1Thursday February 19, 2013 guy@alum.mit.edu. 2 Summary for 4.4.0 tcpdump release 3 RPKI-RTR (RFC6810) is now official (TCP Port 323) 4 Fix detection of OpenSSL libcrypto. 5 Add DNSSL (RFC6106) support. 6 Add "radius" as an option for -T. 7 Update Action codes for handle_action function according to 8 802.11s amendment. 9 Decode DHCPv6 AFTR-Name option (RFC6334). 10 Updates for Babel. 11 Fix printing of infinite lifetime in ICMPv6. 12 Added support for SPB, SPBM Service Identifier, and Unicast 13 Address sub-TLV in ISIS. 14 Decode RIPv2 authentication up to RFC4822. 15 Fix RIP Request/full table decoding issues. 16 On Linux systems with cap-ng.h, drop root privileges 17 using Linux Capabilities. 18 Add support for reading multiple files. 19 20Wednesday November 28, 2012 guy@alum.mit.edu. 21 Summary for 4.3.1 tcpdump release 22 Print "LLDP, length N" for LLDP packets even when not in verbose 23 mode, so something is printed even if only the timestamp is 24 present 25 Document "-T carp" 26 Print NTP poll interval correctly (it's an exponent, so print 27 both its raw value and 2^value) 28 Document that "-e" is used to get MAC addresses 29 More clearly document that you need to escape or quote 30 backslashes in filter expressions on the command line 31 Fix some "the the" in the man page 32 Use the right maximum path length 33 Don't treat 192_1_2, when passed to -i, as an interface number 34 35Friday April 3, 2011. mcr@sandelman.ca. 36 Summary for 4.3.0 tcpdump release 37 fixes for forces: SPARSE data (per RFC 5810) 38 some more test cases added 39 updates to documentation on -l, -U and -w flags. 40 Fix printing of BGP optional headers. 41 Tried to include DLT_PFSYNC support, failed due to headers required. 42 added TIPC support. 43 Fix LLDP Network Policy bit definitions. 44 fixes for IGMPv3's Max Response Time: it is in units of 0.1 second. 45 SIGUSR1 can be used rather than SIGINFO for stats 46 permit -n flag to affect print-ip for protocol numbers 47 ND_OPT_ADVINTERVAL is in milliseconds, not seconds 48 Teach PPPoE parser about RFC 4638 49 50 51Friday December 9, 2011. guy@alum.mit.edu. 52 Summary for 4.2.1 tcpdump release 53 Only build the Babel printer if IPv6 is enabled. 54 Support Babel on port 6696 as well as 6697. 55 Include ppi.h in release tarball. 56 Include all the test files in the release tarball, and don't 57 "include" test files that no longer exist. 58 Don't assume we have <rpc/rpc.h> - check for it. 59 Support "-T carp" as a way of dissecting IP protocol 112 as CARP 60 rather than VRRP. 61 Support Hilscher NetAnalyzer link-layer header format. 62 Constify some pointers and fix compiler warnings. 63 Get rid of never-true test. 64 Fix an unintended fall-through in a case statement in the ARP 65 printer. 66 Fix several cases where sizeof(sizeof(XXX)) was used when just 67 sizeof(XXX) was intended. 68 Make stricter sanity checks in the ES-IS printer. 69 Get rid of some GCCisms that caused builds to fai with compilers 70 that don't support them. 71 Fix typo in man page. 72 Added length checks to Babel printer. 73 74Sunday July 24, 2011. mcr@sandelman.ca. 75 Summary for 4.2.+ 76 merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov 77 at gmail dot com> 78 updates to forces for new port numbers 79 Use "-H", not "-h", for the 802.11s option. (-h always help) 80 Better ICMPv6 checksum handling. 81 add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12 82 get rid of uuencoded pcap test files, git can do binary. 83 sFlow changes for 64-bit counters. 84 fixes for PPI packet header handling and printing. 85 Add DCB Exchange protocol (DCBX) version 1.01. 86 Babel dissector, from Juliusz Chroboczek and Grégoire Henry. 87 improvements to radiotap for rate values > 127. 88 Many improvements to ForCES decode, including fix SCTP TML port 89 updated RPL type code to RPL-17 draft 90 Improve printout of DHCPv6 options. 91 added support and test case for QinQ (802.1q VLAN) packets 92 Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4. 93 Build fixes for Sparc and other machines with alignment restrictions. 94 Merged changes from Debian package. 95 PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options. 96 Build fixes for OSX (Snow Leopard and others) 97 Add support for IEEE 802.15.4 packets 98 99Tue. July 20, 2010. guy@alum.mit.edu. 100 Summary for 4.1.2 tcpdump release 101 If -U is specified, flush the file after creating it, so it's 102 not zero-length 103 Fix TCP flags output description, and some typoes, in the man 104 page 105 Add a -h flag, and only attempt to recognize 802.11s mesh 106 headers if it's set 107 When printing the link-layer type list, send *all* output to 108 stderr 109 Include the CFLAGS setting when configure was run in the 110 compiler flags 111 112Thu. April 1, 2010. guy@alum.mit.edu. 113 Summary for 4.1.1 tcpdump release 114 Fix build on systems with PF, such as FreeBSD and OpenBSD. 115 Don't blow up if a zero-length link-layer address is passed to 116 linkaddr_string(). 