1 Tuesday, December 30, 2025 / The Tcpdump Group 2 Summary for 4.99.6 tcpdump release 3 Remove protocol decoding for: 4 OTV (draft-hasmit-otv-04, this Internet-Draft is no longer active). 5 Refine protocol decoding for: 6 DNS: Use ND_TCHECK_LEN() instead of a custom bounds check. 7 IPv6: Add a missing comma and remove a colon in the output. 8 TCP: Note if the Urgent Pointer is non-zero while URG flag not set, 9 if the verbose level is > 1 (option -vv and more). 10 TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set, 11 if the verbose level is > 1 (option -vv and more). 12 TCP: Fix Reset segment processing. 13 IP, IPv6: Fix setting the snapshot length for the payload. 14 IP: Use ND_TTEST_LEN() instead of a custom bounds check. 15 frag6: Add a bounds check in non-verbose mode. 16 PTP: Remove spaces before colons in output. 17 PTP: Fix management packet fields. 18 ISO: Avoid undefined behavior and integer overflow in the Fletcher 19 checksum calculation. 20 NFS: Delete dead code. 21 BOOTP: Use an uint16_t variable to get the result of a GET_BE_U_2(). 22 ZEP: use the existing NTP time formatting code. 23 NTP: Fix p_ntp_time_fmt() using epoch 1/epoch 2 convention (RFC 4330). 24 NTP: Update a field name with the RFC 5905 name (Origin Timestamp). 25 IPv6 mobility: Modernize packet parsing and make fixes. 26 IP6OPTS: Modernize packet parsing and make fixes. 27 VXLAN: Add UDP port 8472 used by Linux as the default port. 28 EGP: Replace custom code with tok2str(); Modernize packet parsing and 29 fix printing with -v option. 30 User interface: 31 Add optional unit suffix on -C file size. 32 Improve the handling of size suffixes for -C. 33 Print errors for options -A, -x[x] and -X[X] (mutually exclusive). 34 Print errors about -C, -G and -z options usage. 35 For PCAP_ERROR_CAPTURE_NOTSUP, show the error message provided 36 by libpcap for that error if it's non-empty. 37 Update the -z option processing. Print "invalid option -- z" when it is. 38 Add the -g option, causing IPv4 output in verbose mode to be on one line. 39 Other: 40 Avoid race condition when receiving signal during shutdown. 41 Always show the interface name in error messages when the 42 interface can't be opened. 43 Clean up the message shown if a -i flag is specified with an 44 interface index that's too large. 45 Source code: 46 Fix '-tt' option printing when time > 2106-02-07T06:28:15Z. 47 Add sub-second packet timestamp checks for invalid micro/nano. 48 Remove unused missing/snprintf.c. 49 Fix incompatible pointer types with time functions calls on Windows. 50 Use C99 macros to define 64-bit constants and maximum 64-bit values. 51 Windows: 52 Fixed to find wpcap.dll if WinPcap isn't installed and Npcap was 53 installed without the WinPcap API compatibility option. (GitHub 54 issue #1226). 55 Building and testing: 56 Makefile.in: Use a local libpcap in the releasecheck target. 57 CMake: Fix build with CMake 3.31. 58 autotools, CMake: don't separately test whether snprintf(3) is 59 available and whether it's suitable - the test for whether it's 60 suitable also fails if it's unavailable. 61 CMake: Skip snprintf(3) tests when cross-compiling. 62 autotools, CMake: fix issues with snprintf test and sanitizers. 63 CMake: check whether check_c_source_runs() works, treat the build 64 as a cross-compile if it doesn't work. 65 Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the 66 environment variable BUILD_YEAR2038 = yes (via autogen.sh). 67 Autoconf: Avoid incorrectly include the libpcap's config.h. 68 Autoconf: Refine reporting of os-proto.h. 69 Require config.h to be from the tcpdump build. 70 AppVeyor: Update Npcap SDK to 1.15. 71 autogen.sh: Allow to configure Autoconf warnings. 72 autogen.sh: Delete all trailing blank lines at end of configure. 73 74 Friday, August 30, 2024 / The Tcpdump Group 75 Summary for 4.99.5 tcpdump release 76 Refine protocol decoding for: 77 Arista: Use the test .pcap file from pull request #955 (HwInfo). 78 BGP: Fix an undefined behavior when it tries to parse a too-short packet. 79 CARP: Print the protocol name before any GET_(). 80 CDP: only hex-dump unknown TLVs in verbose mode. 81 DHCP: parse the SZTP redirect tag. 82 DHCPv6: client-id/server-id DUID type 2 correction; parse the user class, 83 boot file URL, and SZTP redirect options; add DUID-UUID printing 84 (RFC6355). 85 DNS: Detect and correctly handle too-short URI RRs. 86 EAP: Assign ndo_protocol in the eap_print() function. 87 ESP: Don't use EVP_add_cipher_alias() (fixes building on OpenBSD 7.5). 88 Frame Relay (Multilink): Fix the Timestamp Information Element printing. 89 ICMPv6: Fix printing the Home Agent Address Discovery Reply Message. 90 IEEE 802.11: no need for an element ID in the structures for IEs, make 91 the length in the IE structures a u_int, include the "TA" field while 92 printing Block Ack Control frame. 93 IP: Enable TSO (TCP Segmentation Offload) support; fix printing invalid 94 cases as invalid, not truncated; use ND_ICHECKMSG_ZU() to test the 95 header length. 96 IPv6: Fix printing invalid cases as invalid, not truncated; use 97 ND_ICHECKMSG_U() to print an invalid version. 98 IPv6: Fix invalid 32-bit versus 64-bit printouts of fragment headers. 99 ISAKMP: Fix printing Delete payload SPI when size is zero. 100 Kerberos: Print the protocol name, remove a redundant bounds check. 101 lwres: Fix an undefined behavior in pointer arithmetic. 102 OpenFlow 1.0: Fix indentation of PORT_MOD, improve handling of 103 some lengths, and fix handling of snapend. 104 TCP: Test ports < 1024 in port order to select the printer. 105 UDP: Move source port equal BCM_LI_PORT to bottom of long if else chain. 106 UDP: Test ports < 1024 in port order to select the printer. 107 LDP: Add missing fields of the Common Session Parameters TLV and fix the 108 offset for the A&D bits. 109 NFLOG: Use correct AF code points on all OSes. 110 NFS: Avoid printing non-ASCII characters. 111 OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes. 112 OSPF: Update LS-Ack printing not to run off the end of the packet. 113 OSPF6: Fix an undefined behavior. 114 pflog: Use nd_ types in struct pfloghdr. 115 PPP: Check if there is some data to hexdump. 116 PPP: Remove an extra colon before LCP Callback Operation. 117 Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397; 118 Note: This problem does not affect any tcpdump release. 119 PTP: Fix spelling of type SIGNALING, Parse major and minor version 120 correctly, Print majorSdoId field instead of just the first bit. 121 RIP: Make a couple trivial protocol updates. 122 RPKI-Router: Refine length and bounds checks. 123 RX: Use the "%Y-%m-%d" date format. 124 smbutil.c: Use the "%Y-%m-%d" date format. 125 SNMP: Fix two undefined behaviors. 126 Text protocols: Fix printing truncation if it is not the case. 127 ZEP: Use the "%Y-%m-%d" date format. 128 ZMTP: Replace custom code with bittok2str(). 129 User interface: 130 Print the supported time stamp types (-J) to stdout instead of stderr. 131 Print the list of data link types (-L) to stdout instead of stderr. 132 Use symmetrical quotation characters in error messages. 133 Update --version option to print 32/64-bit build and time_t size. 134 Improve error messages for invalid interface indexes specified 135 with -i. 136 Support "3des" as an alias for "des_ede3_cbc" even if the crypto 137 library doesn't support adding aliases. 138 Source code: 139 tcpdump: Fix a memory leak. 140 child_cleanup: reap as many child processes as possible. 141 Ignore failures when setting the default "any" device DLL to LINUX_SLL2. 142 Fix for backends which doesn't support capsicum. 143 Update ND_BYTES_BETWEEN() macro for better accuracy. 144 Update ND_BYTES_AVAILABLE_AFTER() macro for better accuracy. 145 Introduce new ND_ICHECK*() macros to deduplicate more code. 146 Skip privilege dropping when using -Z root on --with-user builds. 147 Add a nd_printjn() function. 148 Make nd_trunc_longjmp() not static inline. 149 Include <time.h> from netdissect.h. 150 Remove init_crc10_table() and the entourage. 151 Initialize tzcode early. 152 Capsicum support: Fix a 'not defined' macro error. 153 Update the "Error converting time" tests for packet times. 154 Fix warnings when building for 32-bit and defining _TIME_BITS=64. 155 Free interface list just before exiting where it wasn't being 156 freed. 157 Building and testing: 158 Add a configure option to help debugging (--enable-instrument-functions). 159 At build time require a proof of suitable snprintf(3) implementation in 160 libc (and document Solaris 9 as unsupported because of that). 161 Makefile.in: Add two "touch .devel" commands in the releasecheck target. 162 Autoconf: Get --with-user and --with-chroot right. 163 Autoconf: Fix --static-pcap-only test on Solaris 10. 164 Autoconf: Add some warning flags for clang 13 or newer. 165 Autoconf: Update config.{guess,sub}, timestamps 2024-01-01. 166 Autoconf: Add autogen.sh, remove configure and config.h.in and put 167 these generated files in the release tarball. 168 Autoconf: Update the install-sh script to the 2020-11-14.01 version. 169 configure: Apply autoupdate 2.69. 170 CMake: improve the comment before project(tcpdump C). 171 Do not require vsnprintf(). 172 tests: Use the -tttt option, by default, for the tests. 173 Autoconf, CMake: Get the size of a void * and a time_t. 174 Fix propagation of cc_werr_cflags() output. 175 Makefile.in: Fix the depend target. 176 mkdep: Exit with a non-zero status if a command fails. 177 Autoconf: use V_INCLS to update the list of include search paths. 178 Autoconf: don't put anything before -I and -L flags for local libpcap. 179 Autoconf, CMake: work around an Xcode 15+ issue. 180 Autoconf, CMake: use pkg-config and Homebrew when looking for 181 libcrypto. 182 Fix Sun C invocation from CMake. 183 mkdep: Use TMPDIR if it is set and not null. 184 Add initial support for building with TinyCC. 185 Makefile.in: Use the variable MAKE instead of the make command. 186 Makefile.in: Add instrumentation configuration in releasecheck target. 187 Make various improvements to the TESTrun script. 188 Untangle detection of pcap_findalldevs(). 189 Autoconf: don't use egrep, use $EGREP. 190 Autoconf: check for gethostbyaddr(), not gethostbyname(). 191 Autoconf, CMake: search for gethostbyaddr() in libnetwork. 192 Make illumos build warning-free. 193 Documentation: 194 Fixed errors in doc/README.Win32.md and renamed it to README.windows.md. 195 Make various improvements to the man page. 196 Add initial README file for Haiku. 197 Make various improvements to CONTRIBUTING.md. 198 man: Clarify the "any" pseudo-interface further. 199 200 Friday, April 7, 2023 / The Tcpdump Group 201 Summary for 4.99.4 tcpdump release 202 Source code: 203 Fix spaces before tabs in indentation. 