*** empty log message ***

79 files changed, 5330 insertions, 1828 deletions

diff --git a/usr.sbin/tcpdump/CHANGES b/usr.sbin/tcpdump/CHANGES
index 714d7541901..51b3a3bfb19 100644
--- a/usr.sbin/tcpdump/CHANGES
+++ b/usr.sbin/tcpdump/CHANGES
@@ -1,5 +1,118 @@
-$OpenBSD: CHANGES,v 1.4 1996/07/13 11:01:05 mickey Exp $
-@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/CHANGES,v 1.4 1996/07/13 11:01:05 mickey Exp $ (LBL)
+@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/CHANGES,v 1.5 1996/12/12 16:23:05 bitblt Exp $ (LBL)
+
+v3.3 Sat Nov 30 20:56:27 PST 1996
+
+- Added Linux support.
+
+- GRE encapsulated packet printer thanks to John Hawkinson
+  (jhawk@mit.edu)
+
+- Rewrite gmt2local() to avoid problematic os dependencies.
+
+- Suppress nfs truncation message on errors.
+
+- Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
+  Reported by Joachim Ott (ott@ardala.han.de)
+
+- Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
+
+- Print arp hardware type in host order. Thanks to Onno van der Linden
+  (onno@simplex.nl)
+
+- Avoid solaris compiler warnings. Thanks to Bruce Barnett
+  (barnett@grymoire.crd.ge.com)
+
+- Fix rip printer to not print one more route than is actually in the
+  packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
+  Bill Fenner (fenner@parc.xerox.com)
+
+- Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
+
+- Fix dvmrp printer truncation checks and add a dvmrp probe printer.
+  Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
+
+- Rewrite ospf printer to improve truncation checks.
+
+- Don't parse tcp options past the EOL. As noted by David Sacerdote
+  (davids@secnet.com). Also, check tcp options to make sure they ar
+  actually in the tcp header (in addition to the normal truncation
+  checks). Fix the SACK code to print the N blocks (instead of the
+  first block N times).
+
+- Don't say really small UDP packets are truncated just because they
+  aren't big enough to be a RPC. As noted by David Sacerdote.
+
+v3.2.1 Sun Jul 14 03:02:26 PDT 1996
+
+- Added rfc1716 icmp codes as suggested by Martin Fredriksson
+  (martin@msp.se)
+
+- Print mtu for icmp unreach need frag packets. Thanks to John
+  Hawkinson (jhawk@mit.edu)
+
+- Decode icmp router discovery messages. Thanks to Jeffrey Honig
+  (jch@bsdi.com)
+
+- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
+  (kushida@trl.ibm.co.jp)
+
+- Check igmp checksum if possible. Thanks to John Hawkinson.
+
+- Made changes for SINIX. Thanks to Andrej Borsenkow
+  (borsenkow.msk@sni.de)
+
+- Use autoconf's idea of the top level directory in install targets.
+  Thanks to John Hawkinson.
+
+- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
+  Mogul (mogul@pa.dec.com)
+
+- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
+  Thanks to John Hawkinson.
+
+- Added some more packet truncation checks.
+
+- On systems that have it, use sigset() instead of signal() since
+  signal() has different semantics on these systems.
+
+- Fixed some more alignment problems on the alpha.
+
+- Add code to massage unprintable characters in the domain and ipx
+  printers. Thanks to John Hawkinson.
+
+- Added explicit netmask support. Thanks to Steve Nuchia
+  (steve@research.oknet.com)
+
+- Add "sca" keyword (for DEC cluster services) as suggested by Terry
+  Kennedy (terry@spcvxa.spc.edu)
+
+- Add "atalk" keyword as suggested by John Hawkinson.
+
+- Added an igrp printer. Thanks to Francis Dupont
+  (francis.dupont@inria.fr)
+
+- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
+  Kennedy (terry@spcvxa.spc.edu)
+
+- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
+  (pascal.hennequin@hugo.int-evry.fr)
+
+- Added some ETHERTYPEs missing on some systems.
+
+- Added truncated packet macros and various checks.
+
+- Fixed endian problems with the DECnet printer.
+
+- Use $CC when checking gcc version. Thanks to Carl Lindberg
+  (carl_lindberg@blacksmith.com)
+
+- Fixes for AIX (although this system is not yet supported). Thanks to
+  John Hawkinson.
+
+- Fix bugs in the autoconf misaligned accesses code fragment.
+
+- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
+  Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
 
 v3.2 Sun Jun 23 02:28:10 PDT 1996
 
diff --git a/usr.sbin/tcpdump/FILES b/usr.sbin/tcpdump/FILES
new file mode 100644
index 00000000000..549cee3b8e2
--- /dev/null
+++ b/usr.sbin/tcpdump/FILES
@@ -0,0 +1,94 @@
+CHANGES
+FILES
+INSTALL
+Makefile.in
+README
+VERSION
+acsite.m4
+addrtoname.c
+addrtoname.h
+appletalk.h
+atime.awk
+bootp.h
+bpf_dump.c
+config.guess
+config.sub
+configure
+configure.in
+decnet.h
+ethertype.h
+extract.h
+fddi.h
+igrp.h
+install-sh
+interface.h
+ipx.h
+lbl/gnuc.h
+lbl/os-solaris2.h
+lbl/os-sunos4.h
+lbl/os-ultrix4.h
+linux-include/net/slcompress.h
+linux-include/net/slip.h
+linux-include/netinet/if_ether.h
+linux-include/netinet/in_systm.h
+linux-include/netinet/ip.h
+linux-include/netinet/ip_icmp.h
+linux-include/netinet/ip_var.h
+linux-include/netinet/tcp.h
+linux-include/netinet/tcp_var.h
+linux-include/netinet/tcpip.h
+linux-include/netinet/udp.h
+linux-include/netinet/udp_var.h
+llc.h
+machdep.c
+machdep.h
+makemib
+mib.h
+mkdep
+netbios.h
+nfsfh.h
+nfsv2.h
+ntp.h
+ospf.h
+packetdat.awk
+parsenfsfh.c
+print-arp.c
+print-atalk.c
+print-atm.c
+print-bootp.c
+print-decnet.c
+print-domain.c
+print-dvmrp.c
+print-egp.c
+print-ether.c
+print-fddi.c
+print-gre.c
+print-icmp.c
+print-igrp.c
+print-ip.c
+print-ipx.c
+print-isoclns.c
+print-krb.c
+print-llc.c
+print-netbios.c
+print-nfs.c
+print-ntp.c
+print-null.c
+print-ospf.c
+print-pim.c
+print-ppp.c
+print-rip.c
+print-sl.c
+print-snmp.c
+print-sunrpc.c
+print-tcp.c
+print-tftp.c
+print-udp.c
+print-wb.c
+send-ack.awk
+stime.awk
+strcasecmp.c
+tcpdump.1
+tcpdump.c
+util.c
+vfprintf.c
diff --git a/usr.sbin/tcpdump/INSTALL b/usr.sbin/tcpdump/INSTALL
new file mode 100644
index 00000000000..023d59ac0a8
--- /dev/null
+++ b/usr.sbin/tcpdump/INSTALL
@@ -0,0 +1,132 @@
+@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/INSTALL,v 1.1 1996/12/12 16:23:03 bitblt Exp $ (LBL)
+
+If you have not built libpcap, do so first.  See the README
+file in this directory for the ftp location.
+
+You will need an ANSI C compiler to build tcpdump. The configure script
+will abort if your compiler is not ANSI compliant. If this happens, use
+the GNU C compiler, available via anonymous ftp:
+
+	ftp://prep.ai.mit.edu/pub/gnu/gcc.tar.gz
+
+After libpcap has been built (either install it with "make install" and
+"make install-incl" or make sure both the libpcap and tcpdump source
+trees are in the same directory), edit the BINDEST and MANDEST paths in
+Makefile.in and run ./configure (a shell script).  "configure" will
+determine your system attributes and generate an appropriate Makefile
+from Makefile.in.  Now build tcpdump by running "make".
+
+If everything builds ok, su and type "make install" (and optionally
+"make install-man). This will install tcpdump and the manual entry. By
+default, tcpdump is installed with group execute permissions. The group
+used depends on your os. In addition, BPF packet access is controlled
+by permissions to /dev/bpf0. In any case, DO NOT give untrusted users
+the capability of running tcpdump. Tcpdump can capture any traffic on
+your net, including passwords.
+
+Note that tcpdump is shipped with some systems, for example, DEC/OSF
+and BSD/386.  Remember to remove or rename the installed binary
+when upgrading.
+
+If you use OSF 4, note that that there appears to be some serious bugs
+with the stock C compiler. The configure code fragments that detect if
+the ether_header and ether_arp structs use the ether_addr struct
+generates warnings instead of fatal errors (?!?!) This makes configure
+think that the ether_arp struct is used when in fact it is not. To get
+around this, delete:
+
+    -DETHER_HEADER_HAS_EA=1 -DETHER_ARP_HAS_EA=1
+
+from the Makefile after running configure (and before attempting to
+compile tcpdump.
+
+Another workaround is to use gcc.
+
+If your system is not one which we have tested tcpdump on, you may have
+to modify the configure script and Makefile.in. Please send us patches
+for any modifications you need to make. However, we are not interested
+in ascii packet printer patches. We believe adding this feature would
+make it too easy for crackers who do not have the programming skills
+needed to write a password sniffer to grab clear text passwords.
+
+FILES
+-----
+CHANGES         - description of differences between releases
+FILES		- list of files exported as part of the distribution
+INSTALL         - this file
+Makefile.in	- compilation rules (input to the configure script)
+README		- description of distribution
+VERSION		- version of this release
+acsite.m4	- autoconf macros
+addrtoname.c	- address to hostname routines
+addrtoname.h	- address to hostname definitions
+appletalk.h	- AppleTalk definitions
+atime.awk	- TCP ack awk script
+bootp.h		- BOOTP definitions
+bpf_dump.c	- bpf instruction pretty-printer routine
+config.guess	- autoconf support
+config.sub	- autoconf support
+configure	- configure script (run this first)
+configure.in	- configure script source
+decnet.h	- DECnet definitions
+ethertype.h	- ethernet definitions
+extract.h	- alignment definitions
+fddi.h		- Fiber Distributed Data Interface definitions
+igrp.h		- Interior Gateway Routing Protocol definitions
+install-sh	- BSD style install script
+interface.h	- globals, prototypes and definitions
+ipx.h		- IPX definitions
+lbl/gnuc.h	- gcc macros and defines
+lbl/os-*.h	- os dependent defines and prototypes
+linux-include/*	- network include files missing on Linux
+llc.h		- LLC definitions
+machdep.c	- machine dependent routines
+machdep.h	- machine dependent definitions
+makemib		- mib to header script
+mib.h		- mib definitions
+mkdep		- construct Makefile dependency list
+netbios.h	- NETBIOS definitions
+nfsfh.h		- Network File System file handle definitions
+nfsv2.h		- Network File System V2 definitions
+ntp.h		- Network Time Protocol definitions
+ospf.h		- Open Shortest Path First definitions
+packetdat.awk	- TCP chunk summary awk script
+parsenfsfh.c	- Network File System file parser routines
+print-arp.c	- Address Resolution Protocol printer routines
+print-atalk.c	- AppleTalk printer routines
+print-atm.c	- atm printer routines
+print-bootp.c	- BOOTP printer routines
+print-decnet.c	- DECnet printer routines
+print-domain.c	- Domain Name System printer routines
+print-egp.c	- External Gateway Protocol printer routines
+print-ether.c	- ethernet printer routines
+print-fddi.c	- Fiber Distributed Data Interface printer routines
+print-gre.c	- Generic Routing Encapsulation printer routines
+print-icmp.c	- Internet Control Message Protocol printer routines
+print-igrp.c	- Interior Gateway Routing Protocol printer routines
+print-ip.c	- ip printer routines
+print-ipx.c	- IPX printer routines
+print-isoclns.c	- isoclns printer routines
+print-krb.c	- Kerberos printer routines
+print-llc.c	- llc printer routines
+print-netbios.c	- netbios printer routines
+print-nfs.c	- Network File System printer routines
+print-ntp.c	- Network Time Protocol printer routines
+print-null.c	- null printer routines
+print-ospf.c	- Open Shortest Path First printer routines
+print-pim.c	- Protocol Independent Multicast printer routines
+print-ppp.c	- Point to Point Protocol printer routines
+print-rip.c	- Routing Information Protocol printer routines
+print-sl.c	- Compressed Serial Line Internet Protocol printer routines
+print-snmp.c	- Simple Network Management Protocol printer routines
+print-sunrpc.c	- Sun Remote Procedure Call printer routines
+print-tcp.c	- TCP printer routines
+print-tftp.c	- Trivial File Transfer Protocol printer routines
+print-udp.c	- UDP printer routines
+print-wb.c	- white board printer routines
+send-ack.awk	- unidirectional tcp send/ack awk script
+stime.awk	- TCP send awk script
+tcpdump.1	- manual entry
+tcpdump.c	- main program
+util.c		- utility routines
+vfprintf.c	- emulation routine
diff --git a/usr.sbin/tcpdump/Makefile b/usr.sbin/tcpdump/Makefile
index 74bdeea79c5..bf26fef7ce5 100644
--- a/usr.sbin/tcpdump/Makefile
+++ b/usr.sbin/tcpdump/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.5 1996/11/12 08:31:56 mickey Exp $
+#	$OpenBSD: Makefile,v 1.6 1996/12/12 16:23:03 bitblt Exp $
 #	$NetBSD: Makefile,v 1.6 1995/03/07 23:18:39 mycroft Exp $
 #
 #  Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994
@@ -37,7 +37,8 @@ SRCS=	tcpdump.c addrtoname.c \
 	print-fddi.c print-llc.c print-sunrpc.c \
 	print-wb.c print-decnet.c print-isoclns.c print-ipx.c \
 	print-atm.c print-dvmrp.c print-krb.c print-pim.c print-netbios.c \
-	util.c bpf_dump.c parsenfsfh.c version.c
+	util.c bpf_dump.c parsenfsfh.c version.c machdep.c print-igrp.c \
+        print-gre.c
 
