mirror of
https://git.FreeBSD.org/src.git
synced 2024-12-24 11:29:10 +00:00
4edb46e9a8
Obtained from: ftp://ftp.ee.lbl.gov/tcpdump.tar.Z on 19-Aug-1996.
403 lines
14 KiB
Plaintext
403 lines
14 KiB
Plaintext
@(#) $Header: CHANGES,v 1.42 96/07/23 14:36:37 leres Exp $ (LBL)
|
|
|
|
v3.2.1 Sun Jul 14 03:02:26 PDT 1996
|
|
|
|
- Added rfc1716 icmp codes as suggested by Martin Fredriksson
|
|
(martin@msp.se)
|
|
|
|
- Print mtu for icmp unreach need frag packets. Thanks to John
|
|
Hawkinson (jhawk@mit.edu)
|
|
|
|
- Decode icmp router discovery messages. Thanks to Jeffrey Honig
|
|
(jch@bsdi.com)
|
|
|
|
- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
|
|
(kushida@trl.ibm.co.jp)
|
|
|
|
- Check igmp checksum if possible. Thanks to John Hawkinson.
|
|
|
|
- Made changes for SINIX. Thanks to Andrej Borsenkow
|
|
(borsenkow.msk@sni.de)
|
|
|
|
- Use autoconf's idea of the top level directory in install targets.
|
|
Thanks to John Hawkinson.
|
|
|
|
- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
|
|
Mogul (mogul@pa.dec.com)
|
|
|
|
- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
|
|
Thanks to John Hawkinson.
|
|
|
|
- Added some more packet truncation checks.
|
|
|
|
- On systems that have it, use sigset() instead of signal() since
|
|
signal() has different semantics on these systems.
|
|
|
|
- Fixed some more alignment problems on the alpha.
|
|
|
|
- Add code to massage unprintable characters in the domain and ipx
|
|
printers. Thanks to John Hawkinson.
|
|
|
|
- Added explicit netmask support. Thanks to Steve Nuchia
|
|
(steve@research.oknet.com)
|
|
|
|
- Add "sca" keyword (for DEC cluster services) as suggested by Terry
|
|
Kennedy (terry@spcvxa.spc.edu)
|
|
|
|
- Add "atalk" keyword as suggested by John Hawkinson.
|
|
|
|
- Added an igrp printer. Thanks to Francis Dupont
|
|
(francis.dupont@inria.fr)
|
|
|
|
- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
|
|
Kennedy (terry@spcvxa.spc.edu)
|
|
|
|
- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
|
|
(pascal.hennequin@hugo.int-evry.fr)
|
|
|
|
- Added some ETHERTYPEs missing on some systems.
|
|
|
|
- Added truncated packet macros and various checks.
|
|
|
|
- Fixed endian problems with the DECnet printer.
|
|
|
|
- Use $CC when checking gcc version. Thanks to Carl Lindberg
|
|
(carl_lindberg@blacksmith.com)
|
|
|
|
- Fixes for AIX (although this system is not yet supported). Thanks to
|
|
John Hawkinson.
|
|
|
|
- Fix bugs in the autoconf misaligned accesses code fragment.
|
|
|
|
- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
|
|
Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
|
|
|
|
v3.2 Sun Jun 23 02:28:10 PDT 1996
|
|
|
|
- Print new icmp unreachable codes as suggested by Martin Fredriksson
|
|
(martin@msp.se). Also print code value when unknown for icmp redirect
|
|
and time exceeded.
|
|
|
|
- Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
|
|
|
|
- Define "new" domain record types if not found in arpa/nameserv.h.
|
|
Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
|
|
fixed an endian bug when printing mx record and added some new record
|
|
types.
|
|
|
|
- Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
|
|
|
|
- Added T/TCP options printing. As suggested by Richard Stevens
|
|
(rstevens@noao.edu)
|
|
|
|
- Use autoconf to detect architectures that can't handle misaligned
|
|
accesses.
|
|
|
|
v3.1 Thu Jun 13 20:59:32 PDT 1996
|
|
|
|
- Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
|
|
and bind (as suggested by Charles Hannum).