204 Updated printers: 205 LSP ping: Fix "Unused value" warnings from Coverity. 206 CVE-2023-1801: Fix an out-of-bounds write in the SMB printer. 207 DNS: sync resource types with IANA. 208 ICMPv6: Update the output to show a RPL DAO field name. 209 Geneve: Fix the Geneve UDP port test. 210 Building and testing: 211 Require at least autoconf 2.69. 212 Don't check for strftime(), as it's in C90 and beyond. 213 Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21. 214 Documentation: 215 man: Document TCP flag names better. 216 217 Thursday, January 12, 2023 / The Tcpdump Group 218 Summary for 4.99.3 tcpdump release 219 Updated printers: 220 PTP: Use the proper values for the control field and print un-allocated 221 values for the message field as "Reserved" instead of "none". 222 Source code: 223 smbutil.c: Replace obsolete function call (asctime) 224 Building and testing: 225 cmake: Update the minimum required version to 2.8.12 (except Windows). 226 CI: Introduce and use TCPDUMP_CMAKE_TAINTED. 227 Makefile.in: Add the releasecheck target. 228 Makefile.in: Add "make -s install" in the releasecheck target. 229 Cirrus CI: Run the "make releasecheck" command in the Linux task. 230 Makefile.in: Add the whitespacecheck target. 231 Cirrus CI: Run the "make whitespacecheck" command in the Linux task. 232 Address all shellcheck warnings in update-test.sh. 233 Makefile.in: Get rid of a remain of gnuc.h. 234 Documentation: 235 Reformat the installation notes (INSTALL.txt) in Markdown. 236 Convert CONTRIBUTING to Markdown. 237 CONTRIBUTING.md: Document the use of "protocol: " in a commit summary. 238 Add a README file for NetBSD. 239 Fix CMake build to set man page section numbers in tcpdump.1 240 241 Saturday, December 31, 2022 / The Tcpdump Group 242 Summary for 4.99.2 tcpdump release 243 Updated printers: 244 BGP: Update cease notification decoding to RFC 9003. 245 BGP: decode BGP link-bandwidth extended community properly. 246 BGP: Fix parsing the AIGP attribute 247 BGP: make sure the path attributes don't go past the end of the packet. 248 BGP: Shutdown message can be up to 255 bytes length according to rfc9003 249 DSA: correctly determine VID. 250 EAP: fix some length checks and output issues. 251 802.11: Fix the misleading comment regarding "From DS", "To DS" Frame 252 Control Flags. 253 802.11: Fetch the CF and TIM IEs a field at a time. 254 802.15.4, BGP, LISP: fix some length checks, compiler warnings, 255 and undefined behavior warnings. 256 PFLOG: Handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all 257 OSes. 258 RRCP: support more Realtek protocols than just RRCP. 259 MPLS: show the EXP field as TC, as per RFC 5462. 260 ICMP: redo MPLS Extension code as general ICMP Extension code. 261 VQP: Do not print unknown error codes twice. 262 Juniper: Add some bounds checks. 263 Juniper: Don't treat known DLT_ types as "Unknown". 264 lwres: Fix a length check, update a variable type. 265 EAP: Fix some undefined behaviors at runtime. 266 Ethernet: Rework the length checks, add a length check. 267 IPX: Add two length checks. 268 Zephyr: Avoid printing non-ASCII characters. 269 VRRP: Print the protocol name before any GET_(). 270 DCCP: Get rid of trailing commas in lists. 271 Juniper: Report invalid packets as invalid, not truncated. 272 IPv6: Remove an obsolete code in an always-false #if wrapper. 273 ISAKMP: Use GET_U_1() to replace a direct dereference. 274 RADIUS: Use GET_U_1() to replace a direct dereference. 275 TCP: Fix an invalid check. 276 RESP: Fix an invalid check. 277 RESP: Remove an unnecessary test. 278 Arista: Refine the output format and print HwInfo. 279 sFlow: add support for IPv6 agent, add a length check. 280 VRRP: add support for IPv6. 281 OSPF: Update to match the Router Properties registry. 282 OSPF: Remove two unnecessary dereferences. 283 OSPF: Add support bit Nt RFC3101. 284 OSPFv3: Remove two unnecessary dereferences. 285 ICMPv6: Fix output for Router Renumbering messages. 286 ICMPv6: Fix the Node Information flags. 287 ICMPv6: Remove an unused macro and extra blank lines. 288 ICMPv6: Add a length check in the rpl_dio_print() function. 289 ICMPv6: Use GET_IP6ADDR_STRING() in the rpl_dio_print() function. 290 IPv6: Add some checks for the Hop-by-Hop Options header 291 IPv6: Add a check for the Jumbo Payload Hop-by-Hop option. 292 NFS: Fix the format for printing an unsigned int 293 PTP: fix printing of the correction fields 294 PTP: Use ND_LCHECK_U for checking invalid length. 295 WHOIS: Add its own printer source file and printer function 296 MPTCP: print length before subtype inside MPTCP options 297 ESP: Add a workaround to a "use-of-uninitialized-value". 298 PPP: Add tests to avoid incorrectly re-entering ppp_hdlc(). 299 PPP: Don't process further if protocol is unknown (-e option). 300 PPP: Change the pointer to packet data. 301 ZEP: Add three length checks. 302 Add some const qualifiers. 303 Building and testing: 304 Update config.guess and config.sub. 305 Use AS_HELP_STRING macro instead of AC_HELP_STRING. 306 Handle some Autoconf/make errors better. 307 Fix an error when cross-compiling. 308 Use "git archive" for the "make releasetar" process. 309 Remove the release candidate rcX targets. 310 Mend "make check" on Solaris 9 with Autoconf. 311 Address assorted compiler warnings. 312 Fix auto-enabling of Capsicum on FreeBSD with Autoconf. 313 Treat "msys" as Windows for test exit statuses. 314 Clean up some help messages in configure. 315 Use unified diff by default. 316 Remove awk code from mkdep. 317 Fix configure test errors with Clang 15 318 CMake: Prevent stripping of the RPATH on installation. 319 AppVeyor CI: update Npcap site, update to 1.12 SDK. 320 Cirrus CI: Use the same configuration as for the main branch. 321 CI: Add back running tcpdump -J/-L and capture, now with Cirrus VMs. 322 Remove four test files (They are now in the libpcap tests directory). 323 On Solaris, for 64-bit builds, use the 64-bit pcap-config. 324 Tell CMake not to check for a C++ compiler. 325 CMake: Add a way to request -Werror and equivalents. 326 configure: Special-case macOS /usr/bin/pcap-config as we do in CMake. 327 configure: Use pcap-config --static-pcap-only if available. 328 configure: Use ac_c_werror_flag to force unknown compiler flags to fail. 329 configure: Use AC_COMPILE_IFELSE() and AC_LANG_SOURCE() for testing 330 flags. 331 Run the test that fails on OpenBSD only if we're not on OpenBSD. 332 Source code: 333 Fix some snapend-changing routines to protect against pointer 334 underflow. 335 Use __func__ from C99 in some function calls. 336 Memory allocator: Update nd_add_alloc_list() to a static function. 337 addrtoname.c: Fix two invalid tests. 338 Use more S_SUCCESS and S_ERR_HOST_PROGRAM in main(). 339 Add some comments about "don't use GET_IP6ADDR_STRING()". 340 Assign ndo->ndo_packetp in pretty_print_packet(). 341 Add ND_LCHECKMSG_U, ND_LCHECK_U, ND_LCHECKMSG_ZU and ND_LCHECK_ZU macros. 342 Update tok2strbuf() to a static function. 343 netdissect.h: Keep the link-layer dissectors names sorted. 344 setsignal(): Set SA_RESTART on non-lethal signals (REQ_INFO, FLUSH_PCAP) 345 to avoid corrupting binary pcap output. 346 Use __builtin_unreachable(). 347 Fail if nd_push_buffer() or nd_push_snaplen() fails. 348 Improve code style and fix many typos. 349 Documentation: 350 Some man page cleanups. 351 Update the print interface for the packet count to stdout. 352 Note that we require compilers to support at least some of C99. 353 Update AIX and Solaris-related specifics. 354 INSTALL.txt: Add doc/README.*, delete the deleted win32 directory. 355 Update README.md and README.Win32.md. 356 Update some comments with new RFC numbers. 357 358 Wednesday, June 9, 2021 by gharris 359 Summary for 4.99.1 tcpdump release 360 Source code: 361 Squelch some compiler warnings 362 ICMP: Update the snapend for some nested IP packets. 363 MACsec: Update the snapend thus the ICV field is not payload 364 for the caller. 365 EIGRP: Fix packet header fields 366 SMB: Disable printer by default in CMake builds 367 OLSR: Print the protocol name even if the packet is invalid 368 MSDP: Print ": " before the protocol name 369 ESP: Remove padding, padding length and next header from the buffer 370 DHCPv6: Update the snapend for nested DHCPv6 packets 371 OpenFlow 1.0: Get snapend right for nested frames. 372 TCP: Update the snapend before decoding a MPTCP option 373 Ethernet, IEEE 802.15.4, IP, L2TP, TCP, ZEP: Add bounds checks 374 ForCES: Refine SPARSEDATA-TLV length check. 375 ASCII/hex: Use nd_trunc_longjmp() in truncation cases 376 GeoNet: Add a ND_TCHECK_LEN() call 377 Replace ND_TCHECK_/memcpy() pairs with GET_CPY_BYTES(). 378 BGP: Fix overwrites of global 'astostr' temporary buffer 379 ARP: fix overwrites of static buffer in q922_string(). 380 Frame Relay: have q922_string() handle errors better. 381 Building and testing: 382 Rebuild configure script when building release 383 Fix "make clean" for out-of-tree autotools builds 384 CMake: add stuff from CMAKE_PREFIX_PATH to PKG_CONFIG_PATH. 385 Documentation: 386 man: Update a reference as www.cifs.org is gone. 387 man: Update DNS sections 388 Solaris: 389 Fix a compile error with Sun C 390 391 Wednesday, December 30, 2020, by mcr (a] sandelman.ca, denis and fxl. 392 Summary for 4.99.0 tcpdump release 393 CVE-2018-16301: For the -F option handle large input files safely. 394 Improve the contents, wording and formatting of the man page. 395 Print unsupported link-layer protocol packets in hex. 396 Add support for new network protocols and DLTs: Arista, Autosar SOME/IP, 397 Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand 398 (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch 399 Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS, 400 ZigBee Encapsulation Protocol (ZEP). 401 Make protocol-specific updates for: AH, DHCP, DNS, ESP, FRF.16, HNCP, 402 ICMP6, IEEE 802.15.4, IPv6, IS-IS, Linux SLL, LLDP, LSP ping, MPTCP, NFS, 403 NSH, NTP, OSPF, OSPF6, PGM, PIM, PPTP, RADIUS, RSVP, Rx, SMB, UDLD, 404 VXLAN-GPE. 405 User interface: 406 Make SLL2 the default for Linux "any" pseudo-device. 407 Add --micro and --nano shorthands. 408 Add --count to print a counter only instead of decoding. 409 Add --print, to cause packet printing even with -w. 410 Add support for remote capture if libpcap supports it. 411 Display the "wireless" flag and connection status. 412 Flush the output packet buffer on a SIGUSR2. 413 Add the snapshot length to the "reading from file ..." message. 414 Fix local time printing (DST offset in timestamps). 415 Allow -C arguments > 2^31-1 GB if they can fit into a long. 416 Handle very large -f files by rejecting them. 417 Report periodic stats only when safe to do so. 418 Print the number of packets captured only as often as necessary. 