 AWKS =	atime.awk packetdat.awk send-ack.awk stime.awk
 
diff --git a/usr.sbin/tcpdump/Makefile.in b/usr.sbin/tcpdump/Makefile.in
new file mode 100644
index 00000000000..0be1ce19d15
--- /dev/null
+++ b/usr.sbin/tcpdump/Makefile.in
@@ -0,0 +1,145 @@
+#  Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
+# 	The Regents of the University of California.  All rights reserved.
+#
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that: (1) source code distributions
+#  retain the above copyright notice and this paragraph in its entirety, (2)
+#  distributions including binary code include the above copyright notice and
+#  this paragraph in its entirety in the documentation or other materials
+#  provided with the distribution, and (3) all advertising materials mentioning
+#  features or use of this software display the following acknowledgement:
+#  ``This product includes software developed by the University of California,
+#  Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+#  the University nor the names of its contributors may be used to endorse
+#  or promote products derived from this software without specific prior
+#  written permission.
+#  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+#  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+#
+# @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/Makefile.in,v 1.1 1996/12/12 16:23:02 bitblt Exp $ (LBL)
+
+#
+# Various configurable paths (remember to edit Makefile.in, not Makefile)
+#
+
+# Top level hierarchy
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+# Pathname of directory to install the binary
+BINDEST = @sbindir@
+# Pathname of directory to install the man page
+MANDEST = @mandir@
+
+# VPATH
+srcdir = @srcdir@
+VPATH = @srcdir@
+
+#
+# You shouldn't need to edit anything below here.
+#
+
+CC = @CC@
+CCOPT = @V_CCOPT@
+INCLS = -I. @V_INCLS@
+DEFS = @DEFS@ -DPPP -DHAVE_FDDI
+
+# Standard CFLAGS
+CFLAGS = $(CCOPT) $(DEFS) $(INCLS)
+
+# Standard LIBS
+LIBS = @LIBS@
+
+INSTALL = @INSTALL@
+
+# Explicitly define compilation rule since SunOS 4's make doesn't like gcc.
+# Also, gcc does not remove the .o before forking 'as', which can be a
+# problem if you don't own the file but can write to the directory.
+.c.o:
+	@rm -f $@
+	$(CC) $(CFLAGS) -c $(srcdir)/$*.c
+
+CSRC =	tcpdump.c \
+	print-arp.c print-atalk.c print-atm.c print-bootp.c \
+	print-decnet.c print-domain.c print-dvmrp.c print-egp.c \
+	print-ether.c print-fddi.c print-gre.c print-icmp.c \
+	print-igrp.c print-ip.c print-ipx.c print-isoclns.c print-krb.c \
+	print-llc.c print-nfs.c print-ntp.c print-null.c print-ospf.c \
+	print-pim.c print-ppp.c print-rip.c print-sl.c print-snmp.c \
+	print-sunrpc.c print-tcp.c print-tftp.c print-udp.c print-wb.c \
+	addrtoname.c bpf_dump.c machdep.c parsenfsfh.c util.c
+LOCALSRC =
+GENSRC = version.c
+
+SRC =	$(CSRC) $(GENSRC) $(LOCALSRC)
+
+# We would like to say "OBJ = $(SRC:.c=.o)" but Ultrix's make cannot
+# hack the extra indirection
+OBJ =	$(CSRC:.c=.o) $(GENSRC:.c=.o) $(LOCALSRC:.c=.o) @LIBOBJS@
+HDR =   addrtoname.h appletalk.h bootp.h decnet.h \
+	ethertype.h extract.h fddi.h interface.h igrp.h ipx.h \
+	llc.h machdep.h mib.h nfsfh.h nfsv2.h ntp.h ospf.h
+
+TAGHDR = \
+	/usr/include/arpa/tftp.h \
+	/usr/include/net/if_arp.h \
+	/usr/include/net/slip.h \
+	/usr/include/netinet/if_ether.h \
+	/usr/include/netinet/in.h \
+	/usr/include/netinet/ip_icmp.h \
+	/usr/include/netinet/tcp.h \
+	/usr/include/netinet/udp.h \
+	/usr/include/protocols/routed.h
+
+TAGFILES = $(SRC) $(HDR) $(TAGHDR)
+
+CLEANFILES = $(OBJ) tcpdump $(GENSRC)
+
+tcpdump: $(OBJ) @V_PCAPDEP@
+	@rm -f $@
+	$(CC) $(CFLAGS) -o $@ $(OBJ) $(LIBS)
+
+version.o: version.c
+version.c: $(srcdir)/VERSION
+	@rm -f $@
+	sed -e 's/.*/char version[] = "&";/' $(srcdir)/VERSION > $@
+
+install: force
+	$(INSTALL) -m 550 -o bin -g @V_GROUP@ tcpdump $(DESTDIR)$(BINDEST)
+
+install-man: force
+	$(INSTALL) -m 444 -o bin -g bin $(srcdir)/tcpdump.1 \
+	    $(DESTDIR)$(MANDEST)/man1
+
+lint:	$(GENSRC) force
+	lint -hbxn $(SRC) | \
+	    grep -v 'struct/union .* never defined' | \
+	    grep -v 'possible pointer alignment problem'
+
+clean:
+	rm -f $(CLEANFILES)
+
+distclean:
+	rm -f $(CLEANFILES) Makefile config.cache config.log config.status \
+	    gnuc.h os-proto.h
+
+tags:	$(TAGFILES)
+	ctags -wtd $(TAGFILES)
+
+tar:	force
+	@cwd=`pwd` ; dir=`basename $$cwd` ; name=tcpdump-`cat VERSION` ; \
+	    list="" ; tar="tar chFFf" ; \
+	    for i in `cat FILES` ; do list="$$list $$name/$$i" ; done; \
+	    echo \
+	    "rm -f ../$$name; ln -s $$dir ../$$name" ; \
+	     rm -f ../$$name; ln -s $$dir ../$$name ; \
+	    echo \
+	    "(cd .. ; $$tar - [lots of files]) | compress > /tmp/$$name.tar.Z" ; \
+	     (cd .. ; $$tar - $$list) | compress > /tmp/$$name.tar.Z ; \
+	    echo \
+	    "rm -f ../$$name" ; \
+	     rm -f ../$$name
+
+force:	/tmp
+depend:	$(GENSRC) force
+	./mkdep -c $(CC) $(DEFS) $(INCLS) $(SRC)
diff --git a/usr.sbin/tcpdump/README b/usr.sbin/tcpdump/README
index 1fc81620072..caecde9a087 100644
--- a/usr.sbin/tcpdump/README
+++ b/usr.sbin/tcpdump/README
@@ -1,21 +1,20 @@
-$OpenBSD: README,v 1.4 1996/07/13 11:01:06 mickey Exp $
-@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/README,v 1.4 1996/07/13 11:01:06 mickey Exp $ (LBL)
+@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/README,v 1.5 1996/12/12 16:23:02 bitblt Exp $ (LBL)
 
-TCPDUMP 3.2
+TCPDUMP 3.3
 Lawrence Berkeley National Laboratory
 Network Research Group
 tcpdump@ee.lbl.gov
-ftp://ftp.ee.lbl.gov/tcpdump-*.tar.Z
+ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
 
 This directory contains source code for tcpdump, a tool for network
 monitoring and data acquisition.  The original distribution is
-available via anonymous ftp to ftp.ee.lbl.gov, in tcpdump-*.tar.Z.
+available via anonymous ftp to ftp.ee.lbl.gov, in tcpdump.tar.Z.
 
 Tcpdump now uses libcap, a system-independent interface for user-level
 packet capture.  Before building tcpdump, you must first retrieve and
 build libpcap, also from LBL, in:
 
-	ftp://ftp.ee.lbl.gov/libpcap-*.tar.Z.
+	ftp://ftp.ee.lbl.gov/libpcap.tar.Z
 
 Once libpcap is built (either install it or make sure it's in
 ../libpcap), you can build tcpdump using the procedure in the INSTALL
@@ -39,7 +38,12 @@ all the input.
 Richard Stevens gives an excellent treatment of the Internet
 protocols in his book ``TCP/IP Illustrated, Volume 1''.
 If you want to learn more about tcpdump and how to interpret
-it's output, pick up this book.
+its output, pick up this book.
+
+Some tools for viewing and analyzing tcpdump trace files are available
+from the Internet Traffic Archive:
+
+	http://town.hall.org/Archives/pub/ITA/
 
