94 squelch a compiler warning. 95 NetBSD: 96 Fix handling of LINKTYPE_HDLC/DLT_HDLC. 97 rpcap: 98 Fix unaligned accesses in rpcapd (pull request #1037). 99 Fix code to process port number. 100 Clean up findalldevs code in rpcapd. 101 Clean up bufferizing code. 102 Fix a file descriptor/handle leak in pcap_findalldevs_ex() 103 (Coverity CID 1507240). 104 Improve error messages for host and port resolution errors. 105 Fix connect code not to fail if both IPv4 and IPv6 addresses are 106 tried. 107 Improve connect failure error message. 108 Provide an error message for a bad authentication reply size. 109 For link-layer types with host-endian fields in the header, fix 110 those fields if capturing from a server with a different byte 111 order. 112 Suppress temporarily the warnings with "enable remote packet capture". 113 Windows: 114 Add support for NdisMediumIP (pull request #1027). 115 Don't require applications using pcap to be built with VS 2015 or 116 later. 117 Use the correct string for the DLL VersionInfo. 118 Remove unnecessary DllMain() function. 119 Correctly handle ERROR_INVALID_FUNCTION from 120 PacketGetTimestampModes() (indicate that WinPcap or an older 121 version of Npcap is probably installed). 122 Fix use-after-free in some cases when a pcap_t is closed. 123 Make sure an error is returned by pcap_create_interface() if 124 PacketOpenAdapter() fails. 125 Return an error if the driver reports 0 timestamp modes supported. 126 Close the ADAPTER handle for some errors in 127 pcap_create_interface(). 128 Get rid of old umaintained VS project files. 129 Fix deprecation warning for pcap_handle(). 130 Npcap is now at npcap.com, not npcap.org. 131 Make sure "no such device" and "no permission to open device" 132 errors show up in pcap_activate(), not pcap_create() (fixes, 133 among other things, tcpdump -i <interface-number>). 134 npcap: squelch deprecation warnings for kernel dump mode. 135 Haiku: 136 Implement pcap_lib_version(), as now required. 137 Handle negative or too-large snaplen values. 138 Fix various build issues and warnings. 139 Building and testing: 140 Update configure-time universal build checks for macOS. 141 Update config.guess and config.sub. 142 If we look for an SSL library with pkg-config in configure script, 143 try pkg-config first. 144 If we have pkg-config and Homebrew, try to set pkg-config up to 145 find Homebrew packages. 146 Handle some Autoconf/make errors better. 147 Use "git archive" for the "make releasetar" process. 148 Remove the release candidate rcX targets. 149 Fix compiling on Solaris 9/SPARC and 11/AMD64. 150 Address assorted compiler warnings. 151 Fix cross-building on Linux for Windows with mingw32 for Win64 152 (pull request #1031). 153 Properly set installation directory on Windows when not compiling 154 with MSVC. 155 Fix configure script checks for compiler flags. 156 Give more details if check for usable (F)Lex fails. 157 Fix compiling with GCC 4.6.4. 158 Don't use add_compile_options() with CMake, as we currently don't 159 require 2.8.12, where it first appeared. 160 Don't provide -L/usr/lib for pkg-config --libs in pkg-config. 161 Fix error message for inadequate Bison/Berkeley YACC. 162 configure: correctly do some DPDK checks. 163 Only use pkg-config when checking for DPDK. 164 Allow the path in which DPDK is installed to be specified. 165 Use pkg-config first when checking for libibverbs. 166 CMake: fix check for libibverbs with Sun's C compiler. 167 Have CMake warn if no capture mechanism can be found. 168 Don't do stuff requiring 3.19 or later on earlier CMakes. 169 Squelch some CMake warnings. 170 Fix diag-control.h to handle compiling with clang-cl (issues 171 #1101 and #1115). 172 Cleanup various leftover cruft in the configure script. 173 Fix building without protochain support. (GH #852) 174 Check for a usable YACC (or Bison) and {F}lex in CMake, as we do 175 in autotools. 176 Only check for a C++ compiler on Haiku, as that's the only 177 platform with C++ code, and make sure they generate code for 178 the same instruction set bit-width (both 32-bit or both 64-bit) 179 (issue #1112). 180 On Solaris, check the target bit-width and set PKG_CONFIG_PATH 181 appropriately, to handle the mess that is the D-Bus library 182 package (issue #1112). 183 Fix generation of pcap-config and libpcap.pc files (issue #1062). 184 pcap-config: don't assume the system library directory is /usr/lib. 185 pcap-config: add a --static-pcap-only flag. 186 Cirrus CI: Use the same configuration as for the main branch. 187 Add four libpcap test files. 188 Update Npcap SDK to 1.13. 189 Makefile.in: Use TEST_DIST, like for tcpdump. 190 Remove awk code from mkdep. 191 Cirrus CI: Add the libssl-dev package in the Linux task. 192 Cirrus CI: Add the openssl@3 brew package in the macOS task. 193 Get "make shellcheck" to pass again. 194 CMake: Build valgrindtest only if Autoconf would. 195 CMake: use ${CMAKE_INSTALL_SBINDIR} rather than just sbin. 196 CMake: use NUL: as the null device on Windows. 197 autoconf: fix typo in test of macOS version. 198 Makefile.in: Add two missing files in EXTRA_DIST. 199 autotools, cmake: provide an rpath option if necessary. 200 configure: get rid of the attempt to auto-run PKG_PROG_PKG_CONFIG. 201 configure: use PKG_CHECK_MODULES to run pkg-config. 202 Documentation: 203 Add README.solaris.md. 204 Add SCTP to pcap-filter(7). 205 Note that = and == are the same operator in filters (issue #1044). 206 Update INSTALL.md, README.md, and README.solaris.md. 207 Update and clean up CONTRIBUTING.md. 208 Trim documentation of support for now-dead UN*Xe and older 209 versions of other UN*Xes. 210 Move the "how to allocate a LINKTYPE_/DLT_ value" documentation to 211 the web site. 212 Clean up man pages. 213 Move README.capture-module to the web site. 214 Improve some protocol details in pcap-filter(7). 215 Refine "relop" notes in pcap-filter(7). 216 In pcap-filter(7) "domain" is an id. 217 Discuss backward compatibility in pcap-filter(7). 218 Other improvements to pcap-filter(7). 219 Document pcap_breakloop(3PCAP) interaction with threads better. 220 Document PCAP_ERROR_NOT_ACTIVATED for more routines. 221 222Wednesday, June 9, 2021: 223 Summary for 1.10.1 libpcap release: 224 Packet filtering: 225 Fix "type XXX subtype YYY" giving a parse error 226 Source code: 227 Add PCAP_AVAILABLE_1_11. 228 Building and testing: 229 Rename struct bpf_aux_data to avoid NetBSD compile errors 230 Squelch some compiler warnings 231 Squelch some Bison warnings 232 Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR 233 Fix Bison detection for minor version 0. 234 Fix parallel build with FreeBSD make. 235 Get DLT_MATCHING_MAX right in gencode.c on NetBSD. 236 Define timeradd() and timersub() if necessary. 237 Fix Cygwin/MSYS target directories. 238 Fix symlinking with DESTDIR. 239 Fix generation of libpcap.pc with CMake when not building a shared 240 library. 241 Check for Arm64 as well as x86-64 when looking for packet.lib on 242 Windows. 243 Documentation: 244 Refine Markdown in README.md. 245 Improve the description of portrange in filters. 246 README.linux.md isn't Markdown, rename it just README.linux. 