419 With no -s, or with -s 0, don't specify the snapshot length with newer 420 versions of libpcap. 421 Improve version and usage message printing. 422 Building and testing: 423 Install into bindir, not sbindir. 424 autoconf: replace --with-system-libpcap with --disable-local-libpcap. 425 Require the compiler to support C99. 426 Better detect and use various C compilers and their features. 427 Add CMake as the second build system. 428 Make out-of-tree builds more reliable. 429 Use pkg-config to detect libpcap if available. 430 Improve Windows support. 431 Add more tests and improve the scripts that run them. 432 Test both with "normal" and "x87" floating-point. 433 Eliminate dependency on libdnet. 434 FreeBSD: 435 Print a proper error message about monitor mode VAP. 436 Use libcasper if available. 437 Fix failure to capture on RDMA device. 438 Include the correct capsicum header. 439 Source code: 440 Start the transition to longjmp() for packet truncation handling. 441 Introduce new helper functions, including GET_*(), nd_print_protocol(), 442 nd_print_invalid(), nd_print_trunc(), nd_trunc_longjmp() and others. 443 Put integer signedness right in many cases. 444 Introduce nd_uint*, nd_mac_addr, nd_ipv4 and nd_ipv6 types to fix 445 alignment issues, especially on SPARC. 446 Fix many C compiler, Coverity, UBSan and cppcheck warnings. 447 Fix issues detected with AddressSanitizer. 448 Remove many workarounds for older compilers and OSes. 449 Add a sanity check on packet header length. 450 Add and remove plenty of bounds checks. 451 Clean up pcap_findalldevs() call to find the first interface. 452 Use a short timeout, rather than immediate mode, for text output. 453 Handle DLT_ENC files *not* written on the same OS and byte-order host. 454 Add, and use, macros to do locale-independent case mapping. 455 Use a table instead of getprotobynumber(). 456 Get rid of ND_UNALIGNED and ND_TCHECK(). 457 Make roundup2() generally available. 458 Resync SMI list against Wireshark. 459 Fix many typos. 460 461 Friday, September 20, 2019, by mcr (a] sandelman.ca 462 A huge thank you to Denis, Francois-Xavier and Guy who did much of the heavy lifting. 463 Summary for 4.9.3 tcpdump release 464 Fix buffer overflow/overread vulnerabilities: 465 CVE-2017-16808 (AoE) 466 CVE-2018-14468 (FrameRelay) 467 CVE-2018-14469 (IKEv1) 468 CVE-2018-14470 (BABEL) 469 CVE-2018-14466 (AFS/RX) 470 CVE-2018-14461 (LDP) 471 CVE-2018-14462 (ICMP) 472 CVE-2018-14465 (RSVP) 473 CVE-2018-14881 (BGP) 474 CVE-2018-14464 (LMP) 475 CVE-2018-14463 (VRRP) 476 CVE-2018-14467 (BGP) 477 CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled) 478 CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled) 479 CVE-2018-14880 (OSPF6) 480 CVE-2018-16451 (SMB) 481 CVE-2018-14882 (RPL) 482 CVE-2018-16227 (802.11) 483 CVE-2018-16229 (DCCP) 484 CVE-2018-16230 (BGP) 485 CVE-2018-16452 (SMB) 486 CVE-2018-16300 (BGP) 487 CVE-2018-16228 (HNCP) 488 CVE-2019-15166 (LMP) 489 CVE-2019-15167 (VRRP) 490 Fix for cmdline argument/local issues: 491 CVE-2018-14879 (tcpdump -V) 492 493 Sunday September 3, 2017 denis (a] ovsienko.info 494 Summary for 4.9.2 tcpdump release 495 Do not use getprotobynumber() for protocol name resolution. Do not do 496 any protocol name resolution if -n is specified. 497 Improve errors detection in the test scripts. 498 Fix a segfault with OpenSSL 1.1 and improve OpenSSL usage. 499 Clean up IS-IS printing. 500 Fix buffer overflow vulnerabilities: 501 CVE-2017-11543 (SLIP) 502 CVE-2017-13011 (bittok2str_internal) 503 Fix infinite loop vulnerabilities: 504 CVE-2017-12989 (RESP) 505 CVE-2017-12990 (ISAKMP) 506 CVE-2017-12995 (DNS) 507 CVE-2017-12997 (LLDP) 508 Fix buffer over-read vulnerabilities: 509 CVE-2017-11541 (safeputs) 510 CVE-2017-11542 (PIMv1) 511 CVE-2017-12893 (SMB/CIFS) 512 CVE-2017-12894 (lookup_bytestring) 513 CVE-2017-12895 (ICMP) 514 CVE-2017-12896 (ISAKMP) 515 CVE-2017-12897 (ISO CLNS) 516 CVE-2017-12898 (NFS) 517 CVE-2017-12899 (DECnet) 518 CVE-2017-12900 (tok2strbuf) 519 CVE-2017-12901 (EIGRP) 520 CVE-2017-12902 (Zephyr) 521 CVE-2017-12985 (IPv6) 522 CVE-2017-12986 (IPv6 routing headers) 523 CVE-2017-12987 (IEEE 802.11) 524 CVE-2017-12988 (telnet) 525 CVE-2017-12991 (BGP) 526 CVE-2017-12992 (RIPng) 527 CVE-2017-12993 (Juniper) 528 CVE-2017-12994 (BGP) 529 CVE-2017-12996 (PIMv2) 530 CVE-2017-12998 (ISO IS-IS) 531 CVE-2017-12999 (ISO IS-IS) 532 CVE-2017-13000 (IEEE 802.15.4) 533 CVE-2017-13001 (NFS) 534 CVE-2017-13002 (AODV) 535 CVE-2017-13003 (LMP) 536 CVE-2017-13004 (Juniper) 537 CVE-2017-13005 (NFS) 538 CVE-2017-13006 (L2TP) 539 CVE-2017-13007 (Apple PKTAP) 540 CVE-2017-13008 (IEEE 802.11) 541 CVE-2017-13009 (IPv6 mobility) 542 CVE-2017-13010 (BEEP) 543 CVE-2017-13012 (ICMP) 544 CVE-2017-13013 (ARP) 545 CVE-2017-13014 (White Board) 546 CVE-2017-13015 (EAP) 547 CVE-2017-11543 (SLIP) 548 CVE-2017-13016 (ISO ES-IS) 549 CVE-2017-13017 (DHCPv6) 550 CVE-2017-13018 (PGM) 551 CVE-2017-13019 (PGM) 552 CVE-2017-13020 (VTP) 553 CVE-2017-13021 (ICMPv6) 554 CVE-2017-13022 (IP) 555 CVE-2017-13023 (IPv6 mobility) 556 CVE-2017-13024 (IPv6 mobility) 557 CVE-2017-13025 (IPv6 mobility) 558 CVE-2017-13026 (ISO IS-IS) 559 CVE-2017-13027 (LLDP) 560 CVE-2017-13028 (BOOTP) 561 CVE-2017-13029 (PPP) 562 CVE-2017-13030 (PIM) 563 CVE-2017-13031 (IPv6 fragmentation header) 564 CVE-2017-13032 (RADIUS) 565 CVE-2017-13033 (VTP) 566 CVE-2017-13034 (PGM) 567 CVE-2017-13035 (ISO IS-IS) 568 CVE-2017-13036 (OSPFv3) 569 CVE-2017-13037 (IP) 570 CVE-2017-13038 (PPP) 571 CVE-2017-13039 (ISAKMP) 572 CVE-2017-13040 (MPTCP) 573 CVE-2017-13041 (ICMPv6) 574 CVE-2017-13042 (HNCP) 575 CVE-2017-13043 (BGP) 576 CVE-2017-13044 (HNCP) 577 CVE-2017-13045 (VQP) 578 CVE-2017-13046 (BGP) 579 CVE-2017-13047 (ISO ES-IS) 580 CVE-2017-13048 (RSVP) 581 CVE-2017-13049 (Rx) 582 CVE-2017-13050 (RPKI-Router) 583 CVE-2017-13051 (RSVP) 584 CVE-2017-13052 (CFM) 585 CVE-2017-13053 (BGP) 586 CVE-2017-13054 (LLDP) 587 CVE-2017-13055 (ISO IS-IS) 588 CVE-2017-13687 (Cisco HDLC) 589 CVE-2017-13688 (OLSR) 590 CVE-2017-13689 (IKEv1) 591 CVE-2017-13690 (IKEv2) 592 CVE-2017-13725 (IPv6 routing headers) 593 594 Sunday July 23, 2017 denis (a] ovsienko.info 595 Summary for 4.9.1 tcpdump release 596 CVE-2017-11108/Fix bounds checking for STP. 597 Make assorted documentation updates and fix a few typos in tcpdump output. 598 Fixup -C for file size >2GB (GH #488). 599 Show AddressSanitizer presence in version output. 600 Fix a bug in test scripts (exposed in GH #613). 601 On FreeBSD adjust Capsicum capabilities for netmap. 602 On Linux fix a use-after-free when the requested interface does not exist. 603 604 Wednesday January 18, 2017 devel.fx.lebail (a] orange.fr 605 Summary for 4.9.0 tcpdump release 606 General updates: 607 Fix some heap overflows found with American Fuzzy Lop by Hanno Boeck and others 608 (More information in the log with CVE-2016-* and CVE-2017-*) 609 Change the way protocols print link-layer addresses (Fix heap overflows 610 in CALM-FAST and GeoNetworking printers) 611 Pass correct caplen value to ether_print() and some other functions 612 Fix lookup_nsap() to match what isonsap_string() expects 613 Clean up relative time stamp printing (Fix an array overflow) 614 Fix some alignment issues with GCC on Solaris 10 SPARC 615 Add some ND_TTEST_/ND_TCHECK_ macros to simplify writing bounds checks 616 Add a fn_printztn() which returns the number of bytes processed 617 Add nd_init() and nd_cleanup() functions. Improve libsmi support 618 Add CONTRIBUTING file 619 Add a summary comment in all printers 620 Compile with more warning options in devel mode if supported (-Wcast-qual, ...) 621 Fix some leaks found by Valgrind/Memcheck 622 Fix a bunch of de-constifications 623 Squelch some Coverity warnings and some compiler warnings 624 Update Coverity and Travis-CI setup 625 Update Visual Studio files 626 627 Frontend: 628 Fix capsicum support to work with zerocopy buffers in bpf 629 Try opening interfaces by name first, then by name-as-index 630 Work around pcap_create() failures fetching time stamp type lists 631 Fix a segmentation fault with 'tcpdump -J' 632 Improve addrtostr6() bounds checking 633 Add exit_tcpdump() function 634 Don't drop CAP_SYS_CHROOT before chrooting 635 Fixes issue where statistics not reported when -G and -W options used 636 637 Updated printers: 638 802.11: Beginnings of 11ac radiotap support 639 802.11: Check the Protected bit for management frames 640 802.11: Do bounds checking on last_presentp before dereferencing it (Fix a heap overflow) 641 802.11: Fix the radiotap printer to handle the special bits correctly 642 802.11: If we have the MCS field, it's 11n 643 802.11: Only print unknown frame type or subtype messages once 644 802.11: Radiotap dBm values get printed as dB; Update a test output accordingly 645 802.11: Source and destination addresses were backwards 646 AH: Add a bounds check 647 AH: Report to our caller that dissection failed if a bounds check fails 648 AP1394: Print src > dst, not dst > src 649 ARP: Don't assume the target hardware address is <= 6 octets long (Fix a heap overflow) 650 ATALK: Add bounds and length checks (Fix heap overflows) 651 ATM: Add some bounds checks (Fix a heap overflow) 652 ATM: Fix an incorrect bounds check 653 BFD: Update specification from draft to RFC 5880 654 BFD: Update to print optional authentication field 655 BGP: Add support for the AIGP attribute (RFC7311) 656 BGP: Print LARGE_COMMUNITY Path Attribute 657 BGP: Update BGP numbers from IANA; Print minor values for FSM notification 658 BOOTP: Add a bounds check 659 Babel: Add decoder for source-specific extension 660 CDP: Filter out non-printable characters 661 CFM: Fixes to match the IEEE standard, additional bounds and length checks 662 CSLIP: Add more bounds checks (Fix a heap overflow) 663 ClassicalIPoATM: Add a bounds check on LLC+SNAP header (Fix a heap overflow) 664 DHCP: Fix MUDURL and TZ options 665 DHCPv6: Process MUDURL and TZ options 666 DHCPv6: Update Status Codes with RFCs/IANA names 667 DNS: Represent the "DNSSEC OK" bit as "DO" instead of "OK". Add a test case 668 DTP: Improve packet integrity checks 669 EGP: Fix bounds checks 670 ESP: Don't use OpenSSL_add_all_algorithms() in OpenSSL 1.1.0 or later 671 Ethernet: Add some bounds checking before calling isoclns_print (Fix a heap overflow) 672 Ethernet: Print the Length/Type field as length when needed 673 FDDI: Fix -e output for FDDI 674 FR: Add some packet-length checks and improve Q.933 printing (Fix heap overflows) 675 GRE: Add some bounds checks (Fix heap overflows) 676 Geneve: Fix error message with invalid option length; Update list option classes 677 HNCP: Fix incorrect time