 Problems, bugs, questions, desirable enhancements, source code
 contributions, etc., should be sent to the email address
diff --git a/usr.sbin/tcpdump/VERSION b/usr.sbin/tcpdump/VERSION
new file mode 100644
index 00000000000..eb39e5382f4
--- /dev/null
+++ b/usr.sbin/tcpdump/VERSION
@@ -0,0 +1 @@
+3.3
diff --git a/usr.sbin/tcpdump/acsite.m4 b/usr.sbin/tcpdump/acsite.m4
new file mode 100644
index 00000000000..27832805804
--- /dev/null
+++ b/usr.sbin/tcpdump/acsite.m4
@@ -0,0 +1,505 @@
+dnl @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/acsite.m4,v 1.1 1996/12/12 16:23:01 bitblt Exp $ (LBL)
+dnl
+dnl Copyright (c) 1995, 1996
+dnl	The Regents of the University of California.  All rights reserved.
+dnl
+dnl Redistribution and use in source and binary forms, with or without
+dnl modification, are permitted provided that: (1) source code distributions
+dnl retain the above copyright notice and this paragraph in its entirety, (2)
+dnl distributions including binary code include the above copyright notice and
+dnl this paragraph in its entirety in the documentation or other materials
+dnl provided with the distribution, and (3) all advertising materials mentioning
+dnl features or use of this software display the following acknowledgement:
+dnl ``This product includes software developed by the University of California,
+dnl Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+dnl the University nor the names of its contributors may be used to endorse
+dnl or promote products derived from this software without specific prior
+dnl written permission.
+dnl THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+dnl WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+dnl MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+dnl
+dnl LBL autoconf macros
+dnl
+
+dnl
+dnl Determine which compiler we're using (cc or gcc)
+dnl If using gcc, determine the version number
+dnl If using cc, require that it support ansi prototypes
+dnl If using gcc, use -O2 (otherwise use -O)
+dnl If using cc, explicitly specify /usr/local/include
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_C_INIT(copt, incls)
+dnl
+dnl results:
+dnl
+dnl	$1 (copt set)
+dnl	$2 (incls set)
+dnl	CC
+dnl	ac_cv_gcc_vers
+dnl	LBL_CFLAGS
+dnl
+dnl XXX need to add test to make sure ac_prog_cc hasn't been called
+AC_DEFUN(AC_LBL_C_INIT,
+    [AC_PREREQ(2.12)
+    $1=-O
+    $2=""
+    if test "${CFLAGS+set}" = set; then
+	    LBL_CFLAGS="$CFLAGS"
+    fi
+    if test -z "$CC" ; then
+	    case "$target_os" in
+
+	    bsdi*)
+		    AC_CHECK_PROG(SHLICC2, shlicc2, yes, no)
+		    if test $SHLICC2 = yes ; then
+			    CC=shlicc2
+			    export CC
+		    fi
+		    ;;
+	    esac
+    fi
+    AC_PROG_CC
+    if test $ac_cv_prog_gcc = yes ; then
+	    if test "$SHLICC2" = yes ; then
+		    ac_cv_gcc_vers=2
+		    $1=-O2
+	    else
+		    AC_MSG_CHECKING(gcc version)
+		    AC_CACHE_VAL(ac_cv_gcc_vers,
+			ac_cv_gcc_vers=`$CC -v 2>&1 | \
+			    sed -n -e '$s/.* //' -e '$s/\..*//p'`)
+		    AC_MSG_RESULT($ac_cv_gcc_vers)
+		    if test $ac_cv_gcc_vers -gt 1 ; then
+			    $1=-O2
+		    fi
+	    fi
+    else
+	    AC_MSG_CHECKING(that $CC handles ansi prototypes)
+	    AC_CACHE_VAL(ac_cv_cc_ansi_prototypes,
+		AC_TRY_COMPILE(
+		    [#include <sys/types.h>],
+		    [int frob(int, char *)],
+		    ac_cv_cc_ansi_prototypes=yes,
+		    ac_cv_cc_ansi_prototypes=no))
+	    AC_MSG_RESULT($ac_cv_cc_ansi_prototypes)
+	    if test $ac_cv_cc_ansi_prototypes = no ; then
+		    case "$target_os" in
+
+		    hpux*)
+			    AC_MSG_CHECKING(for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE))
+			    savedcflags="$CFLAGS"
+			    CFLAGS="-Aa -D_HPUX_SOURCE $CFLAGS"
+			    AC_CACHE_VAL(ac_cv_cc_hpux_cc_aa,
+				AC_TRY_COMPILE(
+				    [#include <sys/types.h>],
+				    [int frob(int, char *)],
+				    ac_cv_cc_hpux_cc_aa=yes,
+				    ac_cv_cc_hpux_cc_aa=no))
+			    AC_MSG_RESULT($ac_cv_cc_hpux_cc_aa)
+			    if test $ac_cv_cc_hpux_cc_aa = no ; then
+				    AC_MSG_ERROR(see the INSTALL for more info)
+			    fi
+			    CFLAGS="$savedcflags"
+			    V_CCOPT="-Aa $V_CCOPT"
+			    AC_DEFINE(_HPUX_SOURCE)
+			    ;;
+
+		    *)
+			    AC_MSG_ERROR(see the INSTALL for more info)
+			    ;;
+		    esac
+	    fi
+	    $2=-I/usr/local/include
+
+	    case "$target_os" in
+
+	    irix*)
+		    V_CCOPT="$V_CCOPT -xansi -signed -g3"
+		    ;;
+
+	    osf*)
+		    V_CCOPT="$V_CCOPT -g3"
+		    ;;
+
+	    ultrix*)
+		    AC_MSG_CHECKING(that Ultrix $CC hacks const in prototypes)
+		    AC_CACHE_VAL(ac_cv_cc_const_proto,
+			AC_TRY_COMPILE(
+			    [#include <sys/types.h>],
+			    [struct a { int b; };
+			    void c(const struct a *)],
+			    ac_cv_cc_const_proto=yes,
+			    ac_cv_cc_const_proto=no))
+		    AC_MSG_RESULT($ac_cv_cc_const_proto)
+		    if test $ac_cv_cc_const_proto = no ; then
+			    AC_DEFINE(const,)
+		    fi
+		    ;;
+	    esac
+    fi
+])
+
+dnl
+dnl Use pfopen.c if available and pfopen() not in standard libraries
+dnl Require libpcap
+dnl Look for libpcap in ..
+dnl Use the installed libpcap if there is no local version
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_LIBPCAP(pcapdep, incls)
+dnl
+dnl results:
+dnl
+dnl	$1 (pcapdep set)
+dnl	$2 (incls appended)
+dnl	LIBS
+dnl
+AC_DEFUN(AC_LBL_LIBPCAP,
+    [pfopen=/usr/examples/packetfilter/pfopen.c
+    if test -f $pfopen ; then
+	    AC_CHECK_FUNCS(pfopen)
+	    if test $ac_cv_func_pfopen = "no" ; then
+		    AC_MSG_RESULT(Using $pfopen)
+		    LIBS="$LIBS $pfopen"
+	    fi
+    fi
+    AC_MSG_CHECKING(for local pcap library)
+    libpcap=FAIL
+    lastdir=FAIL
+    places=`ls .. | sed -e 's,/$,,' -e 's,^,../,' | \
+	egrep '/libpcap-[[0-9]]*\.[[0-9]]*(\.[[0-9]]*)?([[ab]][[0-9]]*)?$'`
+    for dir in $places ../libpcap libpcap ; do
+	    basedir=`echo $dir | sed -e 's/[[ab]][[0-9]]*$//'`
+	    if test $lastdir = $basedir ; then
+		    dnl skip alphas when an actual release is present
+		    continue;
+	    fi
+	    lastdir=$dir
+	    if test -r $dir/pcap.c ; then
+		    libpcap=$dir/libpcap.a
+		    d=$dir
+		    dnl continue and select the last one that exists
+	    fi
+    done
+    if test $libpcap = FAIL ; then
+	    AC_MSG_RESULT(not found)
+	    AC_CHECK_LIB(pcap, main, libpcap="-lpcap")
+	    if test $libpcap = FAIL ; then
+		    AC_MSG_ERROR(see the INSTALL doc for more info)
+	    fi
+    else
+	    $1=$libpcap
+	    $2="-I$d $$2"
+	    AC_MSG_RESULT($libpcap)
+    fi
+    LIBS="$libpcap $LIBS"])
+
+dnl
+dnl Define RETSIGTYPE and RETSIGVAL
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_TYPE_SIGNAL
+dnl
+dnl results:
+dnl
+dnl	RETSIGTYPE (defined)
+dnl	RETSIGVAL (defined)
+dnl
+AC_DEFUN(AC_LBL_TYPE_SIGNAL,
+    [AC_TYPE_SIGNAL
+    if test "$ac_cv_type_signal" = void ; then
+	    AC_DEFINE(RETSIGVAL,)
+    else
+	    AC_DEFINE(RETSIGVAL,(0))
+    fi
+    case "$target_os" in
+
+    irix*)
+	    AC_DEFINE(_BSD_SIGNALS)
+	    ;;
+
+    *)
+	    AC_CHECK_FUNCS(sigset)
+	    if test $ac_cv_func_sigset = yes ; then
+		    AC_DEFINE(signal, sigset)
+	    fi
+	    ;;
+    esac])
+
+dnl
+dnl If using gcc, see if fixincludes should be run
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_FIXINCLUDES
+dnl
+AC_DEFUN(AC_LBL_FIXINCLUDES,
+    [if test $ac_cv_prog_gcc = yes ; then
+	    AC_MSG_CHECKING(if fixincludes is needed)
+	    AC_CACHE_VAL(ac_cv_gcc_fixincludes,
+		AC_TRY_COMPILE(
+		    [/*
+		     * This generates a "duplicate case value" when fixincludes
+		     * has not be run.
+		     */
+#		include <sys/types.h>
+#		include <sys/time.h>
+#		include <sys/ioctl.h>
+#		ifdef HAVE_SYS_IOCCOM_H
+#		include <sys/ioccom.h>
+#		endif],
+		    [switch (0) {
+		    case _IO('A', 1):;
+		    case _IO('B', 1):;
+		    }],
+		    ac_cv_gcc_fixincludes=yes,
+		    ac_cv_gcc_fixincludes=no))
+	    AC_MSG_RESULT($ac_cv_gcc_fixincludes)
+	    if test $ac_cv_gcc_fixincludes = no ; then
+		    # Don't cache failure
+		    unset ac_cv_gcc_fixincludes
+		    AC_MSG_ERROR(see the INSTALL for more info)
+	    fi
+    fi])
+
+dnl
+dnl Check for flex, default to lex
+dnl Require flex 2.4 or higher
+dnl Check for bison, default to yacc
+dnl Default to lex/yacc if both flex and bison are not available
+dnl Define the yy prefix string if using flex and bison
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_LEX_AND_YACC(lex, yacc, yyprefix)
+dnl
+dnl results:
+dnl
+dnl	$1 (lex set)
+dnl	$2 (yacc appended)
+dnl	$3 (optional flex and bison -P prefix)
+dnl
+AC_DEFUN(AC_LBL_LEX_AND_YACC,
+    [AC_CHECK_PROGS($1, flex, lex)
+    if test "$$1" = flex ; then
+	    # The -V flag was added in 2.4
+	    AC_MSG_CHECKING(for flex 2.4 or higher)
+	    AC_CACHE_VAL(ac_cv_flex_v24,
+		if flex -V >/dev/null 2>&1; then
+			ac_cv_flex_v24=yes
+		else
+			ac_cv_flex_v24=no
+		fi)
+	    AC_MSG_RESULT($ac_cv_flex_v24)
+	    if test $ac_cv_flex_v24 = no ; then
+		    s="2.4 or higher required"
+		    AC_MSG_WARN(ignoring obsolete flex executable ($s))
+		    $1=lex
+	    fi
+    fi
+    AC_CHECK_PROGS($2, bison, yacc)
+    if test "$$2" = bison ; then
+	    $2="$$2 -y"
+    fi
+    if test "$$1" != lex -a "$$2" = yacc -o "$$1" = lex -a "$$2" != yacc ; then
+	    AC_MSG_WARN(don't have both flex and bison; reverting to lex/yacc)
+	    $1=lex
+	    $2=yacc
+    fi
+    if test "$$1" = flex -a -n "$3" ; then
+	    $1="$$1 -P$3"
+	    $2="$$2 -p $3"
+    fi])
+
+dnl
+dnl Checks to see if union wait is used with WEXITSTATUS()
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_UNION_WAIT
+dnl
+dnl results:
+dnl
+dnl	DECLWAITSTATUS (defined)
+dnl
+AC_DEFUN(AC_LBL_UNION_WAIT,
+    [AC_MSG_CHECKING(if union wait is used)
+    AC_CACHE_VAL(ac_cv_union_wait,
+	AC_TRY_COMPILE([
+#	include <sys/types.h>
+#	include <sys/wait.h>],
+	    [int status;
+	    u_int i = WEXITSTATUS(status);
+	    u_int j = waitpid(0, &status, 0);],
+	    ac_cv_union_wait=no,
+	    ac_cv_union_wait=yes))
+    AC_MSG_RESULT($ac_cv_union_wait)
+    if test $ac_cv_union_wait = yes ; then
+	    AC_DEFINE(DECLWAITSTATUS,union wait)
+    else
+	    AC_DEFINE(DECLWAITSTATUS,int)
+    fi])
+
+dnl
+dnl Checks to see if the sockaddr struct has the 4.4 BSD sa_len member
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_SOCKADDR_SA_LEN
+dnl
+dnl results:
+dnl
+dnl	HAVE_SOCKADDR_SA_LEN (defined)
+dnl
+AC_DEFUN(AC_LBL_SOCKADDR_SA_LEN,
+    [AC_MSG_CHECKING(if sockaddr struct has sa_len member)
+    AC_CACHE_VAL(ac_cv_sockaddr_has_sa_len,
+	AC_TRY_COMPILE([
+#	include <sys/types.h>
+#	include <sys/socket.h>],
+	[u_int i = sizeof(((struct sockaddr *)0)->sa_len)],
+	ac_cv_sockaddr_has_sa_len=yes,
+	ac_cv_sockaddr_has_sa_len=no))
+    AC_MSG_RESULT($ac_cv_sockaddr_has_sa_len)
+    if test $ac_cv_sockaddr_has_sa_len = yes ; then
+	    AC_DEFINE(HAVE_SOCKADDR_SA_LEN)
+    fi])
+
+dnl
+dnl Checks to see if -R is used
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_HAVE_RUN_PATH
+dnl
+dnl results:
+dnl
+dnl	ac_cv_have_run_path (yes or no)
+dnl
+AC_DEFUN(AC_LBL_HAVE_RUN_PATH,
+    [AC_MSG_CHECKING(for ${CC-cc} -R)
+    AC_CACHE_VAL(ac_cv_have_run_path,
+	[echo 'main(){}' > conftest.c
+	${CC-cc} -o conftest conftest.c -R/a1/b2/c3 >conftest.out 2>&1
+	if test ! -s conftest.out ; then
+		ac_cv_have_run_path=yes
+	else
+		ac_cv_have_run_path=no
+	fi
+	rm -f conftest*])
+    AC_MSG_RESULT($ac_cv_have_run_path)
+    ])
+
+dnl
+dnl Checks to see if unaligned memory accesses fail
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_UNALIGNED_ACCESS
+dnl
+dnl results:
+dnl
+dnl	LBL_ALIGN (DEFINED)
+dnl
+AC_DEFUN(AC_LBL_UNALIGNED_ACCESS,
+    [AC_MSG_CHECKING(if unaligned accesses fail)
+    AC_CACHE_VAL(ac_cv_unaligned_fail,
+	[case "$target_cpu" in
+
+	alpha|hp*|mips|sparc)
+		ac_cv_unaligned_fail=yes
+		;;
+
+	*)
+		cat >conftest.c <<EOF
+#		include <sys/types.h>
+#		include <sys/wait.h>
+#		include <stdio.h>
+		unsigned char a[[5]] = { 1, 2, 3, 4, 5 };
+		main() {
+		unsigned int i;
+		pid_t pid;
+		int status;
+		/* avoid "core dumped" message */
+		pid = fork();
+		if (pid <  0)
+			exit(2);
+		if (pid > 0) {
+			/* parent */
+			pid = waitpid(pid, &status, 0);
+			if (pid < 0)
+				exit(3);
+			exit(!WIFEXITED(status));
+		}
+		/* child */
+		i = *(unsigned int *)&a[[1]];
+		printf("%d\n", i);
+		exit(0);
+		}
+EOF
+		${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS \
+		    conftest.c $LIBS >/dev/null 2>&1
+		if test ! -x conftest ; then
+			dnl failed to compile for some reason
+			ac_cv_unaligned_fail=yes
+		else
+			./conftest >conftest.out
+			if test ! -s conftest.out ; then
+				ac_cv_unaligned_fail=yes
+			else
+				ac_cv_unaligned_fail=no
+			fi
+		fi
+		rm -f conftest* core core.conftest
+		;;
+	esac])
+    AC_MSG_RESULT($ac_cv_unaligned_fail)
+    if test $ac_cv_unaligned_fail = yes ; then
+	    AC_DEFINE(LBL_ALIGN)
+    fi])
+
+dnl
+dnl If using gcc and the file .devel exists:
+dnl	Compile with -g (if supported) and -Wall
+dnl	If using gcc 2, do extra prototype checking
+dnl	If an os prototype include exists, symlink os-proto.h to it
+dnl
+dnl usage:
+dnl
+dnl	AC_LBL_DEVEL(copt)
+dnl
+dnl results:
+dnl
+dnl	$1 (copt appended)
+dnl	HAVE_OS_PROTO_H (defined)
+dnl	os-proto.h (symlinked)
+dnl
+AC_DEFUN(AC_LBL_DEVEL,
+    [rm -f os-proto.h
+    if test "${LBL_CFLAGS+set}" = set; then
+	    $1="$$1 ${LBL_CFLAGS}"
+    fi
+    if test $ac_cv_prog_gcc = yes -a -f .devel ; then
+	    if test "${LBL_CFLAGS+set}" != set; then
+		    if test "$ac_cv_prog_cc_g" = yes ; then
+			    $1="-g $$1"
+		    fi
+		    $1="$$1 -Wall"
+		    if test $ac_cv_gcc_vers -gt 1 ; then
+			    $1="$$1 -Wmissing-prototypes -Wstrict-prototypes"
+		    fi
+	    fi
+	    os=`echo $target_os | sed -e 's/\([[0-9]][[0-9]]*\)[[^0-9]].*$/\1/'`
+	    name="lbl/os-$os.h"
+	    if test -f $name ; then
+		    ln -s $name os-proto.h
+		    AC_DEFINE(HAVE_OS_PROTO_H)
+	    else
+		    AC_MSG_WARN(can't find $name)
+	    fi
+    fi])
diff --git a/usr.sbin/tcpdump/addrtoname.c b/usr.sbin/tcpdump/addrtoname.c
index c885670a06b..4b3ec282c86 100644
--- a/usr.sbin/tcpdump/addrtoname.c
+++ b/usr.sbin/tcpdump/addrtoname.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: addrtoname.c,v 1.4 1996/07/13 11:01:06 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -24,8 +22,8 @@
  *  and address to string conversion routines
  */
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: addrtoname.c,v 1.48 96/06/19 00:50:15 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/addrtoname.c,v 1.5 1996/12/12 16:23:00 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/types.h>
@@ -162,11 +160,11 @@ getname(const u_char *ap)
 	u_int32_t addr;
 	static struct hnamemem *p;		/* static for longjmp() */
 