247 pcapng: 248 Support reading version 1.2, which some writers produce, and which 249 is the same as 1.0 (some new block types were added, but 250 that's not sufficient reason to bump the minor version number, 251 as code that understands those new block types can handle them 252 in a 1.0 file) 253 Linux: 254 Drop support for text-mode USB captures, as we require a 2.6.27 255 or later kernel (credit to Chaoyuan Peng for noting the 256 sscanf vulnerabilities in the text-mode code that got me to 257 realize that we didn't need this code any more) 258 Bluetooth: fix non-blocking mode. 259 Don't assume that all compilers used to build for Linux support 260 the __atomic builtins 261 Windows: 262 Add more information in "interface disappeared" error messages, in 263 the hopes of trying to figure out the cause. 264 Treat ERROR_DEVICE_REMOVED as "device was removed". 265 Indicate in the error message which "device was removed" error 266 occurred. 267 Report the Windows error status if PacketSendPacket() fails. 268 Use %lu for ULONGs in error message formats. 269 Don't treat the inability to find airpcap.dll as an error. 270 Ignore spurious error reports by Microsoft Surface mobile 271 telephony modem driver 272 rpcap: 273 Clean up error checking and error messages for server address 274 lookup. 275 276Tuesday, December 29, 2020 277 Summary for 1.10.0 libpcap release 278 Add support for capturing on DPDK devices 279 Label most APIs by the first release in which they're available 280 Fix some memory leaks, including in pcap_compile() 281 Add pcap_datalink_val_to_description_or_dlt() 282 Handle the pcap private data in a fashion that makes fewer 283 assumptions about memory layouts (might fix GitHub issue #940 284 on ARM) 285 Fix some thread safety issues 286 pcap_findalldevs(): don't sort interfaces by unit number 287 Always return a list of supported time-stamp types, even if only 288 host time stamps are supported 289 Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP 290 Report the DLT description in error messages 291 Add pcap_init() for first-time initialization and global option 292 setting; it's not required, but may be used 293 Remove (unused) SITA support 294 Capture file reading: 295 Correctly handle pcapng captures with more than one IDB with a 296 snspshot length greater than the supported maximum 297 Capture file writing: 298 Create the file in pcap_dump_open_append() if it doesn't exist 299 Packet filtering: 300 Fix "unknown ether proto 'aarp'" 301 Add a new filter "ifindex" for DLT_LINUX_SLL2 files on all 302 platforms and live Linux captures 303 Add a hack to the optimizer to try to catch certain optimizer 304 loops (should prevent GitHub issue #112) 305 Show special Linux BPF offsets symbolically in bpf_image() and 306 bpf_dump() 307 Added support for ICMPv6 types 1-4 as tokens with names 308 Remove undocumented and rather old "ether proto" protocols 309 Catch invalid IPv4 addresses in filters 310 Don't assume ARM supports unaligned accesses 311 Security and other issues found by analysis: 312 Fix various security issues reported by Charles Smith at Tangible 313 Security 314 Fix various security issues reported by Include Security 315 Fix some issues found by cppcheck. 316 Add some overflow checks in the optimizer 317 rpcap: 318 Support rpcap-over-TLS 319 Redo protocol version negotiation to avoid problems with old 320 servers (it still works with servers using the old negotiation, 321 as well as servers not supporting negotiation) 322 Error handling cleanups 323 Add some new authentication libpcap error codes for specific 324 errors 325 Fix some inetd issues in rpcapd 326 Fix rpcapd core dumps with invalid configuration file 327 On UN*X, don't have rpcapd tell the client why authentication 328 failed, so a brute-force attacker can't distinguish between 329 "unknown user name" and "known user name, wrong password" 330 Allow rpcapd to rebind more rapidly (GitHub issue #765) 331 Documentation: 332 Improve man pages, including adding backward compatibility notes 333 Building and testing: 334 Require, and assume, some level of C99 support in the C compiler 335 Require Visual Studio 2015 or later if using Visual Studio 336 Fix configure script issues, including with libnl on Linux 337 Fix CMake issues 338 Squelch complaints from Bison about "%define api.pure" being 339 deprecated 340 Fix compilation of pcap-tc.c 341 Linux: 342 Require PF_PACKET support, and kernel 2.6.27 or later 343 Handle systems without AF_INET or AF_UNIX socket support 344 Get rid of Wireless Extensions for turning monitor mode on 345 Proper memory sync for PACKET_MMAP (may prevent GitHub issue 346 #898) 347 Drop support for libnl 1 and 2. 348 Return error on interface going away, but not if it just went 349 down but is still present 350 Set socket protocol only after packet ring configured, 351 reducing bogus packet drop reports 352 Get ifdrop stats from sysfs. 353 When adjusting BPF programs, do not subtract the 354 SLL[2]_HDR_LEN if the location is negative (special metadata 355 offset), to preserve references to metadata; see 356 https://github.com/the-tcpdump-group/tcpdump/issues/480#issuecomment-486827278 357 Report a warning for unknown ARPHRD types 358 Have pcap_breakloop() forcibly break out of a sleeping 359 capture loop 360 Add support for DSA data link types 361 For raw USB bus capture, use the snapshot length to set the 362 buffer size, and set the len field to reflect the length 363 in the URB (GitHub issue #808) 364 With a timeout of zero, wait indefinitely 365 Clean up support for some non-GNU libc C libraries 366 Add DLT_LINUX_SLL2 for cooked-mode captures 367 Probe CONFIGURATION descriptor of connected USB devices 368 Treat EPERM on ethtool ioctls as meaning "not supported", as 369 permissions checks are done before checking whether the 370 ioctl is supported at all 371 macOS: 372 Cope with getting EPWROFF from SIOCGIFMEDIA 373 Treat EPERM on SIOCGIFMEDIA as meaning "not supported", as 374 permissions checks are done before checking whether the 375 ioctl is supported at all 376 Treat ENXIO when reading packets as meaning "the interface 377 was removed" 378 Report "the interface disappeared", not "the interface went 379 down", if the interface was removed during a capture 380 FreeBSD: 381 Treat ENXIO as meaning "the interface was removed" 382 Report "the interface disappeared", not "the interface went 383 down", if the interface was removed during a capture 384 NetBSD: 385 Treat ENXIO as meaning "the interface was removed" 386 Report "the interface disappeared", not "the interface went 387 down", if the interface was removed during a capture 388 OpenBSD: 389 Treat EIO as meaning "the interface was removed" 390 Report "the interface disappeared", not "the interface went 391 down", if the interface was removed during a capture 392 DragonFly BSD: 393 Treat ENXIO as meaning "the interface was removed" 394 Report "the interface disappeared", not "the interface went 395 down", if the interface was removed during a capture 396 Solaris: 397 Treat ENXIO as meaning "the interface was removed" 398 Report "the interface disappeared", not "the interface went 399 down", if the interface was removed during a capture 400 AIX: 401 Fix loading of BPF kernel extension 402 Treat ENXIO as meaning "the interface was removed" 403 Report "the interface disappeared", not "the interface went 404 down", if the interface was removed during a capture 405 Windows: 406 Make the snapshot length work even if pcap_setfilter() 407 isn't called 408 Fix compilation on Cygwin/MSYS 409 Add pcap_handle(), and deprecate pcap_fileno() 410 Report PCAP_ERROR_NO_SUCH_DEVICE for a