interval format. Fix handling of IPv4 prefixes 678 ICMP6: Fetch a 32-bit big-endian quantity with EXTRACT_32BITS() 679 IGMP: Add a length check 680 IP: Add a bounds check (Fix a heap overflow) 681 IP: Check before fetching the protocol version (Fix a heap overflow) 682 IP: Don't try to dissect if IP version != 4 (Fix a heap overflow) 683 IP: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP 684 IPComp: Check whether we have the CPI before we fetch it (Fix a heap overflow) 685 IPoFC: Fix -e output (IP-over-Fibre Channel) 686 IPv6: Don't overwrite the destination IPv6 address for routing headers 687 IPv6: Fix header printing 688 IPv6: Stop processing IPPROTO_ values once we hit IPPROTO_IPCOMP 689 ISAKMP: Clean up parsing of IKEv2 Security Associations 690 ISOCLNS/IS-IS: Add support for Purge Originator Identifier (RFC6232) and test cases 691 ISOCLNS/IS-IS: Don't overwrite packet data when checking the signature 692 ISOCLNS/IS-IS: Filter out non-printable characters 693 ISOCLNS/IS-IS: Fix segmentation faults 694 ISOCLNS/IS-IS: Have signature_verify() do the copying and clearing 695 ISOCLNS: Add some bounds checks 696 Juniper: Make sure a Juniper header TLV isn't bigger than what's left in the packet (Fix a heap overflow) 697 LLC/SNAP: With -e, print the LLC header before the SNAP header; without it, cut the SNAP header 698 LLC: Add a bounds check (Fix a heap overflow) 699 LLC: Clean up printing of LLC packets 700 LLC: Fix the printing of RFC 948-style IP packets 701 LLC: Skip the LLC and SNAP headers with -x for 802.11 and some other protocols 702 LLDP: Implement IANA OUI and LLDP MUD option 703 MPLS LSP ping: Update printing for RFC 4379, bug fixes, more bounds checks 704 MPLS: "length" is now the *remaining* packet length 705 MPLS: Add bounds and length checks (Fix a heap overflow) 706 NFS: Don't assume the ONC RPC header is nicely aligned 707 NFS: Don't overflow the Opaque_Handle buffer (Fix a segmentation fault) 708 NFS: Don't run past the end of an NFSv3 file handle 709 OLSR: Add a test to cover a HNA sgw case 710 OLSR: Fix 'Advertised networks' count 711 OLSR: Fix printing of smart-gateway HNAs in IPv4 712 OSPF: Add a bounds check for the Hello packet options 713 OSPF: Do more bounds checking 714 OSPF: Fix a segmentation fault 715 OSPF: Fix printing 'ospf_topology_values' default 716 OTV: Add missing bounds checks 717 PGM: Print the formatted IP address, not the raw binary address, as a string 718 PIM: Add some bounds checking (Fix a heap overflow) 719 PIMv2: Fix checksumming of Register messages 720 PPP: Add some bounds checks (Fix a heap overflow) 721 PPP: Report invalid PAP AACK/ANAK packets 722 Q.933: Add a missing bounds check 723 RADIUS: Add Value 13 "VLAN" to Tunnel-Type attribute 724 RADIUS: Filter out non-printable characters 725 RADIUS: Translate UDP/1700 as RADIUS 726 RESP: Do better checking of RESP packets 727 RPKI-RTR: Add a return value check for "fn_printn" call 728 RPKI-RTR: Remove printing when truncated condition already detected 729 RPL: Fix 'Consistency Check' control code 730 RPL: Fix suboption print 731 RSVP: An INTEGRITY object in a submessage covers only the submessage 732 RSVP: Fix an infinite loop; Add bounds and length checks 733 RSVP: Fix some if statements missing brackets 734 RSVP: Have signature_verify() do the copying and clearing 735 RTCP: Add some bounds checks 736 RTP: Add some bounds checks, fix two segmentation faults 737 SCTP: Do more bounds checking 738 SFLOW: Fix bounds checking 739 SLOW: Fix bugs, add checks 740 SMB: Before fetching the flags2 field, make sure we have it 741 SMB: Do bounds checks on NBNS resource types and resource data lengths 742 SNMP: Clean up the "have libsmi but no modules loaded" case 743 SNMP: Clean up the object abbreviation list and fix the code to match them 744 SNMP: Do bounds checks when printing character and octet strings 745 SNMP: Improve ASN.1 bounds checks 746 SNMP: More bounds and length checks 747 STP: Add a bunch of bounds checks, and fix some printing (Fix heap overflows) 748 STP: Filter out non-printable characters 749 TCP: Add bounds and length checks for packets with TCP option 20 750 TCP: Correct TCP option Kind value for TCP Auth and add SCPS-TP 751 TCP: Fix two bounds checks (Fix heap overflows) 752 TCP: Make sure we have the data offset field before fetching it (Fix a heap overflow) 753 TCP: Put TCP-AO option decoding right 754 TFTP: Don't use strchr() to scan packet data (Fix a heap overflow) 755 Telnet: Add some bounds checks 756 TokenRing: Fix -e output 757 UDLD: Fix an infinite loop 758 UDP: Add a bounds check (Fix a heap overflow) 759 UDP: Check against the packet length first 760 VAT: Add some bounds checks 761 VTP: Add a test on Mgmt Domain Name length 762 VTP: Add bounds checks and filter out non-printable characters 763 VXLAN: Add a bound check and a test case 764 ZeroMQ: Fix an infinite loop 765 766 Tuesday October 25, 2016 mcr (a] sandelman.ca 767 Summary for 4.8.1 tcpdump release 768 Fix "-x" for Apple PKTAP and PPI packets 769 Improve separation frontend/backend (tcpdump/libnetdissect) 770 Fix display of timestamps with -tt, -ttt and -ttttt options 771 Add support for the Marvell Extended Distributed Switch Architecture header 772 Use PRIx64 to print a 64-bit number in hex. 773 Printer for HNCP (RFCs 7787 and 7788). 774 dagid is always an IPv6 address, not an opaque 128-bit string, and other fixes to RPL printer. 775 RSVP: Add bounds and length checks 776 OSPF: Do more bounds checking 777 Handle OpenSSL 1.1.x. 778 Initial support for the REdis Serialization Protocol known as RESP. 779 Add printing function for Generic Protocol Extension for VXLAN 780 draft-ietf-nvo3-vxlan-gpe-01 781 Network Service Header: draft-ietf-sfc-nsh-01 782 Don't recompile the filter if the new file has the same DLT. 783 Pass an adjusted struct pcap_pkthdr to the sub-printer. 784 Add three test cases for already fixed CVEs 785 CVE-2014-8767: OLSR 786 CVE-2014-8768: Geonet 787 CVE-2014-8769: AODV 788 Don't do the DDP-over-UDP heuristic first: GitHub issue #499. 789 Use the new debugging routines in libpcap. 790 Harmonize TCP source or destination ports tests with UDP ones 791 Introduce data types to use for integral values in packet structures. 792 RSVP: Fix an infinite loop 793 Support of Type 3 and Type 4 LISP packets. 794 Don't require IPv6 library support in order to support IPv6 addresses. 795 Many many changes to support libnetdissect usage. 796 Add a test that makes unaligned accesses: GitHub issue #478. 797 add a DNSSEC test case: GH #445 and GH #467. 798 BGP: add decoding of ADD-PATH capability 799 fixes to LLC header printing, and RFC948-style IP packets 800 801 Friday April 10, 2015 guy (a] alum.mit.edu 802 Summary for 4.7.4 tcpdump release 803 RPKI to Router Protocol: Fix Segmentation Faults and other problems 804 RPKI to Router Protocol: print strings with fn_printn() 805 wb: fix some bounds checks 806 807 Wednesday March 11, 2015 mcr (a] sandelman.ca 808 Summary for 4.7.3 tcpdump release 809 Capsicum fixes for FreeBSD 10 810 811 Tuesday March 10, 2015 mcr (a] sandelman.ca 812 Summary for 4.7.2 tcpdump release 813 DCCP: update Packet Types with RFC4340/IANA names 814 fixes for CVE-2015-0261: IPv6 mobility header check issue 815 fixes for CVE-2015-2153, 2154, 2155: kday packets 816 817 Friday Nov. 12, 2014 guy (a] alum.mit.edu 818 Summary for 4.7.0 tcpdump release 819 changes to hex printing of CDP packets 820 Fix PPI printing 821 Radius: update Packet Type Codes and Attribute Types with RFC/IANA names 822 Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support. 823 improvements to telnet printer, even if not -v 824 omit length for bcp, print-tcp uses it 825 formatting fixes for a bunch of protocols 826 new bounds checks for a number of protocols 827 split netflow 1,6, and 6 dissector up. 828 added geneve dissector 829 CVE-2014-9140 PPP dissector fixed. 830 831 Tuesday Sep. 2, 2014 mcr (a] sandelman.ca 832 Summary for 4.6.2 tcpdump release 833 fix out-of-source-tree builds: find libpcap that is out of source 834 better configure check for libsmi 835 836 Saturday Jul. 19, 2014 mcr (a] sandelman.ca 837 Summary for 4.6.1 tcpdump release 838 added FreeBSD capsicum 839 add a short option '#', same as long option '--number' 840 841 Wednesday Jul. 2, 2014 mcr (a] sandelman.ca 842 Summary for 4.6.0 tcpdump release 843 all of tcpdump is now using the new "NDO" code base (Thanks Denis!) 844 nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes 845 M3UA decode added. 846 many new test cases: 82 in 4.5.1 to 133 in 4.6.0 847 many improvements to travis continuous integration system: OSX, and Coverity options 848 cleaned up some unnecessary header files 849 Added bittok2str(). 850 a number of unaligned access faults fixed 851 -A flag does not consider CR to be printable anymore 852 fx.lebail took over coverity baby sitting 853 default snapshot size increased to 256K for accommodate USB captures 854 WARNING: this release contains a lot of very worthwhile code churn. 855 856 Wednesday Jan. 15, 2014 guy (a] alum.mit.edu 857 Summary for 4.5.2 tcpdump release 858 Man page fix 859 Fix crashes on SPARC 860 861 Monday Nov. 11, 2013 mcr (a] sandelman.ca 862 Summary for 4.5.1 tcpdump release 863 CREDITS file fixes 864 865 Thursday Nov. 7, 2013 mcr (a] sandelman.ca and guy (a] alum.mit.edu. 866 Summary for 4.5.0 tcpdump release 867 some NFSv4 fixes for printing 868 fix printing of unknown TCP options, and tcp fast-open 869 fixes for syslog parser 870 some gcc-version-specific flag tuning 871 adopt MacOS deprecation workarounds for openssl 872 improvements to babel printing 873 add OpenFlow 1.0 (no SSL) and test cases 874 GeoNet printer. 875 added STBC Rx support 876 improvements to DHCPv6 decoder 877 clarify which autoconf is needed 878 Point users to the the-tcpdump-group repository on GitHub rather 879 than the mcr repository 880 Add MSDP printer. 881 Fixed IPv6 check on Solaris and other OSes requiring extra 882 networking libraries. 883 Add support for VXLAN (draft-mahalingam-dutt-dcops-vxlan-03), 884 and add "vxlan" as an option for -T. 885 Add support for OTV (draft-hasmit-otv-04). 886 fixes for DLT_IEEE802_11_RADIO datalink types 887 added MPTCP decoder 888 889 Saturday April 6, 2013 guy (a] alum.mit.edu. 890 Summary for 4.4.0 tcpdump release 891 RPKI-RTR (RFC6810) is now official (TCP Port 323) 892 Fix detection of OpenSSL libcrypto. 893 Add DNSSL (RFC6106) support. 894 Add "radius" as an option for -T. 895 Update Action codes for handle_action function according to 896 802.11s amendment. 897 Decode DHCPv6 AFTR-Name option (RFC6334). 898 Updates for Babel. 899 Fix printing of infinite lifetime in ICMPv6. 900 Added support for SPB, SPBM Service Identifier, and Unicast 901 Address sub-TLV in ISIS. 902 Decode RIPv2 authentication up to RFC4822. 