117 118Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu. 119 Summary for 4.1.0 tcpdump release 120 Fix printing of MAC addresses for VLAN frames with a length 121 field 122 Add some additional bounds checks and use the EXTRACT_ macros 123 more 124 Add a -b flag to print the AS number in BGP packets in ASDOT 125 notation rather than ASPLAIN notation 126 Add ICMPv6 RFC 5006 support 127 Decode the access flags in NFS access requests 128 Handle the new DLT_ for memory-mapped USB captures on Linux 129 Make the default snapshot (-s) the maximum 130 Print name of device (when -L is used) 131 Support for OpenSolaris (and SXCE build 125 and later) 132 Print new TCP flags 133 Add support for RPL DIO 134 Add support for TCP User Timeout (UTO) 135 Add support for non-standard Ethertypes used by 3com PPPoE gear 136 Add support for 802.11n and 802.11s 137 Add support for Transparent Ethernet Bridge ethertype in GRE 138 Add 4 byte AS support for BGP printer 139 Add support for the MDT SAFI 66 BG printer 140 Add basic IPv6 support to print-olsr 141 Add USB printer 142 Add printer for ForCES 143 Handle frames with an FCS 144 Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames 145 Fix TCP sequence number printing 146 Report 802.2 packets as 802.2 instead of 802.3 147 Don't include -L/usr/lib in LDFLAGS 148 On x86_64 Linux, look in lib64 directory too 149 Lots of code clean ups 150 Autoconf clean ups 151 Update testcases to make output changes 152 Fix compiling with/out smi (--with{,out}-smi) 153 Fix compiling without IPv6 support (--disable-ipv6) 154 155Mon. October 27, 2008. ken@netfunctional.ca. Summary for 4.0.0 tcpdump release 156 Add support for Bluetooth Sniffing 157 Add support for Realtek Remote Control Protocol (openrrcp.org.ru) 158 Add support for 802.11 AVS 159 Add support for SMB over TCP 160 Add support for 4 byte BGP AS printing 161 Add support for compiling on case-insensitive file systems 162 Add support for ikev2 printing 163 Update support for decoding AFS 164 Update DHCPv6 printer 165 Use newer libpcap API's (allows -B option on all platforms) 166 Add -I to turn on monitor mode 167 Bugfixes in lldp, lspping, dccp, ESP, NFS printers 168 Cleanup unused files and various cruft 169 170Mon. September 10, 2007. ken@xelerance.com. Summary for 3.9.8 tcpdump release 171 Rework ARP printer 172 Rework OSPFv3 printer 173 Add support for Frame-Relay ARP 174 Decode DHCP Option 121 (RFC 3442 Classless Static Route) 175 Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121 176 TLV: Add support for Juniper .pcap extensions 177 Print EGP header in new-world-order style 178 Converted print-isakmp.c to NETDISSECT 179 Moved AF specific stuff into af.h 180 Test subsystem now table driven, and saves outputs and diffs to one place 181 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 182 libpcap files on an OS other than where the file was generated 183 184 185Wed. July 23, 2007. mcr@xelerance.com. Summary for 3.9.7 libpcap release 186 187 NFS: Print unsigned values as such. 188 RX: parse safely. 189 BGP: fixes for IPv6-less builds. 190 801.1ag: use standard codepoint. 191 use /dev/bpf on systems with such a device. 192 802.11: print QoS data, avoid dissect of no-data frame, ignore padding. 193 smb: make sure that we haven't gone past the end of the captured data. 194 smb: squelch an uninitialized complaint from coverity. 195 NFS: from NetBSD; don't interpret the reply as a possible NFS reply 196 if it got MSG_DENIED. 197 BGP: don't print TLV values that didn't fit, from www.digit-labs.org. 198 revised INSTALL.txt about libpcap dependancy. 199 200Wed. April 25, 2007. ken@xelerance.com. Summary for 3.9.6 tcpdump release 201 Update man page to reflect changes to libpcap 202 Changes to both TCP and IP Printer Output 203 Fix a potential buffer overflow in the 802.11 printer 204 Print basic info about a few more Cisco LAN protocols. 205 mDNS cleanup 206 ICMP MPLS rework of the extension code 207 bugfix: use the correct codepoint for the OSPF simple text auth token 208 entry, and use safeputs to print the password. 209 Add support in pflog for additional values 210 Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects 211 Add support for the Message-id NACK c-type. 212 Add support for 802.3ah loopback ctrl msg 213 Add support for Multiple-STP as per 802.1s 214 Add support for rapid-SPT as per 802.1w 215 Add support for CFM Link-trace msg, Link-trace-Reply msg, 216 Sender-ID tlv, private tlv, port, interface status 217 Add support for unidirectional link detection as per 218 http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt 219 Add support for the olsr protocol as per RFC 3626 plus the LQ 220 extensions from olsr.org 221 Add support for variable-length checksum in DCCP, as per section 9 of 222 RFC 4340. 