non-existent device 411 Return an appropriate error message for device removed or 412 device unusable due to a suspend/resume 413 Report a warning for unknown NdisMedium types 414 Have pcap_breakloop() forcibly break out of a sleeping 415 capture loop 416 Clean up building DLL 417 Handle CRT mismatch for pcap_dump_fopen() 418 Map NdisMediumWirelessWan to DLT_RAW 419 Add AirPcap support in a module, rather than using 420 WinPcap/Npcap's support for it 421 Report the system error for PacketSetHwFilter() failures 422 Add support for getting and setting packet time stamp types 423 with Npcap 424 Have pcap_init() allow selecting whether the API should use 425 local code page strings or UTF-8 strings (including error 426 messages) 427 Haiku: 428 Add capture support 429 430Sunday, July 22, 2018 431 Summary for 1.9.1 libpcap release 432 Mention pcap_get_required_select_timeout() in the main pcap man page 433 Fix pcap-usb-linux.c build on systems with musl 434 Fix assorted man page and other documentation issues 435 Plug assorted memory leaks 436 Documentation changes to use https: 437 Changes to how time stamp calculations are done 438 Lots of tweaks to make newer compilers happier and warning-free and 439 to fix instances of C undefined behavior 440 Warn if AC_PROG_CC_C99 can't enable C99 support 441 Rename pcap_set_protocol() to pcap_set_protocol_linux(). 442 Align pcap_t private data on an 8-byte boundary. 443 Fix various error messages 444 Use 64-bit clean API in dag_findalldevs() 445 Fix cleaning up after some errors 446 Work around some ethtool ioctl bugs in newer Linux kernels (GitHub 447 issue #689) 448 Add backwards compatibility sections to some man pages (GitHub issue 449 #745) 450 Fix autotool configuration on AIX and macOS 451 Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; 452 they're internal-only and subject to change 453 Fix pcapng block size checking 454 On macOS, don't build rpcapd or test programs any fatter than they 455 need to be 456 Fix reading of capture statistics for Linux USB 457 Fix packet size values for Linux USB packets (GitHub issue #808) 458 Check only VID in VLAN test in filters (GitHub issue #461) 459 Fix pcap_list_datalinks on 802.11 devices on macOS 460 Fix overflows with very large snapshot length in pcap file 461 Improve parsing of rpcapd configuration file (GitHub issue #767) 462 Handle systems without strlcpy() or strlcat() better 463 Fix crashes and other errors with invalid filter expressions 464 Fix use of uninitialized file descriptor in remote capture 465 Fix some CMake issues 466 Fix some divide-by-zero issues with the filter compiler 467 Work around a GNU libc bug in pcap_nametonetaddr() 468 Add support for DLT_LINUX_SLL2 469 Fix handling of the packet-count argument for Myricom SNF devices 470 Fix --disable-rdma in configure script (GitHub issue #782) 471 Fix compilation of TurboCap support (GitHub issue #764) 472 Constify first argument to pcap_findalldevs_ex() 473 Fix a number of issues when running rpcapd as an inetd-style daemon 474 Fix CMake issues with D-Bus libraries 475 In rpcapd, clean up termination of a capture session 476 Redo remote capture protocol negotiation 477 In rpcapd, report the same error for "invalid user name" and 478 "invalid password", to make brute-forcing harder 479 For remote captures, add an error code for "the server requires TLS" 480 Fix pcap_dump_fopen() on Windows to avoid clashes between 481 {Win,N}Pcap and application C runtimes 482 Fix exporting of functions from Windows DLLs (GitHub issue #810) 483 Fix building as part of Npcap 484 Allow rpcapd to rebind more rapidly 485 Fix building shared libpcap library on midipix (midipix.org) 486 Fix hack to detect UTF-16LE adapter names on Windows not to go past 487 the end of the string 488 Fix handling of "wireless WAN" (mobile phone network modems) on 489 Windows with WinPcap/Npcap (GitHub issue #824) 490 Have pcap_dump_open_append() create the dump file if it doesn't 491 exists (GitHub issue #247) 492 Fix the maxmum snapshot length for DLT_USBPCAP 493 Use -fPIC when building for 64-bit SPARC on Linux (GitHub issue #837) 494 Fix CMake 64-bit library installation directory on some Linux 495 distributions 496 Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was 497 specified 498 Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 499 PCAPNG reader applies some sanity checks before doing malloc(). 500 501Sunday, June 24, 2018, by mcr@sandelman.ca 502 Summary for 1.9.0 libpcap release 503 Added testing system to libpcap, independent of tcpdump 504 Changes to how pcap_t is activated 505 Adding support for Large stream buffers on Endace DAG cards 506 Changes to BSD 3-clause license to 2-clause license 507 Additions to TCP header parsing, per RFC3168 508 Add CMake build process (extensive number of changes) 509 Assign a value for OpenBSD DLT_OPENFLOW. 510 Support setting non-blocking mode before activating. 511 Extensive build support for Windows VS2010 and MINGW (many many changes, over many months) 512 Added RPCAPD support when --enable-remote (default no) 513 Add the rpcap daemon source and build instructions. 514 Put back the greasy "save the capture filter string so we can tweak it" 515 hack, that keeps libpcap from capturing rpcap traffic. 516 Fixes for captures on MacOS, utun0 517 fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses. 518 Add a linktype for IBM SDLC frames containing SNA PDUs. 519 pcap_compile() in 1.8.0 and later is newly thread-safe. 520 bound snaplen for linux tpacket_v2 to ~64k 521 Make VLAN filter handle both metadata and inline tags 522 D-Bus captures can now be up to 128MB in size 523 Added LORATAP DLT value 524 Added DLT_VSOCK for https://qemu-project.org/Features/VirtioVsock 525 probe_devices() fixes not to overrun buffer for name of device 526 Add linux-specific pcap_set_protocol_linux() to allow specifying a specific capture protocol. 527 RDMA sniffing support for pcap 528 Add Nordic Semiconductor Bluetooth LE sniffer link-layer header type. 529 fixes for reading /etc/ethers 530 Make it possible to build on Windows without packet.dll. 531 Add tests for large file support on UN*X. 532 Solaris fixes to work with 2.8.6 533 configuration test now looks for header files, not capture devices present 534 Fix to work with Berkeley YACC. 535 fixes for DragonBSD compilation of pcap-netmap.c 536 Clean up the ether_hostton() stuff. 537 Add an option to disable Linux memory-mapped capture support. 538 Add DAG API support checks. 539 Add Septel, Myricom SNF, and Riverbed TurboCap checks. 540 Add checks for Linux USB, Linux Bluetooth, D-Bus, and RDMA sniffing support. 541 Add a check for hardware time stamping on Linux. 542 Don't bother supporting pre-2005 Visual Studio. 543 Increased minimum autoconf version requirement to 2.64 544 Add DLT value 273 for XRA-31 sniffer 545 Clean up handing of signal interrupts in pcap_read_nocb_remote(). 546 Use the XPG 4.2 versions of the networking APIs in Solaris. 547 Fix, and better explain, the "IPv6 means IPv6, not IPv4" option setting. 548 Explicitly warn that negative packet buffer timeouts should not be used. 549 rpcapd: Add support inetd-likes, including xinetd.conf, and systemd units 550 Rename DLT_IEEE802_15_4 to DLT_IEEE802_15_4_WITHFCS. 551 Add DISPLAYPORT AUX link type 552 Remove the sunos4 kernel modules and all references to them. 553 Add more interface flags to pcap_findalldevs(). 