903 Fix RIP Request/full table decoding issues. 904 On Linux systems with cap-ng.h, drop root privileges 905 using Linux Capabilities. 906 Add support for reading multiple files. 907 Add MS NLB heartbeat printer. 908 Separate multiple nexthops in BGP. 909 910 Wednesday November 28, 2012 guy (a] alum.mit.edu. 911 Summary for 4.3.1 tcpdump release 912 Print "LLDP, length N" for LLDP packets even when not in verbose 913 mode, so something is printed even if only the timestamp is 914 present 915 Document "-T carp" 916 Print NTP poll interval correctly (it's an exponent, so print 917 both its raw value and 2^value) 918 Document that "-e" is used to get MAC addresses 919 More clearly document that you need to escape or quote 920 backslashes in filter expressions on the command line 921 Fix some "the the" in the man page 922 Use the right maximum path length 923 Don't treat 192_1_2, when passed to -i, as an interface number 924 925 Friday April 3, 2012. mcr (a] sandelman.ca. 926 Summary for 4.3.0 tcpdump release 927 fixes for forces: SPARSE data (per RFC 5810) 928 some more test cases added 929 updates to documentation on -l, -U and -w flags. 930 Fix printing of BGP optional headers. 931 Tried to include DLT_PFSYNC support, failed due to headers required. 932 added TIPC support. 933 Fix LLDP Network Policy bit definitions. 934 fixes for IGMPv3's Max Response Time: it is in units of 0.1 second. 935 SIGUSR1 can be used rather than SIGINFO for stats 936 permit -n flag to affect print-ip for protocol numbers 937 ND_OPT_ADVINTERVAL is in milliseconds, not seconds 938 Teach PPPoE parser about RFC 4638 939 940 941 Friday December 9, 2011. guy (a] alum.mit.edu. 942 Summary for 4.2.1 tcpdump release 943 Only build the Babel printer if IPv6 is enabled. 944 Support Babel on port 6696 as well as 6697. 945 Include ppi.h in release tarball. 946 Include all the test files in the release tarball, and don't 947 "include" test files that no longer exist. 948 Don't assume we have <rpc/rpc.h> - check for it. 949 Support "-T carp" as a way of dissecting IP protocol 112 as CARP 950 rather than VRRP. 951 Support Hilscher NetAnalyzer link-layer header format. 952 Constify some pointers and fix compiler warnings. 953 Get rid of never-true test. 954 Fix an unintended fall-through in a case statement in the ARP 955 printer. 956 Fix several cases where sizeof(sizeof(XXX)) was used when just 957 sizeof(XXX) was intended. 958 Make stricter sanity checks in the ES-IS printer. 959 Get rid of some GCCisms that caused builds to fai with compilers 960 that don't support them. 961 Fix typo in man page. 962 Added length checks to Babel printer. 963 964 Sunday July 24, 2011. mcr (a] sandelman.ca. 965 Summary for 4.2.+ 966 merged 802.15.4 decoder from Dmitry Eremin-Solenikov <dbaryshkov 967 at gmail dot com> 968 updates to forces for new port numbers 969 Use "-H", not "-h", for the 802.11s option. (-h always help) 970 Better ICMPv6 checksum handling. 971 add support for the RPKI/Router Protocol, per -ietf-sidr-rpki-rtr-12 972 get rid of uuencoded pcap test files, git can do binary. 973 sFlow changes for 64-bit counters. 974 fixes for PPI packet header handling and printing. 975 Add DCB Exchange protocol (DCBX) version 1.01. 976 Babel dissector, from Juliusz Chroboczek and Grgoire Henry. 977 improvements to radiotap for rate values > 127. 978 Many improvements to ForCES decode, including fix SCTP TML port 979 updated RPL type code to RPL-17 draft 980 Improve printout of DHCPv6 options. 981 added support and test case for QinQ (802.1q VLAN) packets 982 Handle DLT_IEEE802_15_4_NOFCS like DLT_IEEE802_15_4. 983 Build fixes for Sparc and other machines with alignment restrictions. 984 Merged changes from Debian package. 985 PGM: Add ACK decoding and add PGMCC DATA and FEEDBACK options. 986 Build fixes for OSX (Snow Leopard and others) 987 Add support for IEEE 802.15.4 packets 988 989 Tue. July 20, 2010. guy (a] alum.mit.edu. 990 Summary for 4.1.2 tcpdump release 991 If -U is specified, flush the file after creating it, so it's 992 not zero-length 993 Fix TCP flags output description, and some typos, in the man 994 page 995 Add a -h flag, and only attempt to recognize 802.11s mesh 996 headers if it's set 997 When printing the link-layer type list, send *all* output to 998 stderr 999 Include the CFLAGS setting when configure was run in the 1000 compiler flags 1001 1002 Thu. April 1, 2010. guy (a] alum.mit.edu. 1003 Summary for 4.1.1 tcpdump release 1004 Fix build on systems with PF, such as FreeBSD and OpenBSD. 1005 Don't blow up if a zero-length link-layer address is passed to 1006 linkaddr_string(). 1007 1008 Thu. March 11, 2010. ken (a] netfunctional.ca/guy (a] alum.mit.edu. 1009 Summary for 4.1.0 tcpdump release 1010 Fix printing of MAC addresses for VLAN frames with a length 1011 field 1012 Add some additional bounds checks and use the EXTRACT_ macros 1013 more 1014 Add a -b flag to print the AS number in BGP packets in ASDOT 1015 notation rather than ASPLAIN notation 1016 Add ICMPv6 RFC 5006 support 1017 Decode the access flags in NFS access requests 1018 Handle the new DLT_ for memory-mapped USB captures on Linux 1019 Make the default snapshot (-s) the maximum 1020 Print name of device (when -L is used) 1021 Support for OpenSolaris (and SXCE build 125 and later) 1022 Print new TCP flags 1023 Add support for RPL DIO 1024 Add support for TCP User Timeout (UTO) 1025 Add support for non-standard Ethertypes used by 3com PPPoE gear 1026 Add support for 802.11n and 802.11s 1027 Add support for Transparent Ethernet Bridge ethertype in GRE 1028 Add 4 byte AS support for BGP printer 1029 Add support for the MDT SAFI 66 BG printer 1030 Add basic IPv6 support to print-olsr 1031 Add USB printer 1032 Add printer for ForCES 1033 Handle frames with an FCS 1034 Handle 802.11n Control Wrapper, Block Acq Req and Block Ack frames 1035 Fix TCP sequence number printing 1036 Report 802.2 packets as 802.2 instead of 802.3 1037 Don't include -L/usr/lib in LDFLAGS 1038 On x86_64 Linux, look in lib64 directory too 1039 Lots of code clean ups 1040 Autoconf clean ups 1041 Update testcases to make output changes 1042 Fix compiling with/out smi (--with{,out}-smi) 1043 Fix compiling without IPv6 support (--disable-ipv6) 1044 1045 Mon. October 27, 2008. ken (a] netfunctional.ca. Summary for 4.0.0 tcpdump release 1046 Add support for Bluetooth Sniffing 1047 Add support for Realtek Remote Control Protocol (openrrcp.org.ru) 1048 Add support for 802.11 AVS 1049 Add support for SMB over TCP 1050 Add support for 4 byte BGP AS printing 1051 Add support for compiling on case-insensitive file systems 1052 Add support for ikev2 printing 1053 Update support for decoding AFS 1054 Update DHCPv6 printer 1055 Use newer libpcap API's (allows -B option on all platforms) 1056 Add -I to turn on monitor mode 1057 Bugfixes in lldp, lspping, dccp, ESP, NFS printers 1058 Cleanup unused files and various cruft 1059 1060 Mon. September 10, 2007. ken (a] xelerance.com. Summary for 3.9.8 tcpdump release 1061 Rework ARP printer 1062 Rework OSPFv3 printer 1063 Add support for Frame-Relay ARP 1064 Decode DHCP Option 121 (RFC 3442 Classless Static Route) 1065 Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121 1066 TLV: Add support for Juniper .pcap extensions 1067 Print EGP header in new-world-order style 1068 Converted print-isakmp.c to NETDISSECT 1069 Moved AF specific stuff into af.h 1070 Test subsystem now table driven, and saves outputs and diffs to one place 1071 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 1072 libpcap files on an OS other than where the file was generated 1073 1074 1075 Wed. July 23, 2007. mcr (a] xelerance.com. Summary for 3.9.7 libpcap release 1076 1077 NFS: Print unsigned values as such. 1078 RX: parse safely. 1079 BGP: fixes for IPv6-less builds. 1080 801.1ag: use standard codepoint. 1081 use /dev/bpf on systems with such a device. 1082 802.11: print QoS data, avoid dissect of no-data frame, ignore padding. 1083 smb: make sure that we haven't gone past the end of the captured data. 1084 smb: squelch an uninitialized complaint from coverity. 1085 NFS: from NetBSD; don't interpret the reply as a possible NFS reply 1086 if it got MSG_DENIED. 1087 BGP: don't print TLV values that didn't fit, from www.digit-labs.org. 1088 revised INSTALL.txt about libpcap dependency. 1089 1090 Wed. April 25, 2007. ken (a] xelerance.com. Summary for 3.9.6 tcpdump release 1091 Update man page to reflect changes to libpcap 1092 Changes to both TCP and IP Printer Output 1093 Fix a potential buffer overflow in the 802.11 printer 1094 Print basic info about a few more Cisco LAN protocols. 1095 mDNS cleanup 1096 ICMP MPLS rework of the extension code 1097 bugfix: use the correct codepoint for the OSPF simple text auth token 1098 entry, and use safeputs to print the password. 1099 Add support in pflog for additional values 1100 Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects 1101 Add support for the Message-id NACK c-type. 1102 Add support for 802.3ah loopback ctrl msg 1103 Add support for Multiple-STP as per 802.1s 1104 Add support for rapid-SPT as per 802.1w 1105 Add support for CFM Link-trace msg, Link-trace-Reply msg, 1106 Sender-ID tlv, private tlv, port, interface status 1107 Add support for unidirectional link detection as per 1108 https://tools.ietf.org/id/draft-foschiano-udld-02.txt 1109 Add support for the olsr protocol as per RFC 3626 plus the LQ 1110 extensions from olsr.org 1111 Add support for variable-length checksum in DCCP, as per section 9 of 1112 RFC 4340. 1113 Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree 1114 Add support for Multiple-STP as per 802.1s 1115 Add support for the cisco proprietary 'dynamic trunking protocol' 1116 Add support for the cisco proprietary VTP protocol 1117 Update dhcp6 options table as per IETF standardization activities 1118 1119 1120 Tue. September 19, 2006. ken (a] xelerance.com. Summary for 3.9.5 tcpdump release 1121 1122 Fix compiling on AIX (, at end of ENUM) 1123 Updated list of DNS RR typecodes 1124 Use local Ethernet defs on WIN32 1125 Add support for Frame-Relay ARP 1126 Fixes for compiling under MSVC++ 1127 Add support for parsing Juniper .pcap files 1128 Add support for FRF.16 Multilink Frame-Relay (DLT_MFR) 1129 Rework the OSPFv3 printer 1130 Fix printing for 4.4BSD/NetBSD NFS Filehandles 1131 Add support for Cisco style NLPID encapsulation 1132 Add cisco prop. eigrp related, extended communities 1133 Add support for BGP signaled VPLS 1134 Cleanup the bootp printer 1135 Add support for PPP over Frame-Relay 1136 Add some bounds checking to the IP options code, and clean up 1137 the options output a bit. 1138 Add additional modp groups to ISAKMP printer 1139 Add support for Address-Withdraw and Label-Withdraw Msgs 1140 Add support for the BFD Discriminator TLV 1141 Fixes for 64bit compiling 1142 Add support for PIMv2 checksum verification 1143 Add support for further dissection of the IPCP Compression Option 1144 Add support for Cisco's proposed VQP protocol 1145 Add basic support for keyed authentication TCP option 1146 Lots of minor cosmetic changes to output printers 1147 1148 1149 Mon. September 19, 2005. ken (a] xelerance.com. Summary for 3.9.4 tcpdump release 1150 Decoder support for more Juniper link-layer types 1151 Fix a potential buffer overflow (although it can't occur in 1152 practice). 