-#ifndef TCPDUMP_ALIGN
+#ifndef LBL_ALIGN
 	addr = *(const u_int32_t *)ap;
 #else
 	/*
-	 * Deal with alignment.
+	 * Extract 32 bits in network order, dealing with alignment.
 	 */
 	switch ((long)ap & 3) {
 
@@ -175,26 +173,26 @@ getname(const u_char *ap)
 		break;
 
 	case 2:
-#if BYTE_ORDER == LITTLE_ENDIAN
-		addr = ((u_int32_t)*(u_short *)(ap + 2) << 16) |
-			(u_int32_t)*(u_short *)ap;
-#else
+#ifdef WORDS_BIGENDIAN
 		addr = ((u_int32_t)*(u_short *)ap << 16) |
 			(u_int32_t)*(u_short *)(ap + 2);
+#else
+		addr = ((u_int32_t)*(u_short *)(ap + 2) << 16) |
+			(u_int32_t)*(u_short *)ap;
 #endif
 		break;
 
 	default:
-#if BYTE_ORDER == LITTLE_ENDIAN
-		addr = ((u_int32_t)ap[3] << 24) |
-			((u_int32_t)ap[2] << 16) |
-			((u_int32_t)ap[1] << 8) |
-			(u_int32_t)ap[0];
-#else
+#ifdef WORDS_BIGENDIAN
 		addr = ((u_int32_t)ap[0] << 24) |
 			((u_int32_t)ap[1] << 16) |
 			((u_int32_t)ap[2] << 8) |
 			(u_int32_t)ap[3];
+#else
+		addr = ((u_int32_t)ap[3] << 24) |
+			((u_int32_t)ap[2] << 16) |
+			((u_int32_t)ap[1] << 8) |
+			(u_int32_t)ap[0];
 #endif
 		break;
 	}
@@ -740,7 +738,7 @@ dnaddr_string(u_short dnaddr)
 
 /* Return a zero'ed hnamemem struct and cuts down on calloc() overhead */
 struct hnamemem *
-newhnamemem()
+newhnamemem(void)
 {
 	register struct hnamemem *p;
 	static struct hnamemem *ptr = NULL;
diff --git a/usr.sbin/tcpdump/addrtoname.h b/usr.sbin/tcpdump/addrtoname.h
index ce0d795444c..cbf912bd3d2 100644
--- a/usr.sbin/tcpdump/addrtoname.h
+++ b/usr.sbin/tcpdump/addrtoname.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: addrtoname.h,v 1.4 1996/07/13 11:01:07 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1992, 1993, 1994, 1995
  *	The Regents of the University of California.  All rights reserved.
@@ -20,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: addrtoname.h,v 1.13 95/05/04 17:52:44 mccanne Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/addrtoname.h,v 1.5 1996/12/12 16:22:59 bitblt Exp $ (LBL)
  */
 
 /* Name to address translation routines. */
diff --git a/usr.sbin/tcpdump/appletalk.h b/usr.sbin/tcpdump/appletalk.h
index 7943072a778..8bf5f668144 100644
--- a/usr.sbin/tcpdump/appletalk.h
+++ b/usr.sbin/tcpdump/appletalk.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: appletalk.h,v 1.4 1996/07/13 11:01:07 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,7 +20,7 @@
  *
  * AppleTalk protocol formats (courtesy Bill Croft of Stanford/SUMEX).
  *
- * @(#) Header: appletalk.h,v 1.12 96/06/03 02:54:24 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/appletalk.h,v 1.5 1996/12/12 16:22:59 bitblt Exp $ (LBL)
  */
 
 struct LAP {
diff --git a/usr.sbin/tcpdump/atime.awk b/usr.sbin/tcpdump/atime.awk
index 0398a25bdff..b42dec24018 100644
--- a/usr.sbin/tcpdump/atime.awk
+++ b/usr.sbin/tcpdump/atime.awk
@@ -1,6 +1,3 @@
-#	$OpenBSD: atime.awk,v 1.3 1996/06/10 07:47:12 deraadt Exp $
-#	$NetBSD: atime.awk,v 1.2 1995/03/06 19:09:52 mycroft Exp $
-
 $6 ~ /^ack/ && $5 !~ /[SFR]/ 	{
 	# given a tcpdump ftp trace, output one line for each ack
 	# in the form
diff --git a/usr.sbin/tcpdump/bootp.h b/usr.sbin/tcpdump/bootp.h
index 3ef7248cb14..8db301b826b 100644
--- a/usr.sbin/tcpdump/bootp.h
+++ b/usr.sbin/tcpdump/bootp.h
@@ -1,6 +1,4 @@
-/*	$OpenBSD: bootp.h,v 1.4 1996/07/13 11:01:08 mickey Exp $	*/
-
-/* @(#) Header: bootp.h,v 1.7 95/05/04 17:52:46 mccanne Exp (LBL) */
+/* @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/bootp.h,v 1.5 1996/12/12 16:22:58 bitblt Exp $ (LBL) */
 /*
  * Bootstrap Protocol (BOOTP).  RFC951 and RFC1048.
  *
diff --git a/usr.sbin/tcpdump/bpf_dump.c b/usr.sbin/tcpdump/bpf_dump.c
index ffce0bcdc43..f37db3fd7d3 100644
--- a/usr.sbin/tcpdump/bpf_dump.c
+++ b/usr.sbin/tcpdump/bpf_dump.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: bpf_dump.c,v 1.4 1996/07/13 11:01:08 mickey Exp $	*/
-
 /*
- * Copyright (c) 1992, 1993, 1994, 1995
+ * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -21,8 +19,8 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: bpf_dump.c,v 1.8 95/10/19 20:28:00 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/bpf_dump.c,v 1.5 1996/12/12 16:22:57 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/types.h>
diff --git a/usr.sbin/tcpdump/decnet.h b/usr.sbin/tcpdump/decnet.h
index b3c63389551..ffb97e3fc20 100644
--- a/usr.sbin/tcpdump/decnet.h
+++ b/usr.sbin/tcpdump/decnet.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: decnet.h,v 1.4 1996/07/13 11:01:08 mickey Exp $	*/
-
 /*
  * Copyright (c) 1992, 1994, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -20,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: decnet.h,v 1.5 96/06/23 02:11:44 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/decnet.h,v 1.5 1996/12/12 16:22:57 bitblt Exp $ (LBL)
  */
 
 typedef unsigned char byte[1];		/* single byte field */
@@ -453,30 +451,3 @@ struct dcmsg				/* disconnect confirm message */
     word	dc_src;			/* source link address */
     word	dc_reason;		/* reason code */
   };
-
-/*
- * Like the macros in extract.h, except that since DECNET is a little-endian
- * protocol, the BYTE_ORDER sense is reversed.
- */
-#define	EXTRACT_8BITS(p)	(*(p))
-#if BYTE_ORDER == BIG_ENDIAN
-#define EXTRACT_16BITS(p)\
-	((u_short)\
-		(*((u_char *)p+1)<<8|\
-		 *((u_char *)p+0)<<0))
-#define EXTRACT_32BITS(p)\
-		(*((u_char *)p+3)<<24|\
-		 *((u_char *)p+2)<<16|\
-		 *((u_char *)p+1)<<8|\
-		 *((u_char *)p+0)<<0)
-#else
-#define EXTRACT_16BITS(p)\
-	((u_short)\
-		(*((u_char *)p+0)<<8|\
-		 *((u_char *)p+1)<<0))
-#define EXTRACT_32BITS(p)\
-		(*((u_char *)p+0)<<24|\
-		 *((u_char *)p+1)<<16|\
-		 *((u_char *)p+2)<<8|\
-		 *((u_char *)p+3)<<0)
-#endif
diff --git a/usr.sbin/tcpdump/ethertype.h b/usr.sbin/tcpdump/ethertype.h
index e842d9bb1d3..75c1b815d23 100644
--- a/usr.sbin/tcpdump/ethertype.h
+++ b/usr.sbin/tcpdump/ethertype.h
@@ -1,7 +1,5 @@
-/*	$OpenBSD: ethertype.h,v 1.5 1996/11/12 07:54:56 mickey Exp $	*/
-
 /*
- * Copyright (c) 1993, 1994
+ * Copyright (c) 1993, 1994, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -20,15 +18,20 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: ethertype.h,v 1.4 94/06/14 20:11:45 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/ethertype.h,v 1.6 1996/12/12 16:22:56 bitblt Exp $ (LBL)
  */
 
-/* Map between Ethernet protocol types and names */
+/* Types missing from some systems */
 