223 Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree 224 Add support for Multiple-STP as per 802.1s 225 Add support for the cisco propriatry 'dynamic trunking protocol' 226 Add support for the cisco proprietary VTP protocol 227 Update dhcp6 options table as per IETF standardization activities 228 229 230Tue. September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release 231 232 Fix compiling on AIX (, at end of ENUM) 233 Updated list of DNS RR typecodes 234 Use local Ethernet defs on WIN32 235 Add support for Frame-Relay ARP 236 Fixes for compiling under MSVC++ 237 Add support for parsing Juniper .pcap files 238 Add support for FRF.16 Multilink Frame-Relay (DLT_MFR) 239 Rework the OSPFv3 printer 240 Fix printing for 4.4BSD/NetBSD NFS Filehandles 241 Add support for Cisco style NLPID encapsulation 242 Add cisco prop. eigrp related, extended communities 243 Add support for BGP signaled VPLS 244 Cleanup the bootp printer 245 Add support for PPP over Frame-Relay 246 Add some bounds checking to the IP options code, and clean up 247 the options output a bit. 248 Add additional modp groups to ISAKMP printer 249 Add support for Address-Withdraw and Label-Withdraw Msgs 250 Add support for the BFD Discriminator TLV 251 Fixes for 64bit compiling 252 Add support for PIMv2 checksum verification 253 Add support for further dissection of the IPCP Compression Option 254 Add support for Cisco's proposed VQP protocol 255 Add basic support for keyed authentication TCP option 256 Lots of minor cosmetic changes to output printers 257 258 259Mon. September 19, 2005. ken@xelerance.com. Summary for 3.9.4 tcpdump release 260 Decoder support for more Juniper link-layer types 261 Fix a potential buffer overflow (although it can't occur in 262 practice). 263 Fix the handling of unknown management frame types in the 802.11 264 printer. 265 Add FRF.16 support, fix various Frame Relay bugs. 266 Add support for RSVP integrity objects, update fast-reroute 267 object printer to latest spec. 268 Clean up documentation of vlan filter expression, document mpls 269 filter expression. 270 Document new pppoed and pppoes filter expressions. 271 Update diffserver-TE codepoints as per RFC 4124. 272 Spelling fixes in ICMPv6. 273 Don't require any fields other than flags to be present in IS-IS 274 restart signaling TLVs, and only print the system ID in 275 those TLVs as system IDs, not as node IDs. 276 Support for DCCP. 277 278Tue. July 5, 2005. ken@xelerance.com. Summary for 3.9.3 tcpdump release 279 280 Option to chroot() when dropping privs 281 Fixes for compiling on nearly every platform, 282 including improved 64bit support 283 Many new testcases 284 Support for sending packets 285 Many compliation fixes on most platforms 286 Fixes for recent version of GCC to eliminate warnings 287 Improved Unicode support 288 289 Decoders & DLT Changes, Updates and New: 290 AES ESP support 291 Juniper ATM, FRF.15, FRF.16, PPPoE, 292 ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC 293 GGSN,ES,MONITOR,SERVICES 294 L2VPN 295 Axent Raptor/Symantec Firewall 296 TCP-MD5 (RFC 2385) 297 ESP-in-UDP (RFC 3948) 298 ATM OAM 299 LMP, LMP Service Discovery 300 IP over FC 301 IP over IEEE 1394 302 BACnet MS/TP 303 SS7 304 LDP over TCP 305 LACP, MARKER as per 802.3ad 306 PGM (RFC 3208) 307 LSP-PING 308 G.7041/Y.1303 Generic Framing Procedure 309 EIGRP-IP, EIGRP-IPX 310 ICMP6 311 Radio - via radiotap 312 DHCPv6 313 HDLC over PPP 314 315Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release 316 317 No changes from 3.8.2. Version bumped only to maintain consistency 318 with libpcap 0.8.3. 319 320Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release 321 322 Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184 323 http://www.rapid7.com/advisories/R7-0017.html 324 IP-over-IEEE1394 printing. 325 some MINGW32 changes. 326 updates for autoconf 2.5 327 fixes for print-aodv.c - check for too short packets 328 formatting changes to print-ascii for hex output. 329 check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c, 330 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c, 331 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c, 332 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c 333 print-ether.c - better handling of unknown types. 334 print-isoclns.c - additional decoding of types. 335 print-llc.c - strings for LLC names added. 336 print-pfloc.c - various enhancements 337 print-radius.c - better decoding to strings. 338 339Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release 340 341 changed syntax of -E argument so that multiple SAs can be decrypted 342 fixes for Digital Unix headers and Documentation 343 __attribute__ fixes 344 CDP changes from Terry Kennedy <terry@tmk.com>. 345 IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com> 346 Fixes for ASN.1 decoder for 2.100.3 forms. 347 Added a count of packets received and processed to clarify numbers. 348 Incorporated WinDUMP patches for Win32 builds. 349 PPPoE payload length headers. 350 Fixes for HP C compiler builds. 351 Use new pcap_breakloop() and pcap_findalldevs() if we can. 352 BGP output split into multiple lines. 353 Fixes to 802.11 decoding. 354 Fixes to PIM decoder. 355 SuperH is a CPU that can't handle unaligned access. Many fixes for 356 unaligned access work. 357 Fixes to Frame-Relay decoder for Q.933/922 frames. 358 Clarified when Solaris can do captures as non-root. 359 Added tests/ subdir for examples/regression tests. 360 New -U flag. -flush stdout after every packet 361 New -A flag -print ascii only 362 support for decoding IS-IS inside Cisco HDLC Frames 363 more verbosity for tftp decoder 364 mDNS decoder 365 new BFD decoder 366 cross compilation patches 367 RFC 3561 AODV support. 