554 Summary for 1.9.0 libpcap release (to 2017-01-25 by guy@alum.mit.edu) 555 Man page improvements 556 Fix Linux cooked mode userspace filtering (GitHub pull request #429) 557 Fix compilation if IPv6 support not enabled 558 Fix some Linux memory-mapped capture buffer size issues 559 Don't fail if kernel filter can't be set on Linux (GitHub issue 560 #549) 561 Improve sorting of interfaces for pcap_findalldevs() 562 Don't list Linux usbmon devices if usbmon module isn't loaded 563 Report PCAP_ERROR_PERM_DENIED if no permission to open Linux usbmon 564 devices 565 Fix DLT_ type for Solaris IPNET devices 566 Always return an error message for errors finding DAG or Myricom 567 devices 568 If possible, don't require that a device be openable when 569 enumerating them for pcap_findalldevs() 570 Don't put incompletely-initialized addresses in the address list for 571 When finding Myricom devices, update description for regular 572 interfaces that are Myricom devices and handle SNF_FLAGS=0x2(port 573 aggregation enabled) 574 Fix compilation error in DAG support 575 Fix issues with CMake configuration 576 Add support for stream buffers larger than 2GB on newer DAG cards 577 Remove support for building against DAG versions without STREAMS 578 support (before dag-3.0.0 2007) 579 580Tuesday, Oct. 25, 2016 mcr@sandelman.ca 581 Summary for 1.8.1 libpcap release 582 Add a target in Makefile.in for Exuberant Ctags use: 'extags'. 583 Rename configure.in to configure.ac: autoconf 2.59 584 Clean up the name-to-DLT mapping table. 585 Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS 586 Clarify what the return values are for both success and failure. 587 Many changes to build on windows 588 Check for the "break the loop" condition in the inner loop for TPACKET_V3. 589 Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue #493. 590 Filter out duplicate looped back CAN frames. 591 Fix the handling of loopback filters for IPv6 packets. 592 Add a link-layer header type for RDS (IEC 62106) groups. 593 Use different intermediate folders for x86 and x64 builds on Windows. 594 On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. 595 Removes the need for the "host-endian" link-layer header type. 596 Compile with '-Wused-but-marked-unused' in devel mode if supported 597 Have separate DLTs for big-endian and host-endian SocketCAN headers. 598 Reflect version.h being renamed to pcap_version.h. 599 Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! 600 Properly check for sock_recv() errors. 601 Re-impose some of Winsock's limitations on sock_recv(). 602 Replace sprintf() with pcap_snprintf(). 603 Fix signature of pcap_stats_ex_remote(). 604 Initial cmake support for remote packet capture. 605 Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. 606 Clean up {DAG, Septel, Myricom SNF}-only builds. 607 Do UTF-16-to-ASCII conversion into the right place. 608 pcap_create_interface() needs the interface name on Linux. 609 Clean up hardware time stamp support: the "any" device does not support any time stamp types. 610 Add support for capturing on FreeBSD usbusN interfaces. 611 Add a LINKTYPE/DLT_ value for FreeBSD USB. 612 Go back to using PCAP_API on Windows. 613 CMake support 614 Add TurboCap support from WinPcap. 615 Recognize 802.1ad nested VLAN tag in vlan filter. 616 617Thursday Sep. 3, 2015 guy@alum.mit.edu 618 Summary for 1.7.5 libpcap release 619 Man page cleanups. 620 Add some allocation failure checks. 621 Fix a number of Linux/ucLinux configure/build issues. 622 Fix some memory leaks. 623 Recognize 802.1ad nested VLAN tag in vlan filter. 624 Fix building Bluetooth Linux Monitor support with BlueZ 5.1+ 625 626Saturday Jun. 27, 2015 mcr@sandelman.ca 627 Summary for 1.7.4 libpcap release 628 Include fix for GitHub issue #424 -- out of tree builds. 629 630Friday Apr. 10, 2015 guy@alum.mit.edu 631 Summary for 1.7.3 libpcap release 632 Work around a Linux bonding driver bug. 633 634Thursday Feb. 12, 2015 guy@alum.mit.edu/mcr@sandelman.ca 635 Summary for 1.7.2 libpcap release 636 Support for filtering Geneve encapsulated packets. 637 Generalize encapsulation handling, fixing some bugs. 638 Don't add null addresses to address lists. 639 Add pcap_dump_open_append() to open for appending. 640 Fix the swapping of isochronous descriptors in Linux USB. 641 Attempt to handle TPACKET_V1 with 32-bit userland and 64-bit kernel. 642 643Wednesday Nov. 12, 2014 guy@alum.mit.edu/mcr@sandelman.ca 644 Summary for 1.7.0 libpcap release 645 Fix handling of zones for BPF on Solaris 646 new DLT for ZWAVE 647 clarifications for read timeouts. 648 Use BPF extensions in compiled filters, fixing VLAN filters 649 some fixes to compilation without stdint.h 650 EBUSY can now be returned by SNFv3 code. 651 Fix the range checks in BPF loads 652 Various DAG fixes. 653 Various Linux fixes. 654 655Monday Aug. 12, 2014 guy@alum.mit.edu 656 Summary for 1.6.2 libpcap release 657 Don't crash on filters testing a non-existent link-layer type 658 field. 659 Fix sending in non-blocking mode on Linux with memory-mapped 660 capture. 661 Fix timestamps when reading pcap-ng files on big-endian 662 machines. 663 664Saturday Jul. 19, 2014 mcr@sandelman.ca 665 Summary for 1.6.1 libpcap release 666 some fixes for the any device 667 changes for how --enable-XXX (--enable-sniffing, --enable-can) works 668 669Wednesday Jul. 2, 2014 mcr@sandelman.ca 670 Summary for 1.6.0 libpcap release 671 Don't support D-Bus sniffing on OS X 672 fixes for byte order issues with NFLOG captures 673 Handle using cooked mode for DLT_NETLINK in activate_new(). 674 on platforms where you can not capture on down interfaces, do not list them 675 but: do list interfaces which are down, if you can capture on them! 676 677Wednesday December 18, 2013 guy@alum.mit.edu 678Summary for 1.5.3 libpcap release 679 Don't let packets that don't match the current filter get to the 680 application when TPACKET_V3 is used. (GitHub issue #331) 681 Fix handling of pcap_loop()/pcap_dispatch() with a packet count 682 of 0 on some platforms (including Linux with TPACKET_V3). 683 (GitHub issue #333) 684 Work around TPACKET_V3 deficiency that causes packets to be lost 685 when a timeout of 0 is specified. (GitHub issue #335) 686 Man page formatting fixes. 687 688Wednesday December 4, 2013 guy@alum.mit.edu 689Summary for 1.5.2 libpcap release 690 Fix libpcap to work when compiled with TPACKET_V3 support and 691 running on a kernel without TPACKET_V3 support. (GitHub 692 issue #329) 693 694Wednesday November 20, 2013 guy@alum.mit.edu 695Summary for 1.5.1 libpcap release 696 Report an error, rather than crashing, if an IPv6 address is 697 used for link-layer filtering. (Wireshark bug 9376) 698 699Wednesday October 30, 2013 guy@alum.mit.edu 700Summary for 1.5.0 libpcap release 701 TPACKET_V3 support added for Linux 702 Point users to the the-tcpdump-group repository on GitHub rather 703 than the mcr repository 704 Checks added for malloc()/realloc()/etc. failures 705 Fixed build on Solaris 11 706 Support filtering E1 SS7 traffic on MTP2 layer Annex A 707 Use "ln -s" to link man pages by default 708 Add support for getting nanosecond-resolution time stamps when 709 capturing and reading capture files 710 Many changes to autoconf to deal better with non-GCC compilers 711 added many new DLT types 712 713Saturday April 6, 2013 guy@alum.mit.edu 714Summary for 1.4.0 libpcap release 715 Add netfilter/nfqueue interface. 