-/* Add other Ethernet packet types here */
+#ifndef ETHERTYPE_NS
+#define ETHERTYPE_NS		0x0600
+#endif
 #ifndef	ETHERTYPE_SPRITE
 #define	ETHERTYPE_SPRITE	0x0500
 #endif
+#ifndef ETHERTYPE_TRAIL
+#define ETHERTYPE_TRAIL		0x1000
+#endif
 #ifndef	ETHERTYPE_MOPDL
 #define	ETHERTYPE_MOPDL		0x6001
 #endif
@@ -41,6 +44,12 @@
 #ifndef	ETHERTYPE_LAT
 #define	ETHERTYPE_LAT		0x6004
 #endif
+#ifndef ETHERTYPE_SCA
+#define ETHERTYPE_SCA		0x6007
+#endif
+#ifndef ETHERTYPE_REVARP
+#define ETHERTYPE_REVARP	0x8035
+#endif
 #ifndef	ETHERTYPE_LANBRIDGE
 #define	ETHERTYPE_LANBRIDGE	0x8038
 #endif
@@ -56,19 +65,12 @@
 #ifndef	ETHERTYPE_VPROD
 #define	ETHERTYPE_VPROD		0x805c
 #endif
-#ifndef	ETHERTYPE_LOOPBACK
-#define	ETHERTYPE_LOOPBACK	0x9000
-#endif
-#ifndef ETHERTYPE_8022
-#define ETHERTYPE_8022		0x0004
-#endif
 #ifndef ETHERTYPE_ATALK
 #define ETHERTYPE_ATALK		0x809b
 #endif
 #ifndef ETHERTYPE_AARP
 #define ETHERTYPE_AARP		0x80f3
 #endif
-#ifndef ETHERTYPE_NS
-#define ETHERTYPE_NS		0x0600
+#ifndef	ETHERTYPE_LOOPBACK
+#define	ETHERTYPE_LOOPBACK	0x9000
 #endif
-
diff --git a/usr.sbin/tcpdump/extract.h b/usr.sbin/tcpdump/extract.h
index 9561f022669..18a3a49e3cc 100644
--- a/usr.sbin/tcpdump/extract.h
+++ b/usr.sbin/tcpdump/extract.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: extract.h,v 1.4 1996/07/13 11:01:09 mickey Exp $	*/
-
 /*
  * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -20,20 +18,40 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: extract.h,v 1.12 96/06/20 18:48:42 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/extract.h,v 1.5 1996/12/12 16:22:55 bitblt Exp $ (LBL)
  */
 
+/* Network to host order macros */
+
 #ifdef LBL_ALIGN
-#define EXTRACT_SHORT(p)\
-	((u_short)\
-		((u_short)*((u_char *)(p)+0)<<8|\
-		 (u_short)*((u_char *)(p)+1)<<0))
-#define EXTRACT_LONG(p)\
-		((u_int32_t)*((u_char *)(p)+0)<<24|\
-		 (u_int32_t)*((u_char *)(p)+1)<<16|\
-		 (u_int32_t)*((u_char *)(p)+2)<<8|\
-		 (u_int32_t)*((u_char *)(p)+3)<<0)
+#define EXTRACT_16BITS(p) \
+	((u_short)*((u_char *)(p) + 0) << 8 | \
+	(u_short)*((u_char *)(p) + 1))
+#define EXTRACT_32BITS(p) \
+	((u_int32_t)*((u_char *)(p) + 0) << 24 | \
+	(u_int32_t)*((u_char *)(p) + 1) << 16 | \
+	(u_int32_t)*((u_char *)(p) + 2) << 8 | \
+	(u_int32_t)*((u_char *)(p) + 3))
 #else
-#define EXTRACT_SHORT(p)	((u_short)ntohs(*(u_short *)(p)))
-#define EXTRACT_LONG(p)		(ntohl(*(u_int32_t *)(p)))
+#define EXTRACT_16BITS(p) \
+	((u_short)ntohs(*(u_short *)(p)))
+#define EXTRACT_32BITS(p) \
+	((u_int32_t)ntohl(*(u_int32_t *)(p)))
 #endif
+
+#define EXTRACT_24BITS(p) \
+	((u_int32_t)*((u_char *)(p) + 0) << 16 | \
+	(u_int32_t)*((u_char *)(p) + 1) << 8 | \
+	(u_int32_t)*((u_char *)(p) + 2))
+
+/* Little endian protocol host order macros */
+
+#define EXTRACT_LE_8BITS(p) (*(p))
+#define EXTRACT_LE_16BITS(p) \
+	((u_short)*((u_char *)(p) + 1) << 8 | \
+	(u_short)*((u_char *)(p) + 0))
+#define EXTRACT_LE_32BITS(p) \
+	((u_int32_t)*((u_char *)(p) + 3) << 24 | \
+	(u_int32_t)*((u_char *)(p) + 2) << 16 | \
+	(u_int32_t)*((u_char *)(p) + 1) << 8 | \
+	(u_int32_t)*((u_char *)(p) + 0))
diff --git a/usr.sbin/tcpdump/fddi.h b/usr.sbin/tcpdump/fddi.h
index a97bd3e0477..44bfc48e62c 100644
--- a/usr.sbin/tcpdump/fddi.h
+++ b/usr.sbin/tcpdump/fddi.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: fddi.h,v 1.4 1996/07/13 11:01:09 mickey Exp $	*/
-
 /*
  * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -20,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: fddi.h,v 1.8 96/06/03 03:06:04 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/fddi.h,v 1.5 1996/12/12 16:22:55 bitblt Exp $ (LBL)
  */
 
 /*
diff --git a/usr.sbin/tcpdump/gnuc.h b/usr.sbin/tcpdump/gnuc.h
new file mode 100644
index 00000000000..495bdf3bceb
--- /dev/null
+++ b/usr.sbin/tcpdump/gnuc.h
@@ -0,0 +1,43 @@
+/* @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/gnuc.h,v 1.1 1996/12/12 16:22:54 bitblt Exp $ (LBL) */
+
+/* Define __P() macro, if necessary */
+#ifndef __P
+#if __STDC__
+#define __P(protos) protos
+#else
+#define __P(protos) ()
+#endif
+#endif
+
+/* inline foo */
+#ifdef __GNUC__
+#define inline __inline
+#else
+#define inline
+#endif
+
+/*
+ * Handle new and old "dead" routine prototypes
+ *
+ * For example:
+ *
+ *	__dead void foo(void) __attribute__((volatile));
+ *
+ */
+#ifdef __GNUC__
+#ifndef __dead
+#define __dead volatile
+#endif
+#if __GNUC__ < 2  || (__GNUC__ == 2 && __GNUC_MINOR__ < 5)
+#ifndef __attribute__
+#define __attribute__(args)
+#endif
+#endif
+#else
+#ifndef __dead
+#define __dead
+#endif
+#ifndef __attribute__
+#define __attribute__(args)
+#endif
+#endif
diff --git a/usr.sbin/tcpdump/igrp.h b/usr.sbin/tcpdump/igrp.h
new file mode 100644
index 00000000000..cc6088a8217
--- /dev/null
+++ b/usr.sbin/tcpdump/igrp.h
@@ -0,0 +1,36 @@
+/* Cisco IGRP definitions */
+
+/* IGRP Header */
+
+struct igrphdr {
+#ifdef WORDS_BIGENDIAN
+	u_char ig_v:4;		/* protocol version number */
+	u_char ig_op:4;		/* opcode */
+#else
+	u_char ig_op:4;		/* opcode */
+	u_char ig_v:4;		/* protocol version number */
+#endif
+	u_char ig_ed;		/* edition number */
+	u_short ig_as;		/* autonomous system number */
+	u_short ig_ni;		/* number of subnet in local net */
+	u_short ig_ns;		/* number of networks in AS */
+	u_short ig_nx;		/* number of networks ouside AS */
+	u_short ig_sum;		/* checksum of IGRP header & data */
+};
+
+#define IGRP_UPDATE	1
+#define IGRP_REQUEST	2
+
+/* IGRP routing entry */
+
+struct igrprte {
+	u_char igr_net[3];	/* 3 significant octets of IP address */
+	u_char igr_dly[3];	/* delay in tens of microseconds */
+	u_char igr_bw[3];	/* bandwidth in units of 1 kb/s */
+	u_char igr_mtu[2];	/* MTU in octets */
+	u_char igr_rel;		/* percent packets successfully tx/rx */
+	u_char igr_ld;		/* percent of channel occupied */
+	u_char igr_hct;		/* hop count */
+};
+
+#define IGRP_RTE_SIZE	14	/* don't believe sizeof ! */
diff --git a/usr.sbin/tcpdump/install-sh b/usr.sbin/tcpdump/install-sh
new file mode 100644
index 00000000000..ebc66913e94
--- /dev/null
+++ b/usr.sbin/tcpdump/install-sh
@@ -0,0 +1,250 @@
+#! /bin/sh
+#
+# install - install a program, script, or datafile
+# This comes from X11R5 (mit/util/scripts/install.sh).
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+#
+# Calling this script install-sh is preferred over install.sh, to prevent
+# `make' implicit rules from creating a file called install from it
+# when there is no Makefile.
+#
+# This script is compatible with the BSD install script, but was written
+# from scratch.  It can only install one file at a time, a restriction
+# shared with many OS's install programs.
+
+
+# set DOITPROG to echo to test this script
+
+# Don't use :- since 4.3BSD and earlier shells don't like it.
+doit="${DOITPROG-}"
+
+
+# put in absolute paths if you don't have them in your path; or use env. vars.
+
+mvprog="${MVPROG-mv}"
+cpprog="${CPPROG-cp}"
+chmodprog="${CHMODPROG-chmod}"
+chownprog="${CHOWNPROG-chown}"
+chgrpprog="${CHGRPPROG-chgrp}"
+stripprog="${STRIPPROG-strip}"
+rmprog="${RMPROG-rm}"
+mkdirprog="${MKDIRPROG-mkdir}"
+
+transformbasename=""
+transform_arg=""
+instcmd="$mvprog"
+chmodcmd="$chmodprog 0755"
+chowncmd=""
+chgrpcmd=""
+stripcmd=""
+rmcmd="$rmprog -f"
+mvcmd="$mvprog"
+src=""
+dst=""
+dir_arg=""
+
+while [ x"$1" != x ]; do
+    case $1 in
+	-c) instcmd="$cpprog"
+	    shift
+	    continue;;
+
+	-d) dir_arg=true
+	    shift
+	    continue;;
+
+	-m) chmodcmd="$chmodprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-o) chowncmd="$chownprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-g) chgrpcmd="$chgrpprog $2"
+	    shift
+	    shift
+	    continue;;
+
+	-s) stripcmd="$stripprog"
+	    shift
+	    continue;;
+
+	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
+	    shift
+	    continue;;
+
+	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
+	    shift
+	    continue;;
+
+	*)  if [ x"$src" = x ]
+	    then
+		src=$1
+	    else
+		# this colon is to work around a 386BSD /bin/sh bug
+		:
+		dst=$1
+	    fi
+	    shift
+	    continue;;
+    esac
+done
+
+if [ x"$src" = x ]
+then
+	echo "install:	no input file specified"
+	exit 1
+else
+	true
+fi
+
+if [ x"$dir_arg" != x ]; then
+	dst=$src
+	src=""
+	
+	if [ -d $dst ]; then
+		instcmd=:
+	else
+		instcmd=mkdir
+	fi
+else
+
+# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
+# might cause directories to be created, which would be especially bad 
+# if $src (and thus $dsttmp) contains '*'.
+
+	if [ -f $src -o -d $src ]
+	then
+		true
+	else
+		echo "install:  $src does not exist"
+		exit 1
+	fi
+	
+	if [ x"$dst" = x ]
+	then
+		echo "install:	no destination specified"
+		exit 1
+	else
+		true
+	fi
+
+# If destination is a directory, append the input filename; if your system
+# does not like double slashes in filenames, you may need to add some logic
+
+	if [ -d $dst ]
+	then
+		dst="$dst"/`basename $src`
+	else
+		true
+	fi
+fi
+
+## this sed command emulates the dirname command
+dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
+
+# Make sure that the destination directory exists.
+#  this part is taken from Noah Friedman's mkinstalldirs script
+
+# Skip lots of stat calls in the usual case.
+if [ ! -d "$dstdir" ]; then
+defaultIFS='	
+'
+IFS="${IFS-${defaultIFS}}"
+
+oIFS="${IFS}"
+# Some sh's can't handle IFS=/ for some reason.
+IFS='%'
+set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
+IFS="${oIFS}"
+
+pathcomp=''
+
+while [ $# -ne 0 ] ; do
+	pathcomp="${pathcomp}${1}"
+	shift
+
+	if [ ! -d "${pathcomp}" ] ;
+        then
+		$mkdirprog "${pathcomp}"
+	else
+		true
+	fi
+
+	pathcomp="${pathcomp}/"
+done
+fi
+
+if [ x"$dir_arg" != x ]
+then
+	$doit $instcmd $dst &&
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi
+else
+
+# If we're going to rename the final executable, determine the name now.
+
+	if [ x"$transformarg" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		dstfile=`basename $dst $transformbasename | 
+			sed $transformarg`$transformbasename
+	fi
+
+# don't allow the sed command to completely eliminate the filename
+
+	if [ x"$dstfile" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		true
+	fi
+
+# Make a temp file name in the proper directory.
+
+	dsttmp=$dstdir/#inst.$$#
+
+# Move or copy the file name to the temp name
+
+	$doit $instcmd $src $dsttmp &&
+
+	trap "rm -f ${dsttmp}" 0 &&
+
+# and set any options; do chmod last to preserve setuid bits
+
+# If any of these fail, we abort the whole thing.  If we want to
+# ignore errors from any of these, just make sure not to ignore
+# errors from the above "$doit $instcmd $src $dsttmp" command.
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi &&
+
+# Now rename the file to the real destination.
+
+	$doit $rmcmd -f $dstdir/$dstfile &&
+	$doit $mvcmd $dsttmp $dstdir/$dstfile 
+
+fi &&
+
+
+exit 0
diff --git a/usr.sbin/tcpdump/interface.h b/usr.sbin/tcpdump/interface.h
index b46827587b3..35ae9a29d1d 100644
--- a/usr.sbin/tcpdump/interface.h
+++ b/usr.sbin/tcpdump/interface.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: interface.h,v 1.4 1996/07/13 11:01:10 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -20,12 +18,13 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: interface.h,v 1.90 96/06/23 02:44:19 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/interface.h,v 1.5 1996/12/12 16:22:53 bitblt Exp $ (LBL)
  */
 