368 UDP/TCP pseudo-checksum properly for source-route options. 369 sanitized all files to modified BSD license 370 Add support for RFC 2625 IP-over-Fibre Channel. 371 fixes for DECnet support. 372 Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI. 373 RFC 2684 encapsulation of BPDUs. 374 375Tuesday, February 25, 2003. fenner@research.att.com. 3.7.2 release 376 377 Fixed infinite loop when parsing malformed isakmp packets. 378 (reported by iDefense; already fixed in CVS) 379 Fixed infinite loop when parsing malformed BGP packets. 380 Fixed buffer overflow with certain malformed NFS packets. 381 Pretty-print unprintable network names in 802.11 printer. 382 Handle truncated nbp (appletalk) packets. 383 Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt 384 Print IP protocol name even if we don't have a printer for it. 385 Print IP protocol name or number for fragments. 386 Print the whole MPLS label stack, not just the top label. 387 Print request header and file handle for NFS v3 FSINFO and PATHCONF 388 requests. 389 Fix NFS packet truncation checks. 390 Handle "old" DR-Priority and Bidir-Capable PIM HELLO options. 391 Handle unknown RADIUS attributes properly. 392 Fix an ASN.1 parsing error that would cause e.g. the OID 393 2.100.3 to be misrepresented as 4.20.3 . 394 395Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release 396see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log. 397 keyword "ipx" added. 398 Better OSI/802.2 support on Linux. 399 IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net. 400 LLC SAP support for FDDI/token ring/RFC-1483 style ATM 401 BXXP protocol was replaced by the BEEP protocol; 402 improvements to SNAP demux. 403 Changes to "any" interface documentation. 404 Documentation on pcap_stats() counters. 405 Fix a memory leak found by Miklos Szeredi - pcap_ether_aton(). 406 Added MPLS encapsulation decoding per RFC3032. 407 DNS dissector handles TKEY, TSIG and IXFR. 408 adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org> 409 SMB printing has much improved bounds checks 410 OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging 411 Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>. 412 Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net> 413 IPX socket 0x85be is for Cisco EIGRP over IPX. 414 Improvements to fragmented ESP handling. 415 SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu> 416 Linux ARPHDR_ATM support fixed. 417 Added a "netbeui" keyword, which selects NetBEUI packets. 418 IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option. 419 Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>. 420 Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm" 421 Better Linux libc5 compat. 422 BIND9 lwres dissector added. 423 MIPS and SPARC get strict alignment macros (affects print-bgp.c) 424 Apple LocalTalk LINKTYPE_ reserved. 425 New time stamp formats documented. 426 DHCP6 updated to draft-22.txt spec. 427 ICMP types/codes now accept symbolic names. 428 Add SIGINFO handler from LBL 429 encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>. 430 now we are -Wstrict-prototype clean. 431 NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>. 432 PPPoE dissector cleaned up. 433 Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>. 434 In dissector, now the caller prints the IP addresses rather than proto. 435 cjclark@alum.mit.edu: print the IP proto for non-initial fragments. 436 LLC frames with a DSAP and LSAP of 0xe0 are IPX frames. 437 Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX. 438 captures on the "any" device won't be done in promiscuous mode 439 Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl> 440 ARCNet support, from NetBSD. 441 HSRP dissector, from Julian Cowley <julian@lava.net>. 442 Handle (GRE-encapsulated) PPTP 443 added -C option to rotate save file every optarg * 1,000,000 bytes. 444 support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>. 445 PPTP support, from Motonori Shindo <mshindo@mshindo.net>. 446 IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>. 447 CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>. 448 ESP printing updated to RFC2406. 449 HP-UX can now handle large number of PPAs. 450 MSDP printer added. 451 L2TP dissector improvements from Motonori Shindo. 452 453Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release 454 Cleaned up documentation. 455 Promisc mode fixes for Linux 456 IPsec changes/cleanups. 457 Alignment fixes for picky architectures 458 459 Removed dependency on native headers for packet dissectors. 460 Removed Linux specific headers that were shipped 461 462 libpcap changes provide for exchanging capture files between 463 systems. Save files now have well known PACKET_ values instead of 464 depending upon system dependant mappings of DLT_* types. 465 466 Support for computing/checking IP and UDP/TCP checksums. 467 468 Updated autoconf stock files. 469 470 IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6, 471 472 Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp, 473 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk 474 475 Added filtering support for: VLANs, ESIS, ISIS 476 477 Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP, 478 L2TP, PPPoE 479 480 HP-UX 11.0 -- find the right dlpi device. 