716 If we don't have support for IPv6 address resolution, support, 717 in filter expressions, what IPv6 stuff we can. 718 Fix pcap-config to include -lpthread if canusb support is 719 present 720 Try to fix "pcap_parse not defined" problems when --without-flex 721 and --without-bison are used when you have Flex and Bison 722 Fix some issues with the pcap_loop man page. 723 Fix pcap_getnonblock() and pcap_setnonblock() to fill in the 724 supplied error message buffer 725 Fix typo that, it appeared, would cause pcap-libdlpi.c not to 726 compile (perhaps systems with libdlpi also have BPF and use 727 that instead) 728 Catch attempts to call pcap_compile() on a non-activated pcap_t 729 Fix crash on Linux with CAN-USB support without usbfs 730 Fix addition of VLAN tags for Linux cooked captures 731 Check for both EOPNOTSUPP and EINVAL after SIOCETHTOOL ioctl, so 732 that the driver can report either one if it doesn't support 733 SIOCETHTOOL 734 Add DLT_INFINIBAND and DLT_SCTP 735 Describe "proto XXX" and "protochain XXX" in the pcap-filter man 736 page 737 Handle either directories, or symlinks to directories, that 738 correspond to interfaces in /sys/class/net 739 Fix handling of VLAN tag insertion to check, on Linux 3.x 740 kernels, for VLAN tag valid flag 741 Clean up some man pages 742 Support libnl3 as well as libnl1 and libnl2 on Linux 743 Fix handling of Bluetooth devices on 3.x Linux kernels 744 745Friday March 30, 2012. mcr@sandelman.ca 746Summary for 1.3.0 libpcap release 747 Handle DLT_PFSYNC in {FreeBSD, other *BSD+Mac OS X, other}. 748 Linux: Don't fail if netfilter isn't enabled in the kernel. 749 Add new link-layer type for NFC Forum LLCP. 750 Put the CANUSB stuff into EXTRA_DIST, so it shows up in the release tarball. 751 Add LINKTYPE_NG40/DLT_NG40. 752 Add DLT_MPEG_2_TS/LINKTYPE_MPEG_2_TS for MPEG-2 transport streams. 753 [PATCH] Fix AIX-3.5 crash with read failure during stress 754 AIX fixes. 755 Introduce --disable-shared configure option. 756 Added initial support for canusb devices. 757 Include the pcap(3PCAP) additions as 1.2.1 changes. 758 many updates to documentation: pcap.3pcap.in 759 Improve 'inbound'/'outbound' capture filters under Linux. 760 Note the cleanup of handling of new DLT_/LINKTYPE_ values. 761 On Lion, don't build for PPC. 762 For mac80211 devices we need to clean up monitor mode on exit. 763 764Friday December 9, 2011. guy@alum.mit.edu. 765Summary for 1.2.1 libpcap release 766 Update README file. 767 Fix typos in README.linux file. 768 Clean up some compiler warnings. 769 Fix Linux compile problems and tests for ethtool.h. 770 Treat Debian/kFreeBSD and GNU/Hurd as systems with GNU 771 toolchains. 772 Support 802.1 QinQ as a form of VLAN in filters. 773 Treat "carp" as equivalent to "vrrp" in filters. 774 Fix code generated for "ip6 protochain". 775 Add some new link-layer header types. 776 Support capturing NetFilter log messages on Linux. 777 Clean up some error messages. 778 Turn off monitor mode on exit for mac80211 interfaces on Linux. 779 Fix problems turning monitor mode on for non-mac80211 interfaces 780 on Linux. 781 Properly fail if /sys/class/net or /proc/net/dev exist but can't 782 be opened. 783 Fail if pcap_activate() is called on an already-activated 784 pcap_t, and add a test program for that. 785 Fix filtering in pcap-ng files. 786 Don't build for PowerPC on Mac OS X Lion. 787 Simplify handling of new DLT_/LINKTYPE_ values. 788 Expand pcap(3PCAP) man page. 789 790Sunday July 24, 2011. mcr@sandelman.ca. 791Summary for 1.2 libpcap release 792 All of the changes listed below for 1.1.1 and 1.1.2. 793 Changes to error handling for pcap_findalldevs(). 794 Fix the calculation of the frame size in memory-mapped captures. 795 Add a link-layer header type for STANAG 5066 D_PDUs. 796 Add a link-layer type for a variant of 3GPP TS 27.010. 797 Noted real nature of LINKTYPE_ARCNET. 798 Add a link-layer type for DVB-CI. 799 Fix configure-script discovery of VLAN acceleration support. 800 see https://netoptimizer.blogspot.com/2010/09/tcpdump-vs-vlan-tags.html 801 Linux, HP-UX, AIX, NetBSD and OpenBSD compilation/conflict fixes. 802 Protect against including AIX 5.x's <net/bpf.h> having been included. 803 Add DLT_DBUS, for raw D-Bus messages. 804 Treat either EPERM or EACCES as "no soup for you". 805 Changes to permissions on DLPI systems. 806 Add DLT_IEEE802_15_4_NOFCS for 802.15.4 interfaces. 807 808Fri. August 6, 2010. guy@alum.mit.edu. 809Summary for 1.1.2 libpcap release 810 Return DLT_ values, not raw LINKTYPE_ values from 811 pcap_datalink() when reading pcap-ng files 812 Add support for "wlan ra" and "wlan ta", to check the RA and TA 813 of WLAN frames that have them 814 Don't crash if "wlan addr{1,2,3,4}" are used without 802.11 815 headers 816 Do filtering on USB and Bluetooth capturing 817 On FreeBSD/SPARC64, use -fPIC - it's apparently necessary 818 Check for valid port numbers (fit in a 16-bit unsigned field) in 819 "port" filters 820 Reject attempts to put savefiles into non-blocking mode 821 Check for "no such device" for the "get the media types" ioctl 822 in *BSD 823 Improve error messages from bpf_open(), and let it do the error 824 handling 825 Return more specific errors from pcap_can_set_rfmon(); fix 826 documentation 827 Update description fetching code for FreeBSD, fix code for 828 OpenBSD 829 Ignore /sys/net/dev files if we get ENODEV for them, not just 830 ENXIO; fixes handling of bonding devices on Linux 831 Fix check for a constant 0 argument to BPF_DIV 832 Use the right version of ar when cross-building 833 Free any filter set on a savefile when the savefile is closed 834 Include the CFLAGS setting when configure was run in the 835 compiler flags 836 Add support for 802.15.4 interfaces on Linux 837 838Thu. April 1, 2010. guy@alum.mit.edu. 839Summary for 1.1.1 libpcap release 840 Update CHANGES to reflect more of the changes in 1.1.0. 841 Fix build on RHEL5. 842 Fix shared library build on AIX. 843 844Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu. 845Summary for 1.1.0 libpcap release 846 Add SocketCAN capture support 847 Add Myricom SNF API support 848 Update Endace DAG and ERF support 849 Add support for shared libraries on Solaris, HP-UX, and AIX 850 Build, install, and un-install shared libraries by default; 851 don't build/install shared libraries on platforms we don't support 852 Fix building from a directory other than the source directory 853 Fix compiler warnings and builds on some platforms 854 Update config.guess and config.sub 855 Support monitor mode on mac80211 devices on Linux 856 Fix USB memory-mapped capturing on Linux; it requires a new DLT_ 857 value 858 On Linux, scan /sys/class/net for devices if we have it; scan 859 it, or /proc/net/dev if we don't have /sys/class/net, even if 860 we have getifaddrs(), as it'll find interfaces with no 861 addresses 862 Add limited support for reading pcap-ng files 863 Fix BPF driver-loading error handling on AIX 864 Support getting the full-length interface description on FreeBSD 865 In the lexical analyzer, free up any addrinfo structure we got back 866 from getaddrinfo(). 867 Add support for BPF and libdlpi in OpenSolaris (and SXCE) 868 Hyphenate "link-layer" everywhere 869 Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations 870 In pcap_read_linux_mmap(), if there are no frames available, call 871 poll() even if we're in non-blocking mode, so we pick up 872 errors, and check for the errors in question. 