 #ifndef tcpdump_interface_h
 #define tcpdump_interface_h
 
+#include "gnuc.h"
 #ifdef HAVE_OS_PROTO_H
 #include "os-proto.h"
 #endif
@@ -52,95 +51,12 @@ extern int packettype;		/* as specified by -T */
 #define PT_RTP		4	/* Real-Time Applications protocol */
 #define PT_RTCP		5	/* Real-Time Applications control protocol */
 
-extern char *program_name;	/* used to generate self-identifying messages */
-
-extern int32_t thiszone;	/* seconds offset from gmt to local time */
-
-extern int snaplen;
-/* global pointers to beginning and end of current packet (during printing) */
-extern const u_char *packetp;
-extern const u_char *snapend;
-
-extern int pcap_fddipad;	/* alignment offset for FDDI headers,in bytes */
-
-#ifdef __STDC__
-struct timeval;
-#endif
-
-extern void ts_print(const struct timeval *);
-extern int32_t gmt2local(void);
-
-extern int fn_print(const u_char *, const u_char *);
-extern int fn_printn(const u_char *, u_int, const u_char *);
-extern const char *tok2str(const struct tok *, const char *, int);
-extern char *dnaddr_string(u_short);
-extern char *savestr(const char *);
-
-extern void wrapup(int);
-
-#if __STDC__
-extern __dead void error(const char *, ...)
-    __attribute__((volatile, format (printf, 1, 2)));
-extern void warning(const char *, ...) __attribute__ ((format (printf, 1, 2)));
-#endif
-
-extern char *read_infile(char *);
-extern char *copy_argv(char **);
-
-extern char *isonsap_string(const u_char *);
-extern char *llcsap_string(u_char);
-extern char *protoid_string(const u_char *);
-extern char *dnname_string(u_short);
-extern char *dnnum_string(u_short);
-
-/* The printer routines. */
-
-#ifdef __STDC__
-struct pcap_pkthdr;
-#endif
-
-extern void atm_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
-extern void ether_if_print(u_char *, const struct pcap_pkthdr *,
-			   const u_char *);
-extern void fddi_if_print(u_char *, const struct pcap_pkthdr *, const u_char*);
-extern void null_if_print(u_char *, const struct pcap_pkthdr *, const u_char*);
-extern void ppp_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
-extern void sl_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
-
-extern void arp_print(const u_char *, int, int);
-extern void ip_print(const u_char *, int);
-extern void tcp_print(const u_char *, int, const u_char *);
-extern void udp_print(const u_char *, int, const u_char *);
-extern void icmp_print(const u_char *, const u_char *);
-extern void default_print(const u_char *, int);
-extern void default_print_unaligned(const u_char *, int);
-
-extern void aarp_print(const u_char *, int);
-extern void atalk_print(const u_char *, int);
-extern void bootp_print(const u_char *, int, u_short, u_short);
-extern void decnet_print(const u_char *, int, int);
-extern void egp_print(const u_char *, int, const u_char *);
-extern int ether_encap_print(u_short, const u_char *, int, int);
-extern void ipx_print(const u_char *, int length);
-extern void isoclns_print(const u_char *, int, int,
-			  const u_char *, const u_char *);
-extern int llc_print(const u_char *, int, int, const u_char *, const u_char *);
-extern void nfsreply_print(const u_char *, int, const u_char *);
-extern void nfsreq_print(const u_char *, int, const u_char *);
-extern void ns_print(const u_char *, int);
-extern void ntp_print(const u_char *, int);
-extern void ospf_print(const u_char *, int, const u_char *);
-extern void rip_print(const u_char *, int);
-extern void snmp_print(const u_char *, int);
-extern void sunrpcrequest_print(const u_char *, int, const u_char *);
-extern void tftp_print(const u_char *, int);
-extern void wb_print(const void *, int);
-extern void dvmrp_print(const u_char *, int);
-extern void pim_print(const u_char *, int);
-extern void krb_print(const u_char *, int);
-
+#ifndef min
 #define min(a,b) ((a)>(b)?(b):(a))
+#endif
+#ifndef max
 #define max(a,b) ((b)>(a)?(b):(a))
+#endif
 
 /*
  * The default snapshot length.  This value allows most printers to print
@@ -186,15 +102,102 @@ extern void krb_print(const u_char *, int);
 #define HTONL(x)	(x) = htonl(x)
 #define HTONS(x)	(x) = htons(x)
 #endif
+#endif
+
+extern char *program_name;	/* used to generate self-identifying messages */
+
+extern int32_t thiszone;	/* seconds offset from gmt to local time */
+
+extern int snaplen;
+/* global pointers to beginning and end of current packet (during printing) */
+extern const u_char *packetp;
+extern const u_char *snapend;
+
+/* True if  "l" bytes of "var" were captured */
+#define TTEST2(var, l) ((u_char *)&(var) <= snapend - (l))
 
-/* some systems don't define these */
-#ifndef ETHERTYPE_REVARP
-#define ETHERTYPE_REVARP	0x8035
+/* True if "var" was captured */
+#define TTEST(var) TTEST2(var, sizeof(var))
+
+/* Bail if "l" bytes of "var" were not captured */
+#define TCHECK2(var, l) if (!TTEST2(var, l)) goto trunc
+
+/* Bail if "var" was not captured */
+#define TCHECK(var) TCHECK2(var, sizeof(var))
+
+#ifdef __STDC__
+struct timeval;
 #endif
 
-#ifndef REVARP_REQUEST
-#define REVARP_REQUEST		3
-#define REVARP_REPLY		4
+extern void ts_print(const struct timeval *);
+extern int32_t gmt2local(void);
+
+extern int fn_print(const u_char *, const u_char *);
+extern int fn_printn(const u_char *, u_int, const u_char *);
+extern const char *tok2str(const struct tok *, const char *, int);
+extern char *dnaddr_string(u_short);
+extern char *savestr(const char *);
+
+extern void wrapup(int);
+
+#if __STDC__
+extern __dead void error(const char *, ...)
+    __attribute__((volatile, format (printf, 1, 2)));
+extern void warning(const char *, ...) __attribute__ ((format (printf, 1, 2)));
 #endif
 
+extern char *read_infile(char *);
+extern char *copy_argv(char **);
+
+extern char *isonsap_string(const u_char *);
+extern char *llcsap_string(u_char);
+extern char *protoid_string(const u_char *);
+extern char *dnname_string(u_short);
+extern char *dnnum_string(u_short);
+
+/* The printer routines. */
+
+#ifdef __STDC__
+struct pcap_pkthdr;
 #endif
+
+extern int ether_encap_print(u_short, const u_char *, u_int, u_int);
+extern int llc_print(const u_char *, u_int, u_int, const u_char *,
+	const u_char *);
+extern void aarp_print(const u_char *, u_int);
+extern void arp_print(const u_char *, u_int, u_int);
+extern void atalk_print(const u_char *, u_int);
+extern void atm_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void bootp_print(const u_char *, u_int, u_short, u_short);
+extern void decnet_print(const u_char *, u_int, u_int);
+extern void default_print(const u_char *, u_int);
+extern void default_print_unaligned(const u_char *, u_int);
+extern void dvmrp_print(const u_char *, u_int);
+extern void egp_print(const u_char *, u_int, const u_char *);
+extern void ether_if_print(u_char *, const struct pcap_pkthdr *,
+	const u_char *);
+extern void fddi_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void gre_print(const u_char *, u_int);
+extern void icmp_print(const u_char *, const u_char *);
+extern void igrp_print(const u_char *, u_int, const u_char *);
+extern void ip_print(const u_char *, u_int);
+extern void ipx_print(const u_char *, u_int);
+extern void isoclns_print(const u_char *, u_int, u_int, const u_char *,
+	const u_char *);
+extern void krb_print(const u_char *, u_int);
+extern void nfsreply_print(const u_char *, u_int, const u_char *);
+extern void nfsreq_print(const u_char *, u_int, const u_char *);
+extern void ns_print(const u_char *, u_int);
+extern void ntp_print(const u_char *, u_int);
+extern void null_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void ospf_print(const u_char *, u_int, const u_char *);
+extern void pim_print(const u_char *, u_int);
+extern void ppp_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void rip_print(const u_char *, u_int);
+extern void sl_if_print(u_char *, const struct pcap_pkthdr *, const u_char *);
+extern void snmp_print(const u_char *, u_int);
+extern void sunrpcrequest_print(const u_char *, u_int, const u_char *);
+extern void tcp_print(const u_char *, u_int, const u_char *);
+extern void tftp_print(const u_char *, u_int);
+extern void udp_print(const u_char *, u_int, const u_char *);
+extern void wb_print(const void *, u_int);
diff --git a/usr.sbin/tcpdump/ipx.h b/usr.sbin/tcpdump/ipx.h
index 932f1acd96f..67a2bc00617 100644
--- a/usr.sbin/tcpdump/ipx.h
+++ b/usr.sbin/tcpdump/ipx.h
@@ -1,9 +1,7 @@
-/*	$OpenBSD: ipx.h,v 1.4 1996/07/13 11:01:10 mickey Exp $	*/
-
 /*
  * IPX protocol formats 
  *
- * @(#) Header: ipx.h,v 1.1 94/06/09 11:47:03 mccanne Exp
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/ipx.h,v 1.5 1996/12/12 16:22:52 bitblt Exp $
  */
 
 /* well-known sockets */
diff --git a/usr.sbin/tcpdump/llc.h b/usr.sbin/tcpdump/llc.h
index 850fd4f49c9..cf1496f7baa 100644
--- a/usr.sbin/tcpdump/llc.h
+++ b/usr.sbin/tcpdump/llc.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: llc.h,v 1.4 1996/07/13 11:01:11 mickey Exp $	*/
-
 /*
  * Copyright (c) 1993, 1994
  *	The Regents of the University of California.  All rights reserved.
@@ -20,7 +18,7 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * @(#) Header: llc.h,v 1.4 94/06/14 20:11:46 leres Exp (LBL)
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/llc.h,v 1.5 1996/12/12 16:22:52 bitblt Exp $ (LBL)
  */
 
 /*
diff --git a/usr.sbin/tcpdump/machdep.c b/usr.sbin/tcpdump/machdep.c
new file mode 100644
index 00000000000..058fa393aaa
--- /dev/null
+++ b/usr.sbin/tcpdump/machdep.c
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/machdep.c,v 1.1 1996/12/12 16:22:51 bitblt Exp $ (LBL)";
+#endif
+
+#include <sys/types.h>
+#ifdef __osf__
+#include <sys/sysinfo.h>
+#include <sys/proc.h>
+#endif
+
+#include <pcap.h>
+
+#include "machdep.h"
+
+int
+abort_on_misalignment(char *ebuf)
+{
+#ifdef __osf__
+	static int buf[2] = { SSIN_UACPROC, UAC_SIGBUS };
+
+	if (setsysinfo(SSI_NVPAIRS, (caddr_t)buf, 1, 0, 0) < 0) {
+		(void)sprintf(ebuf, "setsysinfo: %s", pcap_strerror(errno));
+		return (-1);
+	}
+#endif
+	return (0);
+}
diff --git a/usr.sbin/tcpdump/machdep.h b/usr.sbin/tcpdump/machdep.h
new file mode 100644
index 00000000000..f5166ac5664
--- /dev/null
+++ b/usr.sbin/tcpdump/machdep.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/machdep.h,v 1.1 1996/12/12 16:22:51 bitblt Exp $ (LBL)
+ */
+#ifndef tcpdump_machdep_h
+#define tcpdump_machdep_h
+
+int abort_on_misalignment(char *);
+#endif
diff --git a/usr.sbin/tcpdump/makemib b/usr.sbin/tcpdump/makemib
index 74b6d073fe5..9dc0fd2e25d 100644
--- a/usr.sbin/tcpdump/makemib
+++ b/usr.sbin/tcpdump/makemib
@@ -1,9 +1,6 @@
 #!/bin/sh
 #
-#	$OpenBSD: makemib,v 1.4 1996/07/13 11:01:11 mickey Exp $
-#	$NetBSD: makemib,v 1.2 1995/03/06 19:10:22 mycroft Exp $
-#
-# Copyright (c) 1990, by John Robert LoVerso.
+# Copyright (c) 1990, 1996, by John Robert LoVerso.
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms are permitted
@@ -14,9 +11,10 @@
 # by John Robert LoVerso.
 # THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 # IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
-# WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 #
-# @(#) Id: makemib,v 2.1 90/07/10 23:51:54 loverso Exp Locker: loverso (jlv)
+# @(#) $Id: makemib,v 1.5 1996/12/12 16:22:50 bitblt Exp $ (jlv
+)
 