1153 Fix the handling of unknown management frame types in the 802.11 1154 printer. 1155 Add FRF.16 support, fix various Frame Relay bugs. 1156 Add support for RSVP integrity objects, update fast-reroute 1157 object printer to latest spec. 1158 Clean up documentation of vlan filter expression, document mpls 1159 filter expression. 1160 Document new pppoed and pppoes filter expressions. 1161 Update diffserver-TE codepoints as per RFC 4124. 1162 Spelling fixes in ICMPv6. 1163 Don't require any fields other than flags to be present in IS-IS 1164 restart signaling TLVs, and only print the system ID in 1165 those TLVs as system IDs, not as node IDs. 1166 Support for DCCP. 1167 1168 Tue. July 5, 2005. ken (a] xelerance.com. Summary for 3.9.3 tcpdump release 1169 1170 Option to chroot() when dropping privs 1171 Fixes for compiling on nearly every platform, 1172 including improved 64bit support 1173 Many new testcases 1174 Support for sending packets 1175 Many compilation fixes on most platforms 1176 Fixes for recent version of GCC to eliminate warnings 1177 Improved Unicode support 1178 1179 Decoders & DLT Changes, Updates and New: 1180 AES ESP support 1181 Juniper ATM, FRF.15, FRF.16, PPPoE, 1182 ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC 1183 GGSN,ES,MONITOR,SERVICES 1184 L2VPN 1185 Axent Raptor/Symantec Firewall 1186 TCP-MD5 (RFC 2385) 1187 ESP-in-UDP (RFC 3948) 1188 ATM OAM 1189 LMP, LMP Service Discovery 1190 IP over FC 1191 IP over IEEE 1394 1192 BACnet MS/TP 1193 SS7 1194 LDP over TCP 1195 LACP, MARKER as per 802.3ad 1196 PGM (RFC 3208) 1197 LSP-PING 1198 G.7041/Y.1303 Generic Framing Procedure 1199 EIGRP-IP, EIGRP-IPX 1200 ICMP6 1201 Radio - via radiotap 1202 DHCPv6 1203 HDLC over PPP 1204 1205 Tue. March 30, 2004. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8.3 release 1206 1207 No changes from 3.8.2. Version bumped only to maintain consistency 1208 with libpcap 0.8.3. 1209 1210 Mon. March 29, 2004. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8.2 release 1211 1212 Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184 1213 https://web.archive.org/web/20160328035955/https://www.rapid7.com/resources/advisories/R7-0017.jsp 1214 IP-over-IEEE1394 printing. 1215 some MINGW32 changes. 1216 updates for autoconf 2.5 1217 fixes for print-aodv.c - check for too short packets 1218 formatting changes to print-ascii for hex output. 1219 check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c, 1220 print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c, 1221 print-ip.c, print-lwres.c, print-ospf.c, print-pim.c, 1222 print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c 1223 print-ether.c - better handling of unknown types. 1224 print-isoclns.c - additional decoding of types. 1225 print-llc.c - strings for LLC names added. 1226 print-pfloc.c - various enhancements 1227 print-radius.c - better decoding to strings. 1228 1229 Wed. November 12, 2003. mcr (a] sandelman.ottawa.on.ca. Summary for 3.8 release 1230 1231 changed syntax of -E argument so that multiple SAs can be decrypted 1232 fixes for Digital Unix headers and Documentation 1233 __attribute__ fixes 1234 CDP changes from Terry Kennedy <terry (a] tmk.com>. 1235 IPv6 mobility updates from Kazushi Sugyo <sugyo (a] pb.jp.nec.com> 1236 Fixes for ASN.1 decoder for 2.100.3 forms. 1237 Added a count of packets received and processed to clarify numbers. 1238 Incorporated WinDUMP patches for Win32 builds. 1239 PPPoE payload length headers. 1240 Fixes for HP C compiler builds. 1241 Use new pcap_breakloop() and pcap_findalldevs() if we can. 1242 BGP output split into multiple lines. 1243 Fixes to 802.11 decoding. 1244 Fixes to PIM decoder. 1245 SuperH is a CPU that can't handle unaligned access. Many fixes for 1246 unaligned access work. 1247 Fixes to Frame-Relay decoder for Q.933/922 frames. 1248 Clarified when Solaris can do captures as non-root. 1249 Added tests/ subdir for examples/regression tests. 1250 New -U flag. -flush stdout after every packet 1251 New -A flag -print ascii only 1252 support for decoding IS-IS inside Cisco HDLC Frames 1253 more verbosity for tftp decoder 1254 mDNS decoder 1255 new BFD decoder 1256 cross compilation patches 1257 RFC 3561 AODV support. 1258 UDP/TCP pseudo-checksum properly for source-route options. 1259 sanitized all files to modified BSD license 1260 Add support for RFC 2625 IP-over-Fibre Channel. 1261 fixes for DECnet support. 1262 Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI. 1263 RFC 2684 encapsulation of BPDUs. 1264 1265 Tuesday, February 25, 2003. fenner (a] research.att.com. 3.7.2 release 1266 1267 Fixed infinite loop when parsing invalid isakmp packets. 1268 (reported by iDefense; already fixed in CVS) 1269 Fixed infinite loop when parsing invalid BGP packets. 1270 Fixed buffer overflow with certain invalid NFS packets. 1271 Pretty-print unprintable network names in 802.11 printer. 1272 Handle truncated nbp (appletalk) packets. 1273 Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt 1274 Print IP protocol name even if we don't have a printer for it. 1275 Print IP protocol name or number for fragments. 1276 Print the whole MPLS label stack, not just the top label. 1277 Print request header and file handle for NFS v3 FSINFO and PATHCONF 1278 requests. 1279 Fix NFS packet truncation checks. 1280 Handle "old" DR-Priority and Bidir-Capable PIM HELLO options. 1281 Handle unknown RADIUS attributes properly. 1282 Fix an ASN.1 parsing error that would cause e.g. the OID 1283 2.100.3 to be misrepresented as 4.20.3 . 1284 1285 Monday, January 21, 2002. mcr (a] sandelman.ottawa.on.ca. Summary for 3.7 release 1286 keyword "ipx" added. 1287 Better OSI/802.2 support on Linux. 1288 IEEE 802.11 support, from clenahan (a] fortresstech.com, achirica (a] ttd.net. 1289 LLC SAP support for FDDI/token ring/RFC-1483 style ATM 1290 BXXP protocol was replaced by the BEEP protocol; 1291 improvements to SNAP demux. 1292 Changes to "any" interface documentation. 1293 Documentation on pcap_stats() counters. 1294 Fix a memory leak found by Miklos Szeredi - pcap_ether_aton(). 1295 Added MPLS encapsulation decoding per RFC3032. 1296 DNS dissector handles TKEY, TSIG and IXFR. 1297 adaptive SLIP interface patch from Igor Khristophorov <igor (a] atdot.org> 1298 SMB printing has much improved bounds checks 1299 OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging 1300 Zephyr support, from Nickolai Zeldovich <kolya (a] MIT.EDU>. 1301 Solaris - devices with digits in them. Stefan Hudson <hudson (a] mbay.net> 1302 IPX socket 0x85be is for Cisco EIGRP over IPX. 1303 Improvements to fragmented ESP handling. 1304 SCTP support from Armando L. Caro Jr. <acaro (a] mail.eecis.udel.edu> 1305 Linux ARPHDR_ATM support fixed. 1306 Added a "netbeui" keyword, which selects NetBEUI packets. 1307 IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option. 1308 Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus (a] task.com.br>. 1309 Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm" 1310 Better Linux libc5 compat. 1311 BIND9 lwres dissector added. 1312 MIPS and SPARC get strict alignment macros (affects print-bgp.c) 1313 Apple LocalTalk LINKTYPE_ reserved. 1314 New time stamp formats documented. 1315 DHCP6 updated to draft-22.txt spec. 1316 ICMP types/codes now accept symbolic names. 1317 Add SIGINFO handler from LBL 1318 encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer (a] mond.at>. 1319 now we are -Wstrict-prototype clean. 1320 NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin (a] netbsd.org>. 1321 PPPoE dissector cleaned up. 1322 Support for LocalTalk hardware, from Uns Lider <unslider (a] miranda.org>. 1323 In dissector, now the caller prints the IP addresses rather than proto. 1324 cjclark (a] alum.mit.edu: print the IP proto for non-initial fragments. 1325 LLC frames with a DSAP and LSAP of 0xe0 are IPX frames. 1326 Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX. 1327 captures on the "any" device won't be done in promiscuous mode 1328 Token Ring support on DLPI - Onno van der Linden <onno (a] simplex.nl> 1329 ARCNet support, from NetBSD. 1330 HSRP dissector, from Julian Cowley <julian (a] lava.net>. 1331 Handle (GRE-encapsulated) PPTP 1332 added -C option to rotate save file every optarg * 1,000,000 bytes. 1333 support for "vrrp" name - NetBSD, by Klaus Klein <kleink (a] netbsd.org>. 1334 PPTP support, from Motonori Shindo <mshindo (a] mshindo.net>. 1335 IS-IS over PPP support, from Hannes Gredler <hannes (a] juniper.net>. 1336 CNFP support for IPv6,format. Harry Raaymakers <harryr (a] connect.com.au>. 1337 ESP printing updated to RFC2406. 1338 HP-UX can now handle large number of PPAs. 1339 MSDP printer added. 1340 L2TP dissector improvements from Motonori Shindo. 1341 1342 Tuesday January 9, 2001. mcr (a] sandelman.ottawa.on.ca. Summary for 3.6 release 1343 Cleaned up documentation. 1344 Promisc mode fixes for Linux 1345 IPsec changes/cleanups. 1346 Alignment fixes for picky architectures 1347 1348 Removed dependency on native headers for packet dissectors. 1349 Removed Linux specific headers that were shipped 1350 1351 libpcap changes provide for exchanging capture files between 1352 systems. Save files now have well known PACKET_ values instead of 1353 depending upon system dependent mappings of DLT_* types. 1354 1355 Support for computing/checking IP and UDP/TCP checksums. 1356 1357 Updated autoconf stock files. 1358 1359 IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6, 1360 1361 Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp, 1362 timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk 1363 1364 Added filtering support for: VLANs, ESIS, ISIS 1365 1366 Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP, 1367 L2TP, PPPoE 1368 1369 HP-UX 11.0 -- find the right dlpi device. 1370 Solaris 8 - IPv6 works 1371 Linux - Added support for an "any" device to capture on all interfaces 1372 1373 Security fixes: buffer overrun audit done. Strcpy replaced with 1374 strlcpy, sprintf replaced with snprintf. 