873 Note that poll() works on BPF devices is Snow Leopard 874 If an ENXIO or ENETDOWN is received, it may mean the device has 875 gone away. Deal with it. 876 For BPF, raise the default capture buffer size to from 32k to 512k 877 Support ps_ifdrop on Linux 878 Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile 879 under cygwin. 880 Changes to Linux mmapped captures. 881 Fix bug where create_ring would fail for particular snaplen and 882 buffer size combinations 883 Update pcap-config so that it handles libpcap requiring 884 additional libraries 885 Add workaround for threadsafeness on Windows 886 Add missing mapping for DLT_ENC <-> LINKTYPE_ENC 887 DLT: Add DLT_CAN_SOCKETCAN 888 DLT: Add Solaris ipnet 889 Don't check for DLT_IPNET if it's not defined 890 Add link-layer types for Fibre Channel FC-2 891 Add link-layer types for Wireless HART 892 Add link-layer types for AOS 893 Add link-layer types for DECT 894 Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups) 895 Install headers unconditionally, and include vlan.h/bluetooth.h if 896 enabled 897 Autoconf fixes+cleanup 898 Support enabling/disabling bluetooth (--{en,dis}able-bluetooth) 899 Support disabling SITA support (--without-sita) 900 Return -1 on failure to create packet ring (if supported but 901 creation failed) 902 Fix handling of 'any' device, so that it can be opened, and no longer 903 attempt to open it in Monitor mode 904 Add support for snapshot length for USB Memory-Mapped Interface 905 Fix configure and build on recent Linux kernels 906 Fix memory-mapped Linux capture to support pcap_next() and 907 pcap_next_ex() 908 Fixes for Linux USB capture 909 DLT: Add DLT_LINUX_EVDEV 910 DLT: Add DLT_GSMTAP_UM 911 DLT: Add DLT_GSMTAP_ABIS 912 913Mon. October 27, 2008. ken@netfunctional.ca. Summary for 1.0.0 libpcap release 914 Compile with IPv6 support by default 915 Compile with large file support on by default 916 Add pcap-config script, which deals with -I/-L flags for compiling 917 DLT: Add IPMB 918 DLT: Add LAPD 919 DLT: Add AX25 (AX.25 w/KISS header) 920 DLT: Add JUNIPER_ST 921 802.15.4 support 922 Variable length 802.11 header support 923 X2E data type support 924 SITA ACN Interface support - see README.sita 925 Support for memory-mapped capture on Linux 926 Support for zerocopy BPF on platforms that support it 927 Support for setting buffer size when opening devices 928 Support for setting monitor mode when opening 802.11 devices 929 Better support for dealing with VLAN tagging/stripping on Linux 930 Fix dynamic library support on OSX 931 Return PCAP_ERROR_IFACE_NOT_UP if the interface isn't 'UP', so applications 932 can print better diagnostic information 933 Return PCAP_ERROR_PERM_DENIED if we don't have permission to open a device, so 934 applications can tell the user they need to go play with permissions 935 On Linux, ignore ENETDOWN so we can continue to capture packets if the 936 interface goes down and comes back up again. 937 On Linux, support new tpacket frame headers (2.6.27+) 938 On Mac OS X, add scripts for changing permissions on /dev/bpf* and launchd plist 939 On Solaris, support 'passive mode' on systems that support it 940 Fixes to autoconf and general build environment 941 Man page reorganization + cleanup 942 Autogenerate VERSION numbers better 943 944Mon. September 10, 2007. ken@xelerance.com. Summary for 0.9.8 libpcap release 945 Change build process to put public libpcap headers into pcap subir 946 DLT: Add value for IPMI IPMB packets 947 DLT: Add value for u10 Networks boards 948 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 949 libpcap files on an OS other than where the file was generated 950 951Wed. April 25, 2007. ken@xelerance.com. Summary for 0.9.6 libpcap release 952 953 Put the public libpcap headers into a pcap subdirectory in both the 954 source directory and the target include directory, and have include 955 files at the top-level directory to include those headers, for 956 backwards compatibility. 957 Add Bluetooth support 958 Add USB capturing support on Linux 959 Add support for the binary USB sniffing interface in Linux 960 Add support for new FreeBSD BIOCSDIRECTION ioctl 961 Add additional filter operations for 802.11 frame types 962 Add support for filtering on MTP2 frame types 963 Propagate some changes from the main branch, so the x.9 branch has 964 all the DLT_ and LINKTYPE_ values that the main branch does 965 Reserved a DLT_ and SAVEFILE_ value for PPI (Per Packet Info) 966 encapsulated packets 967 Add LINKTYPE_ for IEEE 802.15.4, with address fields padded as done 968 by Linux drivers 969 Add LINKTYPE_ value corresponding to DLT_IEEE802_16_MAC_CPS. 970 Add DLT for IEEE 802.16 (WiMAX) MAC Common Part Sublayer 971 Add DLT for Bluetooth HCI UART transport layer 972 When building a shared library, build with "-fPIC" on Linux to support x86_64 973 Link with "$(CC) -shared" rather than "ld -shared" when building a 974 ".so" shared library 975 Add support for autoconf 2.60 976 Fixes to discard unread packets when changing filters 977 Changes to handle name changes in the DAG library resulting from 978 switching to libtool. 979 Add support for new DAG ERF types. 980 Add an explicit "-ldag" when building the shared library, so the DAG 981 library dependency is explicit. 982 Mac OSX fixes for dealing with "wlt" devices 983 Fixes in add_or_find_if() & pcap_findalldevs() to optimize generating 984 device lists 985 Fixed a bug in pcap_open_live(). The return value of PacketSetHwFilter 986 was not checked. 987 988Tue. September 19, 2006. ken@xelerance.com. Summary for 0.9.5 libpcap release 989 990 Support for LAPD frames with vISDN 991 Support for ERF on channelized T1/E1 cards via DAG API 992 Fix capitalization that caused issues crossc compiling on Linux 993 Better failure detection on PacketGetAdapterNames() 994 Fixes for MPLS packet generation (link layer) 995 OP_PACKET now matches the beginning of the packet, instead of 996 beginning+link-layer 997 Add DLT/LINKTYPE for carrying FRF.16 Multi-link Frame Relay 998 Fix allocation of buffer for list of link-layer types 999 Added a new DLT and LINKTYPE value for ARINC 653 Interpartition Communication Messages 1000 Fixed a typo in a DLT value: it should start with DLT_ and not LINKTYPE_ 1001 Redefined DLT_CAN20B and LINKTYPE_CAN20B as #190 (as this is the right value for CAN). 1002 Added definition for DLT_A429 and LINKTYPE_A429 as #184. 1003 Added a new DLT and LINKTYPE value for CAN v2.0B frames. 1004 Add support for DLT_JUNIPER_VP. 1005 Don't double-count received packets on Linux systems that 1006 support the PACKET_STATISTICS getsockopt() argument on 1007 PF_PACKET sockets. 1008 Add support for DLT_IEEE802_11 and DLT_IEEE802_11_RADIO link 1009 layers in Windows 1010 Add support to build libpcap.lib and wpcap.dll under Cygnus and 1011 MingW32. 1012 1013Mon. September 5, 2005. ken@xelerance.com. Summary for 0.9.4 libpcap release 1014 1015 Support for radiotap on Linux (Mike Kershaw) 1016 Fixes for HP-UX 1017 Support for additional Juniper link-layer types 1018 Fixes for filters on MPLS-encapsulated packets 1019 "vlan" filter fixed 1020 "pppoed" and "pppoes" filters added; the latter modifies later 1021 parts of the filter expression to look at the PPP headers and 1022 headers in the PPP payload 1023 1024Tue. July 5, 2005. ken@xelerance.com. Summary for 0.9.3 libpcap release 1025 1026 Fixes for compiling on nearly every platform, 1027 including improved 64bit support 1028 MSDOS Support 1029 Add support for sending packets 1030 OpenBSD pf format support 1031 IrDA capture (Linux only) 1032 1033Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release 1034 1035 Fixed minor problem in gencode.c that would appear on 64-bit 1036 platforms. 1037 Version number is now sane. 1038 1039Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release 1040 1041 updates for autoconf 2.5 1042 fixes for ppp interfaces for freebsd 4.1 1043 pcap gencode can generate code for 802.11, IEEE1394, and pflog. 1044 1045Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 0.8 release 1046 1047 added pcap_findalldevs() 1048 Win32 patches from NetGroup, Politecnico di Torino (Italy) 1049 OpenBSD pf, DLT_PFLOG added 1050 Many changes to ATM support. 1051 lookup pcap_lookupnet() 1052 Added DLT_ARCNET_LINUX, DLT_ENC, DLT_IEEE802_11_RADIO, DLT_SUNATM, 1053 DLT_IP_OVER_FC, DLT_FRELAY, others. 1054 Sigh. More AIX wonderfulness. 1055 Document updates. 1056 Changes to API: pcap_next_ex(), pcap_breakloop(), pcap_dump_flush(), 1057 pcap_list_datalinks(), pcap_set_datalink(), 1058 pcap_lib_version(), pcap_datalink_val_to_name(), 1059 pcap_datalink_name_to_val(), new error returns. 1060 1061Tuesday, February 25, 2003. fenner@research.att.com. 0.7.2 release 1062 1063 Support link types that use 802.2 always, never, and sometimes. 1064 Don't decrease the size of the BPF buffer from the default. 1065 Support frame relay. 1066 Handle 32-bit timestamps in DLPI, and pass the right buffer size. 1067 Handle Linux systems with modern kernel but without 1068 SOL_PACKET in the userland headers. 1069 Linux support for ARPHRD_RAWHDLC. 1070 Handle 32-bit timestamps in snoop. 1071 Support eg (Octane/O2xxx/O3xxx Gigabit) devices. 1072 Add new reserved DLT types. 1073 1074Monday October 23, 2001. mcr@sandelman.ottawa.on.ca. Summary for 0.7 release 1075 1076 Added pcap_findalldevs() call to get list of interfaces in a MI way. 1077 1078 pcap_stats() has been documented as to what its counters mean on 1079 each platform. 1080 1081Tuesday January 9, 2001. guy@alum.mit.edu. Summary for 0.6 release 1082 1083 New Linux libpcap implementation, which, in 2.2 and later 1084 kernels, uses PF_PACKET sockets and supports kernel packet 1085 filtering (if compiled into the kernel), and supports the "any" 1086 device for capturing on all interfaces. Cleans up promiscuous 1087 mode better on pre-2.2 kernels, and has various other fixes 1088 (handles 2.4 ARPHRD_IEEE802_TR, handles ISDN devices better, 1089 doesn't show duplicate packets on loopback interface, etc.). 1090 1091 Fixed HP-UX libpcap implementation to correctly get the PPA for 1092 an interface, to allow interfaces to be opened by interface name. 1093 1094 libpcap savefiles have system-independent link-layer type values 1095 in the header, rather than sometimes platform-dependent DLT_ 1096 values, to make it easier to exchange capture files between 1097 different OSes. 1098 1099 Non-standard capture files produced by some Linux tcpdumps, e.g. 1100 the one from Red Hat Linux 6.2 and later, can now be read. 1101 1102 Updated autoconf stock files. 1103 1104 Filter expressions can filter on VLAN IDs and various OSI 1105 protocols, and work on Token Ring (with non-source-routed 1106 packets). 1107 1108 "pcap_open_dead()" added to allow compiling filter expressions 1109 to pcap code without opening a capture device or capture file. 1110 1111 Header files fixed to allow use in C++ programs. 1112 1113 Removed dependency on native headers for packet layout. 1114 Removed Linux specific headers that were shipped. 1115 1116 Security fixes: Strcpy replaced with strlcpy, sprintf replaced 1117 with snprintf. 1118 1119 Fixed bug that could cause subsequent "pcap_compile()"s to fail 1120 erroneously after one compile failed. 1121 1122 Assorted other bug fixes. 1123 1124 README.aix and README.linux files added to describe 1125 platform-specific issues. 1126 1127 "getifaddrs()" rather than SIOCGIFCONF used, if available. 1128 1129v0.5 Sat Jun 10 11:09:15 PDT 2000 1130 1131itojun@iijlab.net 1132- Brought in KAME IPv6/IPsec bpf compiler. 1133- Fixes for NetBSD. 1134- Support added for OpenBSD DLT_LOOP and BSD/OS DLT_C_HDLC (Cisco HDLC), 1135 and changes to work around different BSDs having different DLT_ types 1136 with the same numeric value. 1137 1138Assar Westerlund <assar@sics.se> 1139- Building outside the source code tree fixed. 1140- Changed to write out time stamps with 32-bit seconds and microseconds 1141 fields, regardless of whether those fields are 32 bits or 64 bits in 1142 the OS's native "struct timeval". 1143- Changed "pcap_lookupdev()" to dynamically grow the buffer into which 1144 the list of interfaces is read as necessary in order to hold the 1145 entire list. 1146 1147Greg Troxel <gdt@ir.bbn.com> 1148- Added a new "pcap_compile_nopcap()", which lets you compile a filter 1149 expression into a BPF program without having an open live capture or 1150 capture file. 1151 1152v0.4 Sat Jul 25 12:40:09 PDT 1998 1153 1154- Fix endian problem with DLT_NULL devices. From FreeBSD via Bill 1155 Fenner (fenner@parc.xerox.com) 1156 1157- Fix alignment problem with FDDI under DLPI. This was causing core 1158 dumps under Solaris. 1159 1160- Added configure options to disable flex and bison. Resulted from a 1161 bug report by barnett@grymoire.crd.ge.com (Bruce Barnett). Also added 1162 options to disable gcc and to force a particular packet capture type. 1163 1164- Added support for Fore ATM interfaces (qaa and fa) under IRIX. Thanks 1165 to John Hawkinson (jhawk@mit.edu) 1166 1167- Change Linux PPP and SLIP to use DLT_RAW since the kernel does not 1168 supply any "link layer" data. 1169 1170- Change Linux to use SIOCGIFHWADDR ioctl to determine link layer type. 1171 Thanks to Thomas Sailer (sailer@ife.ee.ethz.ch) 1172 1173- Change IRIX PPP to use DLT_RAW since the kernel does not supply any 1174 "link layer" data. 1175 1176- Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 1177 formats. 1178 1179- Added some new SGI snoop interface types. Thanks to Steve Alexander 1180 (sca@refugee.engr.sgi.com) 1181 1182- Fixes for HP-UX 10.20 (which is similar to HP-UX 9). Thanks to 1183 Richard Allen (ra@hp.is) and Steinar Haug (sthaug@nethelp.no) 1184 1185- Fddi supports broadcast as reported by Jeff Macdonald 1186 (jeff@iacnet.com). Also correct ieee802 and arcnet. 1187 1188- Determine Linux pcap buffer size at run time or else it might not be 1189 big enough for some interface types (e.g. FDDI). Thanks to Jes 1190 Sorensen (Jes.Sorensen@cern.ch) 1191 1192- Fix some linux alignment problems. 1193 1194- Document promisc argument to pcap_open_live(). Reported by Ian Marsh 1195 (ianm@sics.se) 1196 1197- Support Metricom radio packets under Linux. Thanks to Kevin Lai 1198 (laik@gunpowder.stanford.edu) 1199 1200- Bind to interface name under Linux to avoid packets from multiple 1201 interfaces on multi-homed hosts. Thanks to Kevin Lai 1202 (laik@gunpowder.stanford.edu) 1203 1204- Change L_SET to SEEK_SET for HP-UX. Thanks to Roland Roberts 1205 (rroberts@muller.com) 1206 1207- Fixed an uninitialized memory reference found by Kent Vander Velden 1208 (graphix@iastate.edu) 1209 1210- Fixed lex pattern for IDs to allow leading digits. As reported by 1211 Theo de Raadt (deraadt@cvs.openbsd.org) 1212 1213- Fixed Linux include file problems when using GNU libc. 1214 1215- Ifdef ARPHRD_FDDI since not all versions of the Linux kernel have it. 1216 Reported reported by Eric Jacksch (jacksch@tenebris.ca) 1217 1218- Fixed bug in pcap_dispatch() that kept it from returning on packet 1219 timeouts. 1220 1221- Changed ISLOOPBACK() macro when IFF_LOOPBACK isn't available to check 1222 for "lo" followed by an eos or digit (newer versions of Linux 1223 apparently call the loopback "lo" instead of "lo0"). 1224 1225- Fixed Linux networking include files to use ints instead of longs to 1226 avoid problems with 64 bit longs on the alpha. Thanks to Cristian 1227 Gafton (gafton@redhat.com) 1228 1229v0.3 Sat Nov 30 20:56:27 PST 1996 1230 1231- Added Linux support. 1232 1233- Fixed savefile bugs. 1234 1235- Solaris x86 fix from Tim Rylance (t.rylance@elsevier.nl) 1236 1237- Add support for bpf kernel port filters. 1238 1239- Remove duplicate atalk protocol table entry. Thanks to Christian 1240 Hopps (chopps@water.emich.edu) 1241 1242- Fixed pcap_lookupdev() to ignore nonexistent devices. This was 1243 reported to happen under BSD/OS by David Vincenzetti 1244 (vince@cryptonet.it) 1245 1246- Avoid solaris compiler warnings. Thanks to Bruce Barnett 1247 (barnett@grymoire.crd.ge.com) 1248 1249v0.2.1 Sun Jul 14 03:02:26 PDT 1996 1250 1251- Fixes for HP-UX 10. Thanks in part to Thomas Wolfram 1252 (wolf@prz.tu-berlin.de) and Rick Jones (raj@hpisrdq.cup.hp.com) 1253 1254- Added support for SINIX. Thanks to Andrej Borsenkow 1255 (borsenkow.msk@sni.de) 1256 1257- Fixes for AIX (although this system is not yet supported). Thanks to 1258 John Hawkinson (jhawk@mit.edu) 1259 1260- Use autoconf's idea of the top level directory in install targets. 1261 Thanks to John Hawkinson. 1262 1263- Add missing autoconf packet capture result message. Thanks to Bill 1264 Fenner (fenner@parc.xerox.com) 1265 1266- Fixed padding problems in the pf module. 1267 1268- Fixed some more alignment problems on the alpha. 1269 1270- Added explicit netmask support. Thanks to Steve Nuchia 1271 (steve@research.oknet.com) 1272 1273- Fixed to handle raw ip addresses such as 0.0.0.1 without "left 1274 justifing" 1275 1276- Add "sca" keyword (for DEC cluster services) as suggested by Terry 1277 Kennedy (terry@spcvxa.spc.edu) 1278 1279- Add "atalk" keyword as suggested by John Hawkinson. 1280 1281- Add "igrp" keyword. 1282 1283- Fixed HID definition in grammar.y to be a string, not a value. 1284 1285- Use $CC when checking gcc version. Thanks to Carl Lindberg 1286 (carl_lindberg@blacksmith.com) 1287 1288- Removed obsolete reference to pcap_immediate() from the man page. 1289 Michael Stolarchuk (mts@terminator.rs.itd.umich.edu) 1290 1291- DLT_NULL has a 4 byte family header. Thanks to Jeffrey Honig 1292 (jch@bsdi.com) 1293 1294v0.2 Sun Jun 23 02:28:42 PDT 1996 1295 1296- Add support for HP-UX. Resulted from code contributed by Tom Murray 1297 (tmurray@hpindck.cup.hp.com) and Philippe-Andri Prindeville 1298 (philipp@res.enst.fr) 1299 1300- Update INSTALL with a reminder to install include files. Thanks to 1301 Mark Andrews (mandrews@aw.sgi.com) 1302 1303- Fix bpf compiler alignment bug on the alpha. 1304 1305- Use autoconf to detect architectures that can't handle misaligned 1306 accesses. 1307 1308- Added loopback support for snoop. Resulted from report Steve 1309 Alexander (sca@engr.sgi.com) 1310 1311v0.1 Fri Apr 28 18:11:03 PDT 1995 1312 1313- Fixed compiler and optimizer bugs. The BPF filter engine uses unsigned 1314 comparison operators, while the code generator and optimizer assumed 1315 signed semantics in several places. Thanks to Charlie Slater 1316 (cslater@imatek.com) for pointing this out. 1317 1318- Removed FDDI ifdef's, they aren't really needed. Resulted from report 1319 by Gary Veum (veum@boa.gsfc.nasa.gov). 1320 1321- Add pcap-null.c which allows offline use of libpcap on systems that 1322 don't support live package capture. This feature resulting from a 1323 request from Jan van Oorschot (j.p.m.voorschot@et.tudelft.nl). 1324 1325- Make bpf_compile() reentrant. Fix thanks to Pascal Hennequin 1326 (Pascal.Hennequin@hugo.int-evry.fr). 1327 1328- Port to GNU autoconf. 1329 1330- Fix pcap-dlpi.c to work with isdn. Resulted from report by Flemming 1331 Johansen (fsj@csd.cri.dk). 1332 1333- Handle multi-digit interface unit numbers (aka ppa's) under dlpi. 1334 Resulted from report by Daniel Ehrlich (ehrlich@cse.psu.edu). 1335 1336- Fix pcap-dlpi.c to work in non-promiscuous mode. Resulted from report 1337 by Jeff Murphy (jcmurphy@acsu.buffalo.edu). 1338 1339- Add support for "long jumps". Thanks to Jeffrey Mogul 1340 (mogul@pa.dec.com). 1341 1342- Fix minor problems when compiling with BDEBUG as noticed by Scott 1343 Bertilson (scott@unet.umn.edu). 1344 1345- Declare sys_errlist "const char *const" to avoid problems under 1346 FreeBSD. Resulted from report by jher@eden.com. 1347 1348v0.0.6 Fri Apr 28 04:07:13 PDT 1995 1349 1350- Add missing variable declaration missing from 0.0.6 1351 1352v0.0.5 Fri Apr 28 00:22:21 PDT 1995 1353 1354- Workaround for problems when pcap_read() returns 0 due to the timeout 1355 expiring. 1356 1357v0.0.4 Thu Apr 20 20:41:48 PDT 1995 1358 1359- Change configuration to not use gcc v2 flags with gcc v1. 1360 1361- Fixed a bug in pcap_next(); if pcap_dispatch() returns 0, pcap_next() 1362 should also return 0. Thanks to Richard Stevens (rstevens@noao.edu). 1363 1364- Fixed configure to test for snoop before dlpi to avoid problems under 1365 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). 1366 1367- Hack around deficiency in Ultrix's make. 1368 1369- Fix two bugs related to the Solaris pre-5.3.2 bufmod bug; handle 1370 savefiles that have more than snapshot bytes of data in them (so we 1371 can read old savefiles) and avoid writing such files. 1372 1373- Added checkioctl which is used with gcc to check that the 1374 "fixincludes" script has been run. 1375 1376v0.0.3 Tue Oct 18 18:13:46 PDT 1994 1377 1378- Fixed configure to test for snoop before dlpi to avoid problems under 1379 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). 1380 1381v0.0.2 Wed Oct 12 20:56:37 PDT 1994 1382 1383- Implement timeout in the dlpi pcap_open_live(). Thanks to Richard 1384 Stevens. 1385 1386- Determine pcap link type from dlpi media type. Resulted from report 1387 by Mahesh Jethanandani (mahesh@npix.com). 1388 1389v0.0.1 Fri Jun 24 14:50:57 PDT 1994 1390 1391- Fixed bug in nit_setflags() in pcap-snit.c. The streams ioctl timeout 1392 wasn't being initialized sometimes resulting in an "NIOCSFLAGS: 1393 Invalid argument" error under OSF/1. Reported by Matt Day 1394 (mday@artisoft.com) and Danny Mitzel (dmitzel@whitney.hitc.com). 1395 1396- Turn on FDDI support by default. 1397 1398v0.0 Mon Jun 20 19:20:16 PDT 1994 1399 1400- Initial release. 1401 1402- Fixed bug with greater/less keywords, reported by Mark Andrews 1403 (mandrews@alias.com). 1404 1405- Fix bug where '|' was defined as BPF_AND instead of BPF_OR, reported 1406 by Elan Amir (elan@leeb.cs.berkeley.edu). 1407 1408- Machines with little-endian byte ordering are supported thanks to 1409 Jeff Mogul. 1410 1411- Add hack for version 2.3 savefiles which don't have caplen and len 1412 swapped thanks to Vern Paxson. 1413 1414- Added "&&" and "||" aliases for "and" and "or" thanks to Vern Paxson. 1415 1416- Added length, inbound and outbound keywords. 1417