 #
 # This script will read either ASN.1-style MIB files or the ".defs" files
@@ -51,7 +49,7 @@ sed \
 	-e 's/--.*//' \
 	-e 's/\([{}]\)/ \1 /g' \
 	$@ \
-| awk '
+| gawk '
 BEGIN {
 	# for sanity, we prep the namespace with objects from RFC-1155
 	# (we manually establish the root)
diff --git a/usr.sbin/tcpdump/mib.h b/usr.sbin/tcpdump/mib.h
index 41e59de5a0b..48ead9b9691 100644
--- a/usr.sbin/tcpdump/mib.h
+++ b/usr.sbin/tcpdump/mib.h
@@ -1,4 +1,3 @@
-/*	$OpenBSD: mib.h,v 1.4 1996/07/13 11:01:12 mickey Exp $	*/
 /*
  * This file was generated by tcpdump/makemib on Wed Sep 26 12:12:31 EDT 1990
  * You probably don't want to edit this by hand!
diff --git a/usr.sbin/tcpdump/mkdep b/usr.sbin/tcpdump/mkdep
new file mode 100644
index 00000000000..2a9c221b1f1
--- /dev/null
+++ b/usr.sbin/tcpdump/mkdep
@@ -0,0 +1,109 @@
+#!/bin/sh -
+#
+# Copyright (c) 1994, 1996
+#	The Regents of the University of California.  All rights reserved.
+#
+# Redistribution and use in source and binary forms are permitted
+# provided that this notice is preserved and that due credit is given
+# to the University of California at Berkeley. The name of the University
+# may not be used to endorse or promote products derived from this
+# software without specific prior written permission. This software
+# is provided ``as is'' without express or implied warranty.
+#
+#	@(#)mkdep.sh	5.11 (Berkeley) 5/5/88
+#
+
+PATH=/bin:/usr/bin:/usr/ucb:/usr/local:/usr/local/bin
+export PATH
+
+MAKE=Makefile			# default makefile name is "Makefile"
+CC=cc				# default C compiler is "cc"
+
+while :
+	do case "$1" in
+		# -c allows you to specify the C compiler
+		-c)
+			CC=$2
+			shift; shift ;;
+
+		# -f allows you to select a makefile name
+		-f)
+			MAKE=$2
+			shift; shift ;;
+
+		# the -p flag produces "program: program.c" style dependencies
+		# so .o's don't get produced
+		-p)
+			SED='s;\.o;;'
+			shift ;;
+		*)
+			break ;;
+	esac
+done
+
+if [ $# = 0 ] ; then
+	echo 'usage: mkdep [-p] [-c cc] [-f makefile] [flags] file ...'
+	exit 1
+fi
+
+if [ ! -w $MAKE ]; then
+	echo "mkdep: no writeable file \"$MAKE\""
+	exit 1
+fi
+
+TMP=/tmp/mkdep$$
+
+trap 'rm -f $TMP ; exit 1' 1 2 3 13 15
+
+cp $MAKE ${MAKE}.bak
+
+sed -e '/DO NOT DELETE THIS LINE/,$d' < $MAKE > $TMP
+
+cat << _EOF_ >> $TMP
+# DO NOT DELETE THIS LINE -- mkdep uses it.
+# DO NOT PUT ANYTHING AFTER THIS LINE, IT WILL GO AWAY.
+
+_EOF_
+
+# If your compiler doesn't have -M, add it.  If you can't, the next two
+# lines will try and replace the "cc -M".  The real problem is that this
+# hack can't deal with anything that requires a search path, and doesn't
+# even try for anything using bracket (<>) syntax.
+#
+# egrep '^#include[ 	]*".*"' /dev/null $* |
+# sed -e 's/:[^"]*"\([^"]*\)".*/: \1/' -e 's/\.c/.o/' |
+
+# XXX this doesn't work with things like "-DDECLWAITSTATUS=union\ wait"
+$CC -M $* |
+sed "
+	s; \./; ;g
+	$SED" |
+awk '{
+	if ($1 != prev) {
+		if (rec != "")
+			print rec;
+		rec = $0;
+		prev = $1;
+	}
+	else {
+		if (length(rec $2) > 78) {
+			print rec;
+			rec = $0;
+		}
+		else
+			rec = rec " " $2
+	}
+}
+END {
+	print rec
+}' >> $TMP
+
+cat << _EOF_ >> $TMP
+
+# IF YOU PUT ANYTHING HERE IT WILL GO AWAY
+_EOF_
+
+# copy to preserve permissions
+cp $TMP $MAKE
+rm -f ${MAKE}.bak $TMP
+exit 0
diff --git a/usr.sbin/tcpdump/netbios.h b/usr.sbin/tcpdump/netbios.h
index 162e83c2c40..517cd414c82 100644
--- a/usr.sbin/tcpdump/netbios.h
+++ b/usr.sbin/tcpdump/netbios.h
@@ -1,30 +1,7 @@
-/*	$OpenBSD: netbios.h,v 1.1 1996/11/12 07:54:55 mickey Exp $	*/
-
-/*
- * Copyright (c) 1994, 1995, 1996
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that: (1) source code distributions
- * retain the above copyright notice and this paragraph in its entirety, (2)
- * distributions including binary code include the above copyright notice and
- * this paragraph in its entirety in the documentation or other materials
- * provided with the distribution, and (3) all advertising materials mentioning
- * features or use of this software display the following acknowledgement:
- * ``This product includes software developed by the University of California,
- * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
- * the University nor the names of its contributors may be used to endorse
- * or promote products derived from this software without specific prior
- * written permission.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
 /*
  * NETBIOS protocol formats
  *
- * @(#) Header: netbios.h,v 1.1 94/06/09 11:47:15 mccanne Exp
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/netbios.h,v 1.2 1996/12/12 16:22:49 bitblt Exp $
  */
 
 struct p8022Hdr {
diff --git a/usr.sbin/tcpdump/nfsfh.h b/usr.sbin/tcpdump/nfsfh.h
index 8f879d51ba8..598f815a297 100644
--- a/usr.sbin/tcpdump/nfsfh.h
+++ b/usr.sbin/tcpdump/nfsfh.h
@@ -1,7 +1,5 @@
-/*	$OpenBSD: nfsfh.h,v 1.4 1996/07/13 11:01:13 mickey Exp $	*/
-
 /*
- * Header: nfsfh.h,v 1.4 95/10/19 20:27:44 leres Exp
+ * $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/nfsfh.h,v 1.5 1996/12/12 16:22:48 bitblt Exp $
  *
  * nfsfh.h - NFS file handle definitions (for portable use)
  *
@@ -26,7 +24,7 @@ typedef struct {
  * our internal representation of that.
  */
 typedef	struct {
-	my_devt	fsid_dev;
+	my_devt	Fsid_dev;		/* XXX avoid name conflict with AIX */
 	u_int32_t fsid_code;
 } my_fsid;
 
diff --git a/usr.sbin/tcpdump/nfsv2.h b/usr.sbin/tcpdump/nfsv2.h
index 71cc7b646bf..b2c0ff9929e 100644
--- a/usr.sbin/tcpdump/nfsv2.h
+++ b/usr.sbin/tcpdump/nfsv2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1994, 1995
+ * Copyright (c) 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * This code is derived from software contributed to Berkeley by
@@ -131,7 +131,9 @@ extern int		vttoif_tab[];
 #define	nfstov_type(a)	ntov_type[fxdr_unsigned(u_int32_t,(a))&0x7]
 
 /* File types */
-typedef enum { NFNON=0, NFREG=1, NFDIR=2, NFBLK=3, NFCHR=4, NFLNK=5 } nfstype;
+typedef enum {
+    NFNON=0, NFREG=1, NFDIR=2, NFBLK=3, NFCHR=4, NFLNK=5
+} tcpdump_nfstype;
 
 /* Structs for common parts of the rpc's */
 struct nfsv2_time {
diff --git a/usr.sbin/tcpdump/ntp.h b/usr.sbin/tcpdump/ntp.h
index 2ef4564b7b9..0d667d568e4 100644
--- a/usr.sbin/tcpdump/ntp.h
+++ b/usr.sbin/tcpdump/ntp.h
@@ -1,6 +1,4 @@
-/*	$OpenBSD: ntp.h,v 1.4 1996/07/13 11:01:13 mickey Exp $	*/
-
-/* Header: ntp.h,v 1.3 95/05/04 17:52:49 mccanne Exp */
+/* $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/ntp.h,v 1.5 1996/12/12 16:22:47 bitblt Exp $ */
 