481 Solaris 8 - IPv6 works 482 Linux - Added support for an "any" device to capture on all interfaces 483 484 Security fixes: buffer overrun audit done. Strcpy replaced with 485 strlcpy, sprintf replaced with snprintf. 486 Look for lex problems, and warn about them. 487 488 489v3.5 Fri Jan 28 18:00:00 PST 2000 490 491Bill Fenner <fenner@research.att.com> 492- switch to config.h for autoconf 493- unify RCSID strings 494- Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser 495- Really fix the RIP printer 496- Fix MAC address -> name translation. 497- some -Wall -Wformat fixes 498- update makemib to parse much of SMIv2 499- Print TCP sequence # with -vv even if you normally wouldn't 500- Print as much of IP/TCP/UDP headers as possible even if truncated. 501 502itojun@iijlab.net 503- -X will make a ascii dump. from netbsd. 504- telnet command sequence decoder (ff xx xx). from netbsd. 505- print-bgp.c: improve options printing. ugly code exists for 506 unaligned option parsing (need some fix). 507- const poisoning in SMB decoder. 508- -Wall -Werror clean checks. 509- bring in KAME IPv6/IPsec decoding code. 510 511Assar Westerlund <assar@sics.se> 512- SNMPv2 and SNMPv3 printer 513- If compiled with libsmi, tcpdump can load MIBs on the fly to decode 514 SNMP packets. 515- Incorporate NFS parsing code from NetBSD. Adds support for nfsv3. 516- portability fixes 517- permit building in different directories. 518 519Ken Hornstein <kenh@cmf.nrl.navy.mil> 520- bring in code at 521 /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing 522 AFS3 packets 523 524Andrew Tridgell <tridge@linuxcare.com> 525- SMB printing code 526 527Love <lha@stacken.kth.se> 528- print-rx.c: add code for printing MakeDir and StoreStatus. Also 529 change date format to the right one. 530 531Michael C. Richardson <mcr@sandelman.ottawa.on.ca> 532- Created tcpdump.org repository 533 534v3.4 Sat Jul 25 12:40:55 PDT 1998 535 536- Hardwire Linux slip support since it's too hard to detect. 537 538- Redo configuration of "network" libraries (-lsocket and -lnsl) to 539 deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu) 540 541- Added -a which tries to translate network and broadcast addresses to 542 names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl) 543 544- Added a configure option to disable gcc. 545 546- Added a "raw" packet printer. 547 548- Not having an interface address is no longer fatal. Requested by John 549 Hawkinson. 550 551- Rework signal setup to accommodate Linux. 552 553- OSPF truncation check fix. Also display the type of OSPF packets 554 using MD5 authentication. Thanks to Brian Wellington 555 (bwelling@tis.com) 556 557- Fix truncation check bugs in the Kerberos printer. Reported by Ezra 558 Peisach (epeisach@mit.edu) 559 560- Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka 561 (plonka@mfa.com) 562 563- Specify full install target as a way of detecting if install 564 directory does not exist. Thanks to Dave Plonka. 565 566- Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie 567 (paul@vix.com) 568 569- Fix off-by-one bug when testing size of ethernet packets. Thanks to 570 Marty Leisner (leisner@sdsp.mc.xerox.com) 571 572- Add a local autoconf macro to check for routines in libraries; the 573 autoconf version is broken (it only puts the library name in the 574 cache variable name). Thanks to John Hawkinson. 575 576- Add a local autoconf macro to check for types; the autoconf version 577 is broken (it uses grep instead of actually compiling a code fragment). 578 579- Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 580 formats. 581 582- Extend OSF ip header workaround to versions 1 and 2. 583 584- Fix some signed problems in the nfs printer. As reported by David 585 Sacerdote (davids@silence.secnet.com) 586 587- Detect group wheel and use it as the default since BSD/OS' install 588 can't hack numeric groups. Reported by David Sacerdote. 589 590- AIX needs special loader options. Thanks to Jonathan I. Kamens 591 (jik@cam.ov.com) 592 593- Fixed the nfs printer to print port numbers in decimal. Thanks to 594 Kent Vander Velden (graphix@iastate.edu) 595 596- Find installed libpcap in /usr/local/lib when not using gcc. 597 598- Disallow network masks with non-network bits set. 599 600- Attempt to detect "egcs" versions of gcc. 601 602- Add missing closing double quotes when displaying bootp strings. 603 Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca) 604 605v3.3 Sat Nov 30 20:56:27 PST 1996 606 607- Added Linux support. 608 609- GRE encapsulated packet printer thanks to John Hawkinson 610 (jhawk@mit.edu) 611 612- Rewrite gmt2local() to avoid problematic os dependencies. 613 614- Suppress nfs truncation message on errors. 615 616- Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro. 617 Reported by Joachim Ott (ott@ardala.han.de) 618 619- Enable "ip_hl vs. ip_vhl" workaround for OSF4 too. 620 621- Print arp hardware type in host order. Thanks to Onno van der Linden 622 (onno@simplex.nl) 623 624- Avoid solaris compiler warnings. Thanks to Bruce Barnett 625 (barnett@grymoire.crd.ge.com) 626 627- Fix rip printer to not print one more route than is actually in the 628 packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and 629 Bill Fenner (fenner@parc.xerox.com) 630 631- Use autoconf endian detection since BYTE_ORDER isn't defined on all systems. 632 633- Fix dvmrp printer truncation checks and add a dvmrp probe printer. 634 Thanks to Danny J. Mitzel (mitzel@ipsilon.com) 635 636- Rewrite ospf printer to improve truncation checks. 637 638- Don't parse tcp options past the EOL. As noted by David Sacerdote 639 (davids@secnet.com). Also, check tcp options to make sure they ar 640 actually in the tcp header (in addition to the normal truncation 641 checks). Fix the SACK code to print the N blocks (instead of the 642 first block N times). 643 644- Don't say really small UDP packets are truncated just because they 645 aren't big enough to be a RPC. As noted by David Sacerdote. 646 647v3.2.1 Sun Jul 14 03:02:26 PDT 1996 648 649- Added rfc1716 icmp codes as suggested by Martin Fredriksson 650 (martin@msp.se) 651 652- Print mtu for icmp unreach need frag packets. Thanks to John 653 Hawkinson (jhawk@mit.edu) 654 655- Decode icmp router discovery messages. Thanks to Jeffrey Honig 656 (jch@bsdi.com) 657 658- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida 659 (kushida@trl.ibm.co.jp) 660 661- Check igmp checksum if possible. Thanks to John Hawkinson. 662 663- Made changes for SINIX. Thanks to Andrej Borsenkow 664 (borsenkow.msk@sni.de) 665 666- Use autoconf's idea of the top level directory in install targets. 667 Thanks to John Hawkinson. 668 669- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey 670 Mogul (mogul@pa.dec.com) 671 672- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop. 673 Thanks to John Hawkinson. 674 675- Added some more packet truncation checks. 676 677- On systems that have it, use sigset() instead of signal() since 678 signal() has different semantics on these systems. 679 680- Fixed some more alignment problems on the alpha. 681 682- Add code to massage unprintable characters in the domain and ipx 683 printers. Thanks to John Hawkinson. 684 685- Added explicit netmask support. Thanks to Steve Nuchia 686 (steve@research.oknet.com) 687 688- Add "sca" keyword (for DEC cluster services) as suggested by Terry 689 Kennedy (terry@spcvxa.spc.edu) 690 691- Add "atalk" keyword as suggested by John Hawkinson. 692 693- Added an igrp printer. Thanks to Francis Dupont 694 (francis.dupont@inria.fr) 695 696- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry 697 Kennedy (terry@spcvxa.spc.edu) 698 699- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin 700 (pascal.hennequin@hugo.int-evry.fr) 701 702- Added some ETHERTYPEs missing on some systems. 703 704- Added truncated packet macros and various checks. 705 706- Fixed endian problems with the DECnet printer. 707 708- Use $CC when checking gcc version. Thanks to Carl Lindberg 709 (carl_lindberg@blacksmith.com) 710 711- Fixes for AIX (although this system is not yet supported). Thanks to 712 John Hawkinson. 713 714- Fix bugs in the autoconf misaligned accesses code fragment. 715 716- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to 717 Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp) 718 719v3.2 Sun Jun 23 02:28:10 PDT 1996 720 721- Print new icmp unreachable codes as suggested by Martin Fredriksson 722 (martin@msp.se). Also print code value when unknown for icmp redirect 723 and time exceeded. 724 725- Fix an alignment endian bug in getname(). Thanks to John Hawkinson. 726 727- Define "new" domain record types if not found in arpa/nameserv.h. 728 Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also 729 fixed an endian bug when printing mx record and added some new record 730 types. 731 732- Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com) 733 734- Added T/TCP options printing. As suggested by Richard Stevens 735 (rstevens@noao.edu) 736 737- Use autoconf to detect architectures that can't handle misaligned 738 accesses. 739 740v3.1 Thu Jun 13 20:59:32 PDT 1996 741 742- Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd 743 and bind (as suggested by Charles Hannum). 744 745- Port to GNU autoconf. 746 747- Add support for printing DVMRP and PIM traffic thanks to 748 Havard Eidnes (Havard.Eidnes@runit.sintef.no). 749 750- Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian 751 define being referenced. Reported by Terry Kennedy. 752 753- Minor fixes to the man page thanks to Mark Andrews. 754 755- Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah 756 (bmah@cs.berkeley.edu). 757 758- Added support for new dns types, thanks to Rainer Orth. 759 760- Fixed tftp_print() to print the block number for ACKs. 761 762- Document -dd and -ddd. Resulted from a bug report from Charlie Slater 763 (cslater@imatek.com). 764 765- Check return status from malloc/calloc/etc. 766 767- Check return status from pcap_loop() so we can print an error and 768 exit with a bad status if there were problems. 769 770- Bail if ip option length is <= 0. Resulted from a bug report from 771 Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au). 772 773- Print out a little more information for sun rpc packets. 774 775- Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu). 776 777- Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were 778 wrong on little endian machines). 779 780- Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford 781 (crawdad@fnal.gov). 782 783- Fix ntp_print() to not print garbage when the stratum is 784 "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com). 785 786- Rewrote tcp options printer code to check for truncation. Added 787 selective acknowledgment case. 788 789- Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig 790 (jch@bsdi.com) 791 792- Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one 793 octet for the sa_family member. Thanks to Yoshitaka Tokugawa 794 (toku@dit.co.jp) 795 796- Don't checksum ip header if we don't have all of it. Thanks to John 797 Hawkinson (jhawk@mit.edu). 798 799- Print out hostnames if possible in egp printer. Thanks to Jeffrey 800 Honig (jhc@bsdi.com) 801 802 803v3.1a1 Wed May 3 19:21:11 PDT 1995 804 805- Include time.h when SVR4 is defined to avoid problems under Solaris 806 2.3. 807 808- Fix etheraddr_string() in the ETHER_SERVICE to return the saved 809 strings, not the local buffer. Thanks to Stefan Petri 810 (petri@ibr.cs.tu-bs.de). 811 812- Detect when pcap raises the snaplen (e.g. with snit). Print a warning 813 that the selected value was not used. Thanks to Pascal Hennequin 814 (Pascal.Hennequin@hugo.int-evry.fr). 815 816- Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin. 817 818- BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu). 819 820v3.0.3 Sun Oct 1 18:35:00 GMT 1995 821 822- Although there never was a 3.0.3 release, the linux boys cleverly 823 "released" one in late 1995. 824 825v3.0.2 Thu Apr 20 21:28:16 PDT 1995 826 827- Change configuration to not use gcc v2 flags with gcc v1. 828 829- Redo gmt2local() so that it works under BSDI (which seems to return 830 an empty timezone struct from gettimeofday()). Based on report from 831 Terry Kennedy (terry@spcvxa.spc.edu). 832 833- Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based 834 on report from Mark Andrews (mandrews@alias.com). 835 836- Don't pass cc flags to gcc. Resulted from a bug report from Rainer 837 Orth (ro@techfak.uni-bielefeld.de). 838 839- Fixed printout of connection id for uncompressed tcp slip packets. 840 Resulted from a bug report from Richard Stevens (rstevens@noao.edu). 841 842- Hack around deficiency in Ultrix's make. 843 844- Add ETHERTYPE_TRAIL define which is missing from irix5. 845 846v3.0.1 Wed Aug 31 22:42:26 PDT 1994 847 848- Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4. 849 850v3.0 Mon Jun 20 19:23:27 PDT 1994 851 852- Added support for printing tcp option timestamps thanks to 853 Mark Andrews (mandrews@alias.com). 854 855- Reorganize protocol dumpers to take const pointers to packets so they 856 never change the contents (i.e., they used to do endian conversions 857 in place). Previously, whenever more than one pass was taken over 858 the packet, the packet contents would be dumped incorrectly (i.e., 859 the output form -x would be wrong on little endian machines because 860 the protocol dumpers would modify the data). Thanks to Charles Hannum 861 (mycroft@gnu.ai.mit.edu) for reporting this problem. 862 863- Added support for decnet protocol dumping thanks to Jeff Mogul 864 (mogul@pa.dec.com). 865 866- Fix bug that caused length of packet to be incorrectly printed 867 (off by ether header size) for unknown ethernet types thanks 868 to Greg Miller (gmiller@kayak.mitre.org). 869 870- Added support for IPX protocol dumping thanks to Brad Parker 871 (brad@fcr.com). 872 873- Added check to verify IP header checksum under -v thanks to 874 Brad Parker (brad@fcr.com). 875 876- Move packet capture code to new libpcap library (which is 877 packaged separately). 878 879- Prototype everything and assume an ansi compiler. 880 881- print-arp.c: Print hardware ethernet addresses if they're not 882 what we expect. 883 884- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags. 885 Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com). 886 887- print-fddi.c: Improvements. Thanks to Jeffrey Mogul 888 (mogul@pa.dec.com). 889 890- print-icmp.c: Byte swap netmask before printing. Thanks to 891 Richard Stevens (rstevens@noao.edu). Print icmp type when unknown. 892 893- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets. 894 By default, only the inner packet is dumped, appended with the token 895 "(encap)". Under -v, both the inner and output packets are dumped 896 (on the same line). Note that the filter applies to the original packet, 897 not the encapsulated packet. So if you run tcpdump on a net with an 898 IP Multicast tunnel, you cannot filter out the datagrams using the 899 conventional syntax. (You can filter away all the ip-in-ip traffic 900 with "not ip proto 4".) 901 902- print-nfs.c: Keep pending rpc's in circular table. Add generic 903 nfs header and remove os dependences. Thanks to Jeffrey Mogul. 904 905- print-ospf.c: Improvements. Thanks to Jeffrey Mogul. 906 907- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc" 908 (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords 909 Add && and || operators 910 911v2.2.1 Tue Jun 6 17:57:22 PDT 1992 912 913- Fix bug with -c flag. 914 915v2.2 Fri May 22 17:19:41 PDT 1992 916 917- savefile.c: Remove hack that shouldn't have been exported. Add 918 truncate checks. 919 920- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0' 921 matches non-echo/reply ICMP packets. 922 923- Many improvements to filter code optimizer. 924 925- Added 'multicast' keyword and extended the 'broadcast' keyword can now be 926 so that protocol qualifications are allowed. For example, "ip broadcast" 927 and "ether multicast" are valid filters. 928 929- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo'). 930 Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel 931 patches to netinet/if_loop.c. 932 933- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS. 934 Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs. 935 936- Added EGP and OSPF printers, thanks to Jeffrey Honig. 937 938v2.1 Tue Jan 28 11:00:14 PST 1992 939 940- Internal release (never publically exported). 941 942v2.0.1 Sun Jan 26 21:10:10 PDT 943 944- Various byte ordering fixes. 945 946- Add truncation checks. 947 948- inet.c: Support BSD style SIOCGIFCONF. 949 950- nametoaddr.c: Handle multi addresses for single host. 951 952- optimize.c: Rewritten. 953 954- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous 955 for broadcast nets. 956 957- print-atal.c: Fix an alignment bug (thanks to 958 stanonik@nprdc.navy.mil) Add missing printf() argument. 959 960- print-bootp.c: First attempt at decoding the vendor buffer. 961 962- print-domain.c: Fix truncation checks. 963 964- print-icmp.c: Calculate length of packets from the ip header. 965 966- print-ip.c: Print frag id in decimal (so it's easier to match up 967 with non-frags). Add support for ospf, egp and igmp. 968 969- print-nfs.c: Lots of changes. 970 971- print-ntp.c: Make some verbose output depend on -v. 972 973- print-snmp.c: New version from John LoVerso. 974 975- print-tcp.c: Print rfc1072 tcp options. 976 977- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits 978 (microseconds) worth of precision. Fix uid bugs. 979 980- A packet dumper has been added (thanks to Jeff Mogul of DECWRL). 981 With this option, you can create an architecture independent binary 982 trace file in real time, without the overhead of the packet printer. 983 At a later time, the packets can be filtered (again) and printed. 984 985- BSD is supported. You must have BPF in your kernel. 986 Since the filtering is now done in the kernel, fewer packets are 987 dropped. In fact, with BPF and the packet dumper option, a measly 988 Sun 3/50 can keep up with a busy network. 989 990- Compressed SLIP packets can now be dumped, provided you use our 991 SLIP software and BPF. These packets are dumped as any other IP 992 packet; the compressed headers are dumped with the '-e' option. 993 994- Machines with little-endian byte ordering are supported (thanks to 995 Jeff Mogul). 996 997- Ultrix 4.0 is supported (also thanks to Jeff Mogul). 998 999- IBM RT and Stanford Enetfilter support has been added by 1000 Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under 1001 both the vanilla Enetfilter interface, and the extended interface 1002 (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter. 1003 1004- TFTP packets are now printed (requests only). 1005 1006- BOOTP packets are now printed. 1007 1008- SNMP packets are now printed. (thanks to John LoVerso of Xylogics). 1009 1010- Sparc architectures, including the Sparcstation-1, are now 1011 supported thanks to Steve McCanne and Craig Leres. 1012 1013- SunOS 4 is now supported thanks to Micky Liu of Columbia 1014 University (micky@cunixc.cc.columbia.edu). 1015 1016- IP options are now printed. 1017 1018- RIP packets are now printed. 1019 1020- There's a -v flag that prints out more information than the 1021 default (e.g., it will enable printing of IP ttl, tos and id) 1022 and -q flag that prints out less (e.g., it will disable 1023 interpretation of AppleTalk-in-UDP). 1024 1025- The grammar has undergone substantial changes (if you have an 1026 earlier version of tcpdump, you should re-read the manual 1027 entry). 1028 1029 The most useful change is the addition of an expression 1030 syntax that lets you filter on arbitrary fields or values in the 1031 packet. E.g., "ip[0] > 0x45" would print only packets with IP 1032 options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN 1033 packets. 1034 1035 The most painful change is that concatenation no longer means 1036 "and" -- e.g., you have to say "host foo and port bar" instead 1037 of "host foo port bar". The up side to this down is that 1038 repeated qualifiers can be omitted, making most filter 1039 expressions shorter. E.g., you can now say "ip host foo and 1040 (bar or baz)" to look at ip traffic between hosts foo and bar or 1041 between hosts foo and baz. [The old way of saying this was "ip 1042 host foo and (ip host bar or ip host baz)".] 1043 1044v2.0 Sun Jan 13 12:20:40 PST 1991 1045 1046- Initial public release. 1047