1375 Look for lex problems, and warn about them. 1376 1377 1378 v3.5 Fri Jan 28 18:00:00 PST 2000 1379 1380 Bill Fenner <fenner (a] research.att.com> 1381 - switch to config.h for autoconf 1382 - unify RCSID strings 1383 - Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser 1384 - Really fix the RIP printer 1385 - Fix MAC address -> name translation. 1386 - some -Wall -Wformat fixes 1387 - update makemib to parse much of SMIv2 1388 - Print TCP sequence # with -vv even if you normally wouldn't 1389 - Print as much of IP/TCP/UDP headers as possible even if truncated. 1390 1391 itojun (a] iijlab.net 1392 - -X will make a ascii dump. from netbsd. 1393 - telnet command sequence decoder (ff xx xx). from netbsd. 1394 - print-bgp.c: improve options printing. ugly code exists for 1395 unaligned option parsing (need some fix). 1396 - const poisoning in SMB decoder. 1397 - -Wall -Werror clean checks. 1398 - bring in KAME IPv6/IPsec decoding code. 1399 1400 Assar Westerlund <assar (a] sics.se> 1401 - SNMPv2 and SNMPv3 printer 1402 - If compiled with libsmi, tcpdump can load MIBs on the fly to decode 1403 SNMP packets. 1404 - Incorporate NFS parsing code from NetBSD. Adds support for nfsv3. 1405 - portability fixes 1406 - permit building in different directories. 1407 1408 Ken Hornstein <kenh (a] cmf.nrl.navy.mil> 1409 - bring in code at 1410 /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing 1411 AFS3 packets 1412 1413 Andrew Tridgell <tridge (a] linuxcare.com> 1414 - SMB printing code 1415 1416 Love <lha (a] stacken.kth.se> 1417 - print-rx.c: add code for printing MakeDir and StoreStatus. Also 1418 change date format to the right one. 1419 1420 Michael C. Richardson <mcr (a] sandelman.ottawa.on.ca> 1421 - Created tcpdump.org repository 1422 1423 v3.4 Sat Jul 25 12:40:55 PDT 1998 1424 1425 - Hardwire Linux slip support since it's too hard to detect. 1426 1427 - Redo configuration of "network" libraries (-lsocket and -lnsl) to 1428 deal with IRIX. Thanks to John Hawkinson (jhawk (a] mit.edu) 1429 1430 - Added -a which tries to translate network and broadcast addresses to 1431 names. Suggested by Rob van Nieuwkerk (robn (a] verdi.et.tudelft.nl) 1432 1433 - Added a configure option to disable gcc. 1434 1435 - Added a "raw" packet printer. 1436 1437 - Not having an interface address is no longer fatal. Requested by John 1438 Hawkinson. 1439 1440 - Rework signal setup to accommodate Linux. 1441 1442 - OSPF truncation check fix. Also display the type of OSPF packets 1443 using MD5 authentication. Thanks to Brian Wellington 1444 (bwelling (a] tis.com) 1445 1446 - Fix truncation check bugs in the Kerberos printer. Reported by Ezra 1447 Peisach (epeisach (a] mit.edu) 1448 1449 - Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka 1450 (plonka (a] mfa.com) 1451 1452 - Specify full install target as a way of detecting if install 1453 directory does not exist. Thanks to Dave Plonka. 1454 1455 - Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie 1456 (paul (a] vix.com) 1457 1458 - Fix off-by-one bug when testing size of ethernet packets. Thanks to 1459 Marty Leisner (leisner (a] sdsp.mc.xerox.com) 1460 1461 - Add a local autoconf macro to check for routines in libraries; the 1462 autoconf version is broken (it only puts the library name in the 1463 cache variable name). Thanks to John Hawkinson. 1464 1465 - Add a local autoconf macro to check for types; the autoconf version 1466 is broken (it uses grep instead of actually compiling a code fragment). 1467 1468 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 1469 formats. 1470 1471 - Extend OSF ip header workaround to versions 1 and 2. 1472 1473 - Fix some signed problems in the nfs printer. As reported by David 1474 Sacerdote (davids (a] silence.secnet.com) 1475 1476 - Detect group wheel and use it as the default since BSD/OS' install 1477 can't hack numeric groups. Reported by David Sacerdote. 1478 1479 - AIX needs special loader options. Thanks to Jonathan I. Kamens 1480 (jik (a] cam.ov.com) 1481 1482 - Fixed the nfs printer to print port numbers in decimal. Thanks to 1483 Kent Vander Velden (graphix (a] iastate.edu) 1484 1485 - Find installed libpcap in /usr/local/lib when not using gcc. 1486 1487 - Disallow network masks with non-network bits set. 1488 1489 - Attempt to detect "egcs" versions of gcc. 1490 1491 - Add missing closing double quotes when displaying bootp strings. 1492 Reported by Viet-Trung Luu (vluu (a] picard.math.uwaterloo.ca) 1493 1494 v3.3 Sat Nov 30 20:56:27 PST 1996 1495 1496 - Added Linux support. 1497 1498 - GRE encapsulated packet printer thanks to John Hawkinson 1499 (jhawk (a] mit.edu) 1500 1501 - Rewrite gmt2local() to avoid problematic os dependencies. 1502 1503 - Suppress nfs truncation message on errors. 1504 1505 - Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro. 1506 Reported by Joachim Ott (ott (a] ardala.han.de) 1507 1508 - Enable "ip_hl vs. ip_vhl" workaround for OSF4 too. 1509 1510 - Print arp hardware type in host order. Thanks to Onno van der Linden 1511 (onno (a] simplex.nl) 1512 1513 - Avoid solaris compiler warnings. Thanks to Bruce Barnett 1514 (barnett (a] grymoire.crd.ge.com) 1515 1516 - Fix rip printer to not print one more route than is actually in the 1517 packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier (a] imag.fr) and 1518 Bill Fenner (fenner (a] parc.xerox.com) 1519 1520 - Use autoconf endian detection since BYTE_ORDER isn't defined on all systems. 1521 1522 - Fix dvmrp printer truncation checks and add a dvmrp probe printer. 1523 Thanks to Danny J. Mitzel (mitzel (a] ipsilon.com) 1524 1525 - Rewrite ospf printer to improve truncation checks. 1526 1527 - Don't parse tcp options past the EOL. As noted by David Sacerdote 1528 (davids (a] secnet.com). Also, check tcp options to make sure they ar 1529 actually in the tcp header (in addition to the normal truncation 1530 checks). Fix the SACK code to print the N blocks (instead of the 1531 first block N times). 1532 1533 - Don't say really small UDP packets are truncated just because they 1534 aren't big enough to be a RPC. As noted by David Sacerdote. 1535 1536 v3.2.1 Sun Jul 14 03:02:26 PDT 1996 1537 1538 - Added rfc1716 icmp codes as suggested by Martin Fredriksson 1539 (martin (a] msp.se) 1540 1541 - Print mtu for icmp unreach need frag packets. Thanks to John 1542 Hawkinson (jhawk (a] mit.edu) 1543 1544 - Decode icmp router discovery messages. Thanks to Jeffrey Honig 1545 (jch (a] bsdi.com) 1546 1547 - Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida 1548 (kushida (a] trl.ibm.co.jp) 1549 1550 - Check igmp checksum if possible. Thanks to John Hawkinson. 1551 1552 - Made changes for SINIX. Thanks to Andrej Borsenkow 1553 (borsenkow.msk (a] sni.de) 1554 1555 - Use autoconf's idea of the top level directory in install targets. 1556 Thanks to John Hawkinson. 1557 1558 - Avoid infinite loop in tcp options printing code. Thanks to Jeffrey 1559 Mogul (mogul (a] pa.dec.com) 1560 1561 - Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop. 1562 Thanks to John Hawkinson. 1563 1564 - Added some more packet truncation checks. 1565 1566 - On systems that have it, use sigset() instead of signal() since 1567 signal() has different semantics on these systems. 1568 1569 - Fixed some more alignment problems on the alpha. 1570 1571 - Add code to massage unprintable characters in the domain and ipx 1572 printers. Thanks to John Hawkinson. 1573 1574 - Added explicit netmask support. Thanks to Steve Nuchia 1575 (steve (a] research.oknet.com) 1576 1577 - Add "sca" keyword (for DEC cluster services) as suggested by Terry 1578 Kennedy (terry (a] spcvxa.spc.edu) 1579 1580 - Add "atalk" keyword as suggested by John Hawkinson. 1581 1582 - Added an igrp printer. Thanks to Francis Dupont 1583 (francis.dupont (a] inria.fr) 1584 1585 - Print IPX net numbers in hex a la Novell Netware. Thanks to Terry 1586 Kennedy (terry (a] spcvxa.spc.edu) 1587 1588 - Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin 1589 (pascal.hennequin (a] hugo.int-evry.fr) 1590 1591 - Added some ETHERTYPEs missing on some systems. 1592 1593 - Added truncated packet macros and various checks. 1594 1595 - Fixed endian problems with the DECnet printer. 1596 1597 - Use $CC when checking gcc version. Thanks to Carl Lindberg 1598 (carl_lindberg (a] blacksmith.com) 1599 1600 - Fixes for AIX (although this system is not yet supported). Thanks to 1601 John Hawkinson. 1602 1603 - Fix bugs in the autoconf misaligned accesses code fragment. 1604 1605 - Include sys/param.h to get BYTE_ORDER in a few places. Thanks to 1606 Pavlin Ivanov Radoslavov (pavlin (a] cs.titech.ac.jp) 1607 1608 v3.2 Sun Jun 23 02:28:10 PDT 1996 1609 1610 - Print new icmp unreachable codes as suggested by Martin Fredriksson 1611 (martin (a] msp.se). Also print code value when unknown for icmp redirect 1612 and time exceeded. 1613 1614 - Fix an alignment endian bug in getname(). Thanks to John Hawkinson. 1615 1616 - Define "new" domain record types if not found in arpa/nameserv.h. 1617 Resulted from a suggestion from John Hawkinson (jhawk (a] mit.edu). Also 1618 fixed an endian bug when printing mx record and added some new record 1619 types. 1620 1621 - Added RIP V2 support. Thanks to Jeffrey Honig (jch (a] bsdi.com) 1622 1623 - Added T/TCP options printing. As suggested by Richard Stevens 1624 (rstevens (a] noao.edu) 1625 1626 - Use autoconf to detect architectures that can't handle misaligned 1627 accesses. 1628 1629 v3.1 Thu Jun 13 20:59:32 PDT 1996 1630 1631 - Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd 1632 and bind (as suggested by Charles Hannum). 1633 1634 - Port to GNU autoconf. 1635 1636 - Add support for printing DVMRP and PIM traffic thanks to 1637 Havard Eidnes (Havard.Eidnes (a] runit.sintef.no). 1638 1639 - Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian 1640 define being referenced. Reported by Terry Kennedy. 1641 1642 - Minor fixes to the man page thanks to Mark Andrews. 1643 1644 - Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah 1645 (bmah (a] cs.berkeley.edu). 1646 1647 - Added support for new dns types, thanks to Rainer Orth. 1648 1649 - Fixed tftp_print() to print the block number for ACKs. 1650 1651 - Document -dd and -ddd. Resulted from a bug report from Charlie Slater 1652 (cslater (a] imatek.com). 1653 1654 - Check return status from malloc/calloc/etc. 1655 1656 - Check return status from pcap_loop() so we can print an error and 1657 exit with a bad status if there were problems. 1658 1659 - Bail if ip option length is <= 0. Resulted from a bug report from 1660 Darren Reed (darrenr (a] vitruvius.arbld.unimelb.edu.au). 1661 1662 - Print out a little more information for sun rpc packets. 1663 1664 - Add support for Kerberos 4 thanks to John Hawkinson (jhawk (a] mit.edu). 1665 1666 - Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were 1667 wrong on little endian machines). 1668 1669 - Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford 1670 (crawdad (a] fnal.gov). 1671 1672 - Fix ntp_print() to not print garbage when the stratum is 1673 "unspecified." Thanks to Deus Ex Machina (root (a] belle.bork.com). 1674 1675 - Rewrote tcp options printer code to check for truncation. Added 1676 selective acknowledgment case. 1677 1678 - Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig 1679 (jch (a] bsdi.com) 1680 1681 - Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one 1682 octet for the sa_family member. Thanks to Yoshitaka Tokugawa 1683 (toku (a] dit.co.jp) 1684 1685 - Don't checksum ip header if we don't have all of it. Thanks to John 1686 Hawkinson (jhawk (a] mit.edu). 1687 1688 - Print out hostnames if possible in egp printer. Thanks to Jeffrey 1689 Honig (jhc (a] bsdi.com) 1690 1691 1692 v3.1a1 Wed May 3 19:21:11 PDT 1995 1693 1694 - Include time.h when SVR4 is defined to avoid problems under Solaris 1695 2.3. 1696 1697 - Fix etheraddr_string() in the ETHER_SERVICE to return the saved 1698 strings, not the local buffer. Thanks to Stefan Petri 1699 (petri (a] ibr.cs.tu-bs.de). 1700 1701 - Detect when pcap raises the snaplen (e.g. with snit). Print a warning 1702 that the selected value was not used. Thanks to Pascal Hennequin 1703 (Pascal.Hennequin (a] hugo.int-evry.fr). 1704 1705 - Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin. 1706 1707 - BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry (a] spcvxa.spc.edu). 1708 1709 v3.0.3 Sun Oct 1 18:35:00 GMT 1995 1710 1711 - Although there never was a 3.0.3 release, the linux boys cleverly 1712 "released" one in late 1995. 1713 1714 v3.0.2 Thu Apr 20 21:28:16 PDT 1995 1715 1716 - Change configuration to not use gcc v2 flags with gcc v1. 1717 1718 - Redo gmt2local() so that it works under BSDI (which seems to return 1719 an empty timezone struct from gettimeofday()). Based on report from 1720 Terry Kennedy (terry (a] spcvxa.spc.edu). 1721 1722 - Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based 1723 on report from Mark Andrews (mandrews (a] alias.com). 1724 1725 - Don't pass cc flags to gcc. Resulted from a bug report from Rainer 1726 Orth (ro (a] techfak.uni-bielefeld.de). 1727 1728 - Fixed printout of connection id for uncompressed tcp slip packets. 1729 Resulted from a bug report from Richard Stevens (rstevens (a] noao.edu). 1730 1731 - Hack around deficiency in Ultrix's make. 1732 1733 - Add ETHERTYPE_TRAIL define which is missing from irix5. 1734 1735 v3.0.1 Wed Aug 31 22:42:26 PDT 1994 1736 1737 - Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4. 1738 1739 v3.0 Mon Jun 20 19:23:27 PDT 1994 1740 1741 - Added support for printing tcp option timestamps thanks to 1742 Mark Andrews (mandrews (a] alias.com). 1743 1744 - Reorganize protocol dumpers to take const pointers to packets so they 1745 never change the contents (i.e., they used to do endian conversions 1746 in place). Previously, whenever more than one pass was taken over 1747 the packet, the packet contents would be dumped incorrectly (i.e., 1748 the output form -x would be wrong on little endian machines because 1749 the protocol dumpers would modify the data). Thanks to Charles Hannum 1750 (mycroft (a] gnu.ai.mit.edu) for reporting this problem. 1751 1752 - Added support for decnet protocol dumping thanks to Jeff Mogul 1753 (mogul (a] pa.dec.com). 1754 1755 - Fix bug that caused length of packet to be incorrectly printed 1756 (off by ether header size) for unknown ethernet types thanks 1757 to Greg Miller (gmiller (a] kayak.mitre.org). 1758 1759 - Added support for IPX protocol dumping thanks to Brad Parker 1760 (brad (a] fcr.com). 1761 1762 - Added check to verify IP header checksum under -v thanks to 1763 Brad Parker (brad (a] fcr.com). 1764 1765 - Move packet capture code to new libpcap library (which is 1766 packaged separately). 1767 1768 - Prototype everything and assume an ansi compiler. 1769 1770 - print-arp.c: Print hardware ethernet addresses if they're not 1771 what we expect. 1772 1773 - print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags. 1774 Many helpful suggestions from Gordon Ross (gwr (a] jericho.mc.com). 1775 1776 - print-fddi.c: Improvements. Thanks to Jeffrey Mogul 1777 (mogul (a] pa.dec.com). 1778 1779 - print-icmp.c: Byte swap netmask before printing. Thanks to 1780 Richard Stevens (rstevens (a] noao.edu). Print icmp type when unknown. 1781 1782 - print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets. 1783 By default, only the inner packet is dumped, appended with the token 1784 "(encap)". Under -v, both the inner and output packets are dumped 1785 (on the same line). Note that the filter applies to the original packet, 1786 not the encapsulated packet. So if you run tcpdump on a net with an 1787 IP Multicast tunnel, you cannot filter out the datagrams using the 1788 conventional syntax. (You can filter away all the ip-in-ip traffic 1789 with "not ip proto 4".) 1790 1791 - print-nfs.c: Keep pending rpc's in circular table. Add generic 1792 nfs header and remove os dependences. Thanks to Jeffrey Mogul. 1793 1794 - print-ospf.c: Improvements. Thanks to Jeffrey Mogul. 1795 1796 - tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc" 1797 (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords 1798 Add && and || operators 1799 1800 v2.2.1 Tue Jun 6 17:57:22 PDT 1992 1801 1802 - Fix bug with -c flag. 1803 1804 v2.2 Fri May 22 17:19:41 PDT 1992 1805 1806 - savefile.c: Remove hack that shouldn't have been exported. Add 1807 truncate checks. 1808 1809 - Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0' 1810 matches non-echo/reply ICMP packets. 1811 1812 - Many improvements to filter code optimizer. 1813 1814 - Added 'multicast' keyword and extended the 'broadcast' keyword can now be 1815 so that protocol qualifications are allowed. For example, "ip broadcast" 1816 and "ether multicast" are valid filters. 1817 1818 - Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo'). 1819 Jeffrey Honig (jch (a] MITCHELL.CIT.CORNELL.EDU) contributed the kernel 1820 patches to netinet/if_loop.c. 1821 1822 - Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS. 1823 Contact Jeffrey Honig (jch (a] MITCHELL.CIT.CORNELL.EDU) for the diffs. 1824 1825 - Added EGP and OSPF printers, thanks to Jeffrey Honig. 1826 1827 v2.1 Tue Jan 28 11:00:14 PST 1992 1828 1829 - Internal release (never publicly exported). 1830 1831 v2.0.1 Sun Jan 26 21:10:10 PDT 1832 1833 - Various byte ordering fixes. 1834 1835 - Add truncation checks. 1836 1837 - inet.c: Support BSD style SIOCGIFCONF. 1838 1839 - nametoaddr.c: Handle multi addresses for single host. 1840 1841 - optimize.c: Rewritten. 1842 1843 - pcap-bpf.c: don't choke when we get ptraced. only set promiscuous 1844 for broadcast nets. 1845 1846 - print-atal.c: Fix an alignment bug (thanks to 1847 stanonik (a] nprdc.navy.mil) Add missing printf() argument. 1848 1849 - print-bootp.c: First attempt at decoding the vendor buffer. 1850 1851 - print-domain.c: Fix truncation checks. 1852 1853 - print-icmp.c: Calculate length of packets from the ip header. 1854 1855 - print-ip.c: Print frag id in decimal (so it's easier to match up 1856 with non-frags). Add support for ospf, egp and igmp. 1857 1858 - print-nfs.c: Lots of changes. 1859 1860 - print-ntp.c: Make some verbose output depend on -v. 1861 1862 - print-snmp.c: New version from John LoVerso. 1863 1864 - print-tcp.c: Print rfc1072 tcp options. 1865 1866 - tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits 1867 (microseconds) worth of precision. Fix uid bugs. 1868 1869 - A packet dumper has been added (thanks to Jeff Mogul of DECWRL). 1870 With this option, you can create an architecture independent binary 1871 trace file in real time, without the overhead of the packet printer. 1872 At a later time, the packets can be filtered (again) and printed. 1873 1874 - BSD is supported. You must have BPF in your kernel. 1875 Since the filtering is now done in the kernel, fewer packets are 1876 dropped. In fact, with BPF and the packet dumper option, a measly 1877 Sun 3/50 can keep up with a busy network. 1878 1879 - Compressed SLIP packets can now be dumped, provided you use our 1880 SLIP software and BPF. These packets are dumped as any other IP 1881 packet; the compressed headers are dumped with the '-e' option. 1882 1883 - Machines with little-endian byte ordering are supported (thanks to 1884 Jeff Mogul). 1885 1886 - Ultrix 4.0 is supported (also thanks to Jeff Mogul). 1887 1888 - IBM RT and Stanford Enetfilter support has been added by 1889 Rayan Zachariassen <rayan (a] canet.ca>. tcpdump has been tested under 1890 both the vanilla Enetfilter interface, and the extended interface 1891 (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter. 1892 1893 - TFTP packets are now printed (requests only). 1894 1895 - BOOTP packets are now printed. 1896 1897 - SNMP packets are now printed. (thanks to John LoVerso of Xylogics). 1898 1899 - Sparc architectures, including the Sparcstation-1, are now 1900 supported thanks to Steve McCanne and Craig Leres. 1901 1902 - SunOS 4 is now supported thanks to Micky Liu of Columbia 1903 University (micky (a] cunixc.cc.columbia.edu). 1904 1905 - IP options are now printed. 1906 1907 - RIP packets are now printed. 1908 1909 - There's a -v flag that prints out more information than the 1910 default (e.g., it will enable printing of IP ttl, tos and id) 1911 and -q flag that prints out less (e.g., it will disable 1912 interpretation of AppleTalk-in-UDP). 1913 1914 - The grammar has undergone substantial changes (if you have an 1915 earlier version of tcpdump, you should re-read the manual 1916 entry). 1917 1918 The most useful change is the addition of an expression 1919 syntax that lets you filter on arbitrary fields or values in the 1920 packet. E.g., "ip[0] > 0x45" would print only packets with IP 1921 options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN 1922 packets. 1923 1924 The most painful change is that concatenation no longer means 1925 "and" -- e.g., you have to say "host foo and port bar" instead 1926 of "host foo port bar". The up side to this down is that 1927 repeated qualifiers can be omitted, making most filter 1928 expressions shorter. E.g., you can now say "ip host foo and 1929 (bar or baz)" to look at ip traffic between hosts foo and bar or 1930 between hosts foo and baz. [The old way of saying this was "ip 1931 host foo and (ip host bar or ip host baz)".] 1932 1933 v2.0 Sun Jan 13 12:20:40 PST 1991 1934 1935 - Initial public release. 1936
Indexes created Mon Apr 20 00:23:12 UTC 2026