 /*
  * Based on ntp.h from the U of MD implementation
diff --git a/usr.sbin/tcpdump/os-solaris2.h b/usr.sbin/tcpdump/os-solaris2.h
new file mode 100644
index 00000000000..f5ac55b21b8
--- /dev/null
+++ b/usr.sbin/tcpdump/os-solaris2.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 1993, 1994, 1995, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/os-solaris2.h,v 1.1 1996/12/12 16:22:46 bitblt Exp $ (LBL)
+ */
+
+/* Prototypes missing in SunOS 5 */
+int	daemon(int, int);
+int	dn_expand(u_char *, u_char *, u_char *, u_char *, int);
+int	dn_skipname(u_char *, u_char *);
+int	flock(int, int);
+int	getdtablesize(void);
+int	gethostname(char *, int);
+int	getpagesize(void);
+char	*getusershell(void);
+char	*getwd(char *);
+int	iruserok(u_int, int, char *, char *);
+#ifdef __STDC__
+struct	utmp;
+void	login(struct utmp *);
+#endif
+int	logout(const char *);
+int	res_query(char *, int, int, u_char *, int);
+int	setenv(const char *, const char *, int);
+#if defined(_STDIO_H) && defined(HAVE_SETLINEBUF)
+int	setlinebuf(FILE *);
+#endif
+int	sigblock(int);
+int	sigsetmask(int);
+char    *strerror(int);
+int	snprintf(char *, size_t, const char *, ...);
+int	strcasecmp(const char *, const char *);
+void	unsetenv(const char *);
+#ifdef __STDC__
+struct	timeval;
+#endif
+int	utimes(const char *, struct timeval *);
diff --git a/usr.sbin/tcpdump/os-sunos4.h b/usr.sbin/tcpdump/os-sunos4.h
new file mode 100644
index 00000000000..8e730313657
--- /dev/null
+++ b/usr.sbin/tcpdump/os-sunos4.h
@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 1989, 1990, 1993, 1994, 1995, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/os-sunos4.h,v 1.1 1996/12/12 16:22:46 bitblt Exp $ (LBL)
+ */
+
+/* Prototypes missing in SunOS 4 */
+#ifdef FILE
+int	_filbuf(FILE *);
+int	_flsbuf(u_char, FILE *);
+int	fclose(FILE *);
+int	fflush(FILE *);
+int	fgetc(FILE *);
+int	fprintf(FILE *, const char *, ...);
+int	fputc(int, FILE *);
+int	fputs(const char *, FILE *);
+u_int	fread(void *, u_int, u_int, FILE *);
+int	fseek(FILE *, long, int);
+u_int	fwrite(const void *, u_int, u_int, FILE *);
+int	pclose(FILE *);
+void	rewind(FILE *);
+void	setbuf(FILE *, char *);
+int	setlinebuf(FILE *);
+int	ungetc(int, FILE *);
+int	vfprintf(FILE *, const char *, ...);
+int	vprintf(const char *, ...);
+#endif
+
+#if __GNUC__ <= 1
+int	read(int, char *, u_int);
+int	write(int, char *, u_int);
+#endif
+
+long	a64l(const char *);
+#ifdef __STDC__
+struct	sockaddr;
+#endif
+int	accept(int, struct sockaddr *, int *);
+int	bind(int, struct sockaddr *, int);
+int	bcmp(const void *, const void *, u_int);
+void	bcopy(const void *, void *, u_int);
+void	bzero(void *, int);
+int	chroot(const char *);
+int	close(int);
+void	closelog(void);
+int	connect(int, struct sockaddr *, int);
+char	*crypt(const char *, const char *);
+int	daemon(int, int);
+int	fchmod(int, int);
+int	fchown(int, int, int);
+void	endgrent(void);
+void	endpwent(void);
+void	endservent(void);
+#ifdef __STDC__
+struct	ether_addr;
+#endif
+struct	ether_addr *ether_aton(const char *);
+int	flock(int, int);
+#ifdef __STDC__
+struct	stat;
+#endif
+int	fstat(int, struct stat *);
+#ifdef __STDC__
+struct statfs;
+#endif
+int	fstatfs(int, struct statfs *);
+int	fsync(int);
+#ifdef __STDC__
+struct timeb;
+#endif
+int	ftime(struct timeb *);
+int	ftruncate(int, off_t);
+int	getdtablesize(void);
+long	gethostid(void);
+int	gethostname(char *, int);
+int	getopt(int, char * const *, const char *);
+int	getpagesize(void);
+char	*getpass(char *);
+int	getpeername(int, struct sockaddr *, int *);
+int	getpriority(int, int);
+#ifdef __STDC__
+struct	rlimit;
+#endif
+int	getrlimit(int, struct rlimit *);
+int	getsockname(int, struct sockaddr *, int *);
+int	getsockopt(int, int, int, char *, int *);
+#ifdef __STDC__
+struct	timeval;
+struct	timezone;
+#endif
+int	gettimeofday(struct timeval *, struct timezone *);
+char	*getusershell(void);
+char	*getwd(char *);
+int	initgroups(const char *, int);
+int	ioctl(int, int, caddr_t);
+int	iruserok(u_long, int, char *, char *);
+int	isatty(int);
+int	killpg(int, int);
+int	listen(int, int);
+#ifdef __STDC__
+struct	utmp;
+#endif
+void	login(struct utmp *);
+int	logout(const char *);
+off_t	lseek(int, off_t, int);
+int	lstat(const char *, struct stat *);
+int	mkstemp(char *);
+char	*mktemp(char *);
+int	munmap(caddr_t, int);
+void	openlog(const char *, int, int);
+void	perror(const char *);
+int	printf(const char *, ...);
+int	puts(const char *);
+long	random(void);
+int	readlink(const char *, char *, int);
+#ifdef __STDC__
+struct	iovec;
+#endif
+int	readv(int, struct iovec *, int);
+int	recv(int, char *, u_int, int);
+int	recvfrom(int, char *, u_int, int, struct sockaddr *, int *);
+int	rename(const char *, const char *);
+int	rcmd(char **, u_short, char *, char *, char *, int *);
+int	rresvport(int *);
+int	send(int, char *, u_int, int);
+int	sendto(int, char *, u_int, int, struct sockaddr *, int);
+int	setenv(const char *, const char *, int);
+int	seteuid(int);
+int	setpriority(int, int, int);
+int	select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+int	setpgrp(int, int);
+void	setpwent(void);
+int	setrlimit(int, struct rlimit *);
+void	setservent(int);
+int	setsockopt(int, int, int, char *, int);
+int	shutdown(int, int);
+int	sigblock(int);
+void	(*signal (int, void (*) (int))) (int);
+int	sigpause(int);
+int	sigsetmask(int);
+#ifdef __STDC__
+struct	sigvec;
+#endif
+int	sigvec(int, struct sigvec *, struct sigvec*);
+int	snprintf(char *, size_t, const char *, ...);
+int	socket(int, int, int);
+int	socketpair(int, int, int, int *);
+int	symlink(const char *, const char *);
+void	srandom(int);
+int	sscanf(char *, const char *, ...);
+int	stat(const char *, struct stat *);
+int	statfs(char *, struct statfs *);
+char	*strerror(int);
+int	strcasecmp(const char *, const char *);
+#ifdef __STDC__
+struct	tm;
+#endif
+int	strftime(char *, int, char *, struct tm *);
+int	strncasecmp(const char *, const char *, int);
+long	strtol(const char *, char **, int);
+void	sync(void);
+void	syslog(int, const char *, ...);
+int	system(const char *);
+long	tell(int);
+time_t	time(time_t *);
+char	*timezone(int, int);
+int	tolower(int);
+int	toupper(int);
+int	truncate(char *, off_t);
+void	unsetenv(const char *);
+int	vfork(void);
+int	vsprintf(char *, const char *, ...);
+int	writev(int, struct iovec *, int);
+#ifdef __STDC__
+struct	rusage;
+#endif
+int	utimes(const char *, struct timeval *);
+#if __GNUC__ <= 1
+int	wait(int *);
+pid_t	wait3(int *, int, struct rusage *);
+#endif
+
+/* Ugly signal hacking */
+#ifdef SIG_ERR
+#undef SIG_ERR
+#define SIG_ERR		(void (*)(int))-1
+#undef SIG_DFL
+#define SIG_DFL		(void (*)(int))0
+#undef SIG_IGN
+#define SIG_IGN		(void (*)(int))1
+
+#ifdef KERNEL
+#undef SIG_CATCH
+#define SIG_CATCH	(void (*)(int))2
+#endif
+#undef SIG_HOLD
+#define SIG_HOLD	(void (*)(int))3
+#endif
diff --git a/usr.sbin/tcpdump/os-ultrix4.h b/usr.sbin/tcpdump/os-ultrix4.h
new file mode 100644
index 00000000000..1c8a568d043
--- /dev/null
+++ b/usr.sbin/tcpdump/os-ultrix4.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 1990, 1993, 1994, 1995, 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/os-ultrix4.h,v 1.1 1996/12/12 16:22:45 bitblt Exp $ (LBL)
+ */
+
+/* Prototypes missing in Ultrix 4 */
+int	bcmp(const char *, const char *, u_int);
+void	bcopy(const void *, void *, u_int);
+void	bzero(void *, u_int);
+void	endservent(void);
+int	getopt(int, char * const *, const char *);
+#ifdef __STDC__
+struct timeval;
+struct timezone;
+#endif
+int	gettimeofday(struct timeval *, struct timezone *);
+int	ioctl(int, int, caddr_t);
+int	pfopen(char *, int);
+int	setlinebuf(FILE *);
+int	socket(int, int, int);
+int	strcasecmp(const char *, const char *);
diff --git a/usr.sbin/tcpdump/ospf.h b/usr.sbin/tcpdump/ospf.h
index 67419f3d793..c111a9047e9 100644
--- a/usr.sbin/tcpdump/ospf.h
+++ b/usr.sbin/tcpdump/ospf.h
@@ -1,5 +1,3 @@
-/*	$OpenBSD: ospf.h,v 1.4 1996/07/13 11:01:14 mickey Exp $	*/
-
 /*
  * Copyright (c) 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
diff --git a/usr.sbin/tcpdump/packetdat.awk b/usr.sbin/tcpdump/packetdat.awk
index 5fc12a1fd81..292e21910a6 100644
--- a/usr.sbin/tcpdump/packetdat.awk
+++ b/usr.sbin/tcpdump/packetdat.awk
@@ -1,6 +1,3 @@
-#	$OpenBSD: packetdat.awk,v 1.3 1996/06/10 07:47:27 deraadt Exp $
-#	$NetBSD: packetdat.awk,v 1.2 1995/03/06 19:10:59 mycroft Exp $
-
 BEGIN	{
 	# we need to know (usual) packet size to convert byte numbers
 	# to packet numbers
diff --git a/usr.sbin/tcpdump/parsenfsfh.c b/usr.sbin/tcpdump/parsenfsfh.c
index 08637b62688..5ecc37b5a08 100644
--- a/usr.sbin/tcpdump/parsenfsfh.c
+++ b/usr.sbin/tcpdump/parsenfsfh.c
@@ -1,9 +1,3 @@
-/*	$OpenBSD: parsenfsfh.c,v 1.4 1996/07/13 11:01:14 mickey Exp $	*/
-
-#ifndef lint
-static char *RCSid = "Header: parsenfsfh.c,v 1.9 95/10/19 20:27:44 leres Exp";
-#endif
-
 /*
  * parsenfsfh.c - portable parser for NFS file handles
  *			uses all sorts of heuristics
@@ -13,6 +7,11 @@ static char *RCSid = "Header: parsenfsfh.c,v 1.9 95/10/19 20:27:44 leres Exp";
  * Western Research Laboratory
  */
 
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/parsenfsfh.c,v 1.5 1996/12/12 16:22:44 bitblt Exp $ (LBL)";
+#endif
+
 #include <sys/types.h>
 #include <sys/time.h>
 
@@ -217,8 +216,8 @@ int ourself;		/* true if file handle was generated on this host */
 
 	switch (fhtype) {
 	case FHT_AUSPEX:
-	    fsidp->fsid_dev.Minor = fhp[7];
-	    fsidp->fsid_dev.Major = fhp[6];
+	    fsidp->Fsid_dev.Minor = fhp[7];
+	    fsidp->Fsid_dev.Major = fhp[6];
 	    fsidp->fsid_code = 0;
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -233,8 +232,8 @@ int ourself;		/* true if file handle was generated on this host */
 			/* XXX could ignore 3 high-order bytes */
 
 	    temp = make_uint32(fhp[3], fhp[2], fhp[1], fhp[0]);
-	    fsidp->fsid_dev.Minor = temp & 0xFFFFF;
-	    fsidp->fsid_dev.Major = (temp>>20) & 0xFFF;
+	    fsidp->Fsid_dev.Minor = temp & 0xFFFFF;
+	    fsidp->Fsid_dev.Major = (temp>>20) & 0xFFF;
 
 	    temp = make_uint32(fhp[15], fhp[14], fhp[13], fhp[12]);
 	    *inop = temp;
@@ -243,8 +242,8 @@ int ourself;		/* true if file handle was generated on this host */
 	    break;
 
 	case FHT_IRIX4:
-	    fsidp->fsid_dev.Minor = fhp[3];
-	    fsidp->fsid_dev.Major = fhp[2];
+	    fsidp->Fsid_dev.Minor = fhp[3];
+	    fsidp->Fsid_dev.Major = fhp[2];
 	    fsidp->fsid_code = 0;
 
 	    temp = make_uint32(fhp[8], fhp[9], fhp[10], fhp[11]);
@@ -255,8 +254,8 @@ int ourself;		/* true if file handle was generated on this host */
 	    break;
 
 	case FHT_IRIX5:
-	    fsidp->fsid_dev.Minor = make_uint16(fhp[2], fhp[3]);
-	    fsidp->fsid_dev.Major = make_uint16(fhp[0], fhp[1]);
+	    fsidp->Fsid_dev.Minor = make_uint16(fhp[2], fhp[3]);
+	    fsidp->Fsid_dev.Major = make_uint16(fhp[0], fhp[1]);
 	    fsidp->fsid_code = make_uint32(fhp[4], fhp[5], fhp[6], fhp[7]);
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -272,8 +271,8 @@ int ourself;		/* true if file handle was generated on this host */
 	    break;
 
 	case FHT_SUNOS4:
-	    fsidp->fsid_dev.Minor = fhp[3];
-	    fsidp->fsid_dev.Major = fhp[2];
+	    fsidp->Fsid_dev.Minor = fhp[3];
+	    fsidp->Fsid_dev.Major = fhp[2];
 	    fsidp->fsid_code = make_uint32(fhp[4], fhp[5], fhp[6], fhp[7]);
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -285,9 +284,9 @@ int ourself;		/* true if file handle was generated on this host */
 
 	case FHT_SUNOS5:
 	    temp = make_uint16(fhp[0], fhp[1]);
-	    fsidp->fsid_dev.Major = (temp>>2) &  0x3FFF;
+	    fsidp->Fsid_dev.Major = (temp>>2) &  0x3FFF;
 	    temp = make_uint24(fhp[1], fhp[2], fhp[3]);
-	    fsidp->fsid_dev.Minor = temp & 0x3FFFF;
+	    fsidp->Fsid_dev.Minor = temp & 0x3FFFF;
 	    fsidp->fsid_code = make_uint32(fhp[4], fhp[5], fhp[6], fhp[7]);
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -299,8 +298,8 @@ int ourself;		/* true if file handle was generated on this host */
 
 	case FHT_ULTRIX:
 	    fsidp->fsid_code = 0;
-	    fsidp->fsid_dev.Minor = fhp[0];
-	    fsidp->fsid_dev.Major = fhp[1];
+	    fsidp->Fsid_dev.Minor = fhp[0];
+	    fsidp->Fsid_dev.Major = fhp[1];
 
 	    temp = make_uint32(fhp[7], fhp[6], fhp[5], fhp[4]);
 	    *inop = