198 lines
7.1 KiB
Plaintext
198 lines
7.1 KiB
Plaintext
$NetBSD: CHANGES,v 1.2 1995/03/06 19:09:42 mycroft Exp $
|
|
@(#) Header: CHANGES,v 1.6 94/06/20 19:34:38 leres Exp (LBL)
|
|
|
|
v3.0 Mon Jun 20 19:23:27 PDT 1994
|
|
|
|
- Reorganize protocol dumpers to take const pointers to packets so they
|
|
never change the contents (i.e., they used to do endian conversions
|
|
in place). Previously, whenever more than one pass was taken over
|
|
the packet, the packet contents would be dumped incorrectly (i.e.,
|
|
the output form -x would be wrong on little endian machines because
|
|
the protocol dumpers would modify the data). Thanks to Charles Hannum
|
|
(mycroft@gnu.ai.mit.edu) for reporting this problem.
|
|
|
|
- Added support for decnet protocol dumping thanks to Jeff Mogul
|
|
(mogul@pa.dec.com).
|
|
|
|
- Fix bug that caused length of packet to be incorrectly printed
|
|
(off by ether header size) for unknown ethernet types thanks
|
|
to Greg Miller (gmiller@kayak.mitre.org).
|
|
|
|
- Added support for IPX protocol dumping thanks to Brad Parker
|
|
(brad@fcr.com).
|
|
|
|
- Added check to verify IP header checksum under -v thanks to
|
|
Brad Parker (brad@fcr.com).
|
|
|
|
- Move packet capture code to new libpcap library (which is
|
|
packaged separately).
|
|
|
|
- Prototype everything and assume an ansi compiler.
|
|
|
|
- print-arp.c: Print hardware ethernet addresses if they're not
|
|
what we expect.
|
|
|
|
- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
|
|
Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
|
|
|
|
- print-fddi.c: Improvements. Thanks to Jeffrey Mogul
|
|
(mogul@pa.dec.com).
|
|
|
|
- print-icmp.c: Byte swap netmask before printing. Thanks to
|
|
Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
|
|
|
|
- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
|
|
By default, only the inner packet is dumped, appended with the token
|
|
"(encap)". Under -v, both the inner and output packets are dumped
|
|
(on the same line). Note that the filter applies to the original packet,
|
|
not the encapsulated packet. So if you run tcpdump on a net with an
|
|
IP Multicast tunnel, you cannot filter out the datagrams using the
|
|
conventional syntax. (You can filter away all the ip-in-ip traffic
|
|
with "not ip proto 4".)
|
|
|
|
- print-nfs.c: Keep pending rpc's in circular table. Add generic
|
|
nfs header and remove os dependences. Thanks to Jeffrey Mogul.
|
|
|
|
- print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
|
|
|
|
- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
|
|
(sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
|
|
Add && and || operators
|
|
|
|
v2.2.1 Tue Jun 6 17:57:22 PDT 1992
|
|
|
|
- Fix bug with -c flag.
|
|
|
|
v2.2 Fri May 22 17:19:41 PDT 1992
|
|
|
|
- savefile.c: Remove hack that shouldn't have been exported. Add
|
|
truncate checks.
|
|
|
|
- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0'
|
|
matches non-echo/reply ICMP packets.
|
|
|
|
- Many improvements to filter code optimizer.
|
|
|
|
- Added 'multicast' keyword and extended the 'broadcast' keyword can now be
|
|
so that protocol qualitfications are allowed. For example, "ip broadcast"
|
|
and "ether multicast" are valid filters.
|
|
|
|
- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
|
|
Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
|
|
patches to netinet/if_loop.c.
|
|
|
|
- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
|
|
Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
|
|
|
|
- Added EGP and OSPF printers, thanks to Jeffrey Honig.
|
|
|
|
v2.1 Tue Jan 28 11:00:14 PST 1992
|
|
|
|
- Internal release (never publically exported).
|
|
|
|
v2.0.1 Sun Jan 26 21:10:10 PDT
|
|
|
|
- Various byte ordering fixes.
|
|
|
|
- Add truncation checks.
|
|
|
|
- inet.c: Support BSD style SIOCGIFCONF.
|
|
|
|
- nametoaddr.c: Handle multi addresses for single host.
|
|
|
|
- optimize.c: Rewritten.
|
|
|
|
- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
|
|
for broadcast nets.
|
|
|
|
- print-atal.c: Fix an alignment bug (thanks to
|
|
stanonik@nprdc.navy.mil) Add missing printf() argument.
|
|
|
|
- print-bootp.c: First attempt at decoding the vendor buffer.
|
|
|
|
- print-domain.c: Fix truncation checks.
|
|
|
|
- print-icmp.c: Calculate length of packets from the ip header.
|
|
|
|
- print-ip.c: Print frag id in decimal (so it's easier to match up
|
|
with non-frags). Add support for ospf, egp and igmp.
|
|
|
|
- print-nfs.c: Lots of changes.
|
|
|
|
- print-ntp.c: Make some verbose output depend on -v.
|
|
|
|
- print-snmp.c: New version from John LoVerso.
|
|
|
|
- print-tcp.c: Print rfc1072 tcp options.
|
|
|
|
- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
|
|
(microseconds) worth of precision. Fix uid bugs.
|
|
|
|
- A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
|
|
With this option, you can create an architecture independent binary
|
|
trace file in real time, without the overhead of the packet printer.
|
|
At a later time, the packets can be filtered (again) and printed.
|
|
|
|
- BSD is supported. You must have BPF in your kernel.
|
|
Since the filtering is now done in the kernel, fewer packets are
|
|
dropped. In fact, with BPF and the packet dumper option, a measly
|
|
Sun 3/50 can keep up with a busy network.
|
|
|
|
- Compressed SLIP packets can now be dumped, provided you use our
|
|
SLIP software and BPF. These packets are dumped as any other IP
|
|
packet; the compressed headers are dumped with the '-e' option.
|
|
|
|
- Machines with little-endian byte ordering are supported (thanks to
|
|
Jeff Mogul).
|
|
|
|
- Ultrix 4.0 is supported (also thanks to Jeff Mogul).
|
|
|
|
- IBM RT and Stanford Enetfilter support has been added by
|
|
Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under
|
|
both the vanilla Enetfilter interface, and the extended interface
|
|
(#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
|
|
|
|
- TFTP packets are now printed (requests only).
|
|
|
|
- BOOTP packets are now printed.
|
|
|
|
- SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
|
|
|
|
- Sparc architectures, including the Sparcstation-1, are now
|
|
supported thanks to Steve McCanne and Craig Leres.
|
|
|
|
- SunOS 4 is now supported thanks to Micky Liu of Columbia
|
|
University (micky@cunixc.cc.columbia.edu).
|
|
|
|
- IP options are now printed.
|
|
|
|
- RIP packets are now printed.
|
|
|
|
- There's a -v flag that prints out more information than the
|
|
default (e.g., it will enable printing of IP ttl, tos and id)
|
|
and -q flag that prints out less (e.g., it will disable
|
|
interpretation of AppleTalk-in-UDP).
|
|
|
|
- The grammar has undergone substantial changes (if you have an
|
|
earlier version of tcpdump, you should re-read the manual
|
|
entry).
|
|
|
|
The most useful change is the addition of an expression
|
|
syntax that lets you filter on arbitrary fields or values in the
|
|
packet. E.g., "ip[0] > 0x45" would print only packets with IP
|
|
options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
|
|
packets.
|
|
|
|
The most painful change is that concatenation no longer means
|
|
"and" -- e.g., you have to say "host foo and port bar" instead
|
|
of "host foo port bar". The up side to this down is that
|
|
repeated qualifiers can be omitted, making most filter
|
|
expressions shorter. E.g., you can now say "ip host foo and
|
|
(bar or baz)" to look at ip traffic between hosts foo and bar or
|
|
between hosts foo and baz. [The old way of saying this was "ip
|
|
host foo and (ip host bar or ip host baz)".]
|
|
|
|
v2.0 Sun Jan 13 12:20:40 PST 1991
|
|
|
|
- Initial public release.
|