|
|
|
|
- Port to GNU autoconf.
|
|
|
|
- Add support for printing DVMRP and PIM traffic thanks to
|
|
Havard Eidnes (Havard.Eidnes@runit.sintef.no).
|
|
|
|
- Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
|
|
define being referenced. Reported by Terry Kennedy.
|
|
|
|
- Minor fixes to the man page thanks to Mark Andrews.
|
|
|
|
- Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
|
|
(bmah@cs.berkeley.edu).
|
|
|
|
- Added support for new dns types, thanks to Rainer Orth.
|
|
|
|
- Fixed tftp_print() to print the block number for ACKs.
|
|
|
|
- Document -dd and -ddd. Resulted from a bug report from Charlie Slater
|
|
(cslater@imatek.com).
|
|
|
|
- Check return status from malloc/calloc/etc.
|
|
|
|
- Check return status from pcap_loop() so we can print an error and
|
|
exit with a bad status if there were problems.
|
|
|
|
- Bail if ip option length is <= 0. Resulted from a bug report from
|
|
Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
|
|
|
|
- Print out a little more information for sun rpc packets.
|
|
|
|
- Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
|
|
|
|
- Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
|
|
wrong on little endian machines).
|
|
|
|
- Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
|
|
(crawdad@fnal.gov).
|
|
|
|
- Fix ntp_print() to not print garbage when the stratum is
|
|
"unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
|
|
|
|
- Rewrote tcp options printer code to check for truncation. Added
|
|
selective acknowledgment case.
|
|
|
|
- Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
|
|
(jch@bsdi.com)
|
|
|
|
- Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
|
|
octet for the sa_family member. Thanks to Yoshitaka Tokugawa
|
|
(toku@dit.co.jp)
|
|
|
|
- Don't checksum ip header if we don't have all of it. Thanks to John
|
|
Hawkinson (jhawk@mit.edu).
|
|
|
|
- Print out hostnames if possible in egp printer. Thanks to Jeffrey
|
|
Honig (jhc@bsdi.com)
|
|
|
|
|
|
v3.1a1 Wed May 3 19:21:11 PDT 1995
|
|
|
|
- Include time.h when SVR4 is defined to avoid problems under Solaris
|
|
2.3.
|
|
|
|
- Fix etheraddr_string() in the ETHER_SERVICE to return the saved
|
|
strings, not the local buffer. Thanks to Stefan Petri
|
|
(petri@ibr.cs.tu-bs.de).
|
|
|
|
- Detect when pcap raises the snaplen (e.g. with snit). Print a warning
|
|
that the selected value was not used. Thanks to Pascal Hennequin
|
|
(Pascal.Hennequin@hugo.int-evry.fr).
|
|
|
|
- Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
|
|
|
|
- BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
|
|
|
|
v3.0.3 Sun Oct 1 18:35:00 GMT 1995
|
|
|
|
- Although there never was a 3.0.3 release, the linux boys cleverly
|
|
"released" one in late 1995.
|
|
|
|
v3.0.2 Thu Apr 20 21:28:16 PDT 1995
|
|
|
|
- Change configuration to not use gcc v2 flags with gcc v1.
|
|
|
|
- Redo gmt2local() so that it works under BSDI (which seems to return
|
|
an empty timezone struct from gettimeofday()). Based on report from
|
|
Terry Kennedy (terry@spcvxa.spc.edu).
|
|
|
|
- Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
|
|
on report from Mark Andrews (mandrews@alias.com).
|
|
|
|
- Don't pass cc flags to gcc. Resulted from a bug report from Rainer
|
|
Orth (ro@techfak.uni-bielefeld.de).
|
|
|
|
- Fixed printout of connection id for uncompressed tcp slip packets.
|
|
Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
|
|
|
|
- Hack around deficiency in Ultrix's make.
|
|
|
|
- Add ETHERTYPE_TRAIL define which is missing from irix5.
|
|
|
|
v3.0.1 Wed Aug 31 22:42:26 PDT 1994
|
|
|
|
- Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
|
|
|
|
v3.0 Mon Jun 20 19:23:27 PDT 1994
|
|
|
|
- Added support for printing tcp option timestamps thanks to
|
|
Mark Andrews (mandrews@alias.com).
|
|
|
|
- Reorganize protocol dumpers to take const pointers to packets so they
|
|
never change the contents (i.e., they used to do endian conversions
|
|
in place). Previously, whenever more than one pass was taken over
|
|
the packet, the packet contents would be dumped incorrectly (i.e.,
|
|
the output form -x would be wrong on little endian machines because
|
|
the protocol dumpers would modify the data). Thanks to Charles Hannum
|
|
(mycroft@gnu.ai.mit.edu) for reporting this problem.
|
|
|
|
- Added support for decnet protocol dumping thanks to Jeff Mogul
|
|
(mogul@pa.dec.com).
|
|
|
|
- Fix bug that caused length of packet to be incorrectly printed
|
|
(off by ether header size) for unknown ethernet types thanks
|
|
to Greg Miller (gmiller@kayak.mitre.org).
|
|
|
|
- Added support for IPX protocol dumping thanks to Brad Parker
|
|
(brad@fcr.com).
|
|
|
|
- Added check to verify IP header checksum under -v thanks to
|
|
Brad Parker (brad@fcr.com).
|
|
|
|
- Move packet capture code to new libpcap library (which is
|
|
packaged separately).
|
|
|
|
- Prototype everything and assume an ansi compiler.
|
|
|
|
- print-arp.c: Print hardware ethernet addresses if they're not
|
|
what we expect.
|
|
|
|
- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
|
|
Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
|
|
|
|
- print-fddi.c: Improvements. Thanks to Jeffrey Mogul
|
|
(mogul@pa.dec.com).
|
|
|
|
- print-icmp.c: Byte swap netmask before printing. Thanks to
|
|
Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
|
|
|
|
- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
|
|
By default, only the inner packet is dumped, appended with the token
|
|
"(encap)". Under -v, both the inner and output packets are dumped
|
|
(on the same line). Note that the filter applies to the original packet,
|
|
not the encapsulated packet. So if you run tcpdump on a net with an
|
|
IP Multicast tunnel, you cannot filter out the datagrams using the
|
|
conventional syntax. (You can filter away all the ip-in-ip traffic
|
|
with "not ip proto 4".)
|
|
|
|
- print-nfs.c: Keep pending rpc's in circular table. Add generic
|
|
nfs header and remove os dependences. Thanks to Jeffrey Mogul.
|
|
|
|
- print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
|
|
|
|
- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
|
|
(sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
|
|
Add && and || operators
|
|
|
|
v2.2.1 Tue Jun 6 17:57:22 PDT 1992
|
|
|
|
- Fix bug with -c flag.
|
|
|
|
v2.2 Fri May 22 17:19:41 PDT 1992
|
|
|
|
- savefile.c: Remove hack that shouldn't have been exported. Add
|
|
truncate checks.
|
|
|
|
- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0'
|
|
matches non-echo/reply ICMP packets.
|
|
|
|
- Many improvements to filter code optimizer.
|
|
|
|
- Added 'multicast' keyword and extended the 'broadcast' keyword can now be
|
|
so that protocol qualifications are allowed. For example, "ip broadcast"
|
|
and "ether multicast" are valid filters.
|
|
|
|
- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
|
|
Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
|
|
patches to netinet/if_loop.c.
|
|
|
|
- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
|
|
Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
|
|
|
|
- Added EGP and OSPF printers, thanks to Jeffrey Honig.
|
|
|
|
v2.1 Tue Jan 28 11:00:14 PST 1992
|
|
|
|
- Internal release (never publically exported).
|
|
|
|
v2.0.1 Sun Jan 26 21:10:10 PDT
|
|
|
|
- Various byte ordering fixes.
|
|
|
|
- Add truncation checks.
|
|
|
|
- inet.c: Support BSD style SIOCGIFCONF.
|
|
|
|
- nametoaddr.c: Handle multi addresses for single host.
|
|
|
|
- optimize.c: Rewritten.
|
|
|
|
- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
|
|
for broadcast nets.
|
|
|
|
- print-atal.c: Fix an alignment bug (thanks to
|
|
stanonik@nprdc.navy.mil) Add missing printf() argument.
|
|
|
|
- print-bootp.c: First attempt at decoding the vendor buffer.
|
|
|
|
- print-domain.c: Fix truncation checks.
|
|
|
|
- print-icmp.c: Calculate length of packets from the ip header.
|
|
|
|
- print-ip.c: Print frag id in decimal (so it's easier to match up
|
|
with non-frags). Add support for ospf, egp and igmp.
|
|
|
|
- print-nfs.c: Lots of changes.
|
|
|
|
- print-ntp.c: Make some verbose output depend on -v.
|
|
|
|
- print-snmp.c: New version from John LoVerso.
|
|
|
|
- print-tcp.c: Print rfc1072 tcp options.
|
|
|
|
- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
|
|
(microseconds) worth of precision. Fix uid bugs.
|
|
|
|
- A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
|
|
With this option, you can create an architecture independent binary
|
|
trace file in real time, without the overhead of the packet printer.
|
|
At a later time, the packets can be filtered (again) and printed.
|
|
|
|
- BSD is supported. You must have BPF in your kernel.
|
|
Since the filtering is now done in the kernel, fewer packets are
|
|
dropped. In fact, with BPF and the packet dumper option, a measly
|
|
Sun 3/50 can keep up with a busy network.
|
|
|
|
- Compressed SLIP packets can now be dumped, provided you use our
|
|
SLIP software and BPF. These packets are dumped as any other IP
|
|
packet; the compressed headers are dumped with the '-e' option.
|
|
|
|
- Machines with little-endian byte ordering are supported (thanks to
|
|
Jeff Mogul).
|
|
|
|
- Ultrix 4.0 is supported (also thanks to Jeff Mogul).
|
|
|
|
- IBM RT and Stanford Enetfilter support has been added by
|
|
Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under
|
|
both the vanilla Enetfilter interface, and the extended interface
|
|
(#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
|
|
|
|
- TFTP packets are now printed (requests only).
|
|
|
|
- BOOTP packets are now printed.
|
|
|
|
- SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
|
|
|
|
- Sparc architectures, including the Sparcstation-1, are now
|
|
supported thanks to Steve McCanne and Craig Leres.
|
|
|
|
- SunOS 4 is now supported thanks to Micky Liu of Columbia
|
|
University (micky@cunixc.cc.columbia.edu).
|
|
|
|
- IP options are now printed.
|
|
|
|
- RIP packets are now printed.
|
|
|
|
- There's a -v flag that prints out more information than the
|
|
default (e.g., it will enable printing of IP ttl, tos and id)
|
|
and -q flag that prints out less (e.g., it will disable
|
|
interpretation of AppleTalk-in-UDP).
|
|
|
|
- The grammar has undergone substantial changes (if you have an
|
|
earlier version of tcpdump, you should re-read the manual
|
|
entry).
|
|
|
|
The most useful change is the addition of an expression
|
|
syntax that lets you filter on arbitrary fields or values in the
|
|
packet. E.g., "ip[0] > 0x45" would print only packets with IP
|
|
options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
|
|
packets.
|
|
|
|
The most painful change is that concatenation no longer means
|
|
"and" -- e.g., you have to say "host foo and port bar" instead
|
|
of "host foo port bar". The up side to this down is that
|
|
repeated qualifiers can be omitted, making most filter
|
|
expressions shorter. E.g., you can now say "ip host foo and
|
|
(bar or baz)" to look at ip traffic between hosts foo and bar or
|
|
between hosts foo and baz. [The old way of saying this was "ip
|
|
host foo and (ip host bar or ip host baz)".]
|
|
|
|
v2.0 Sun Jan 13 12:20:40 PST 1991
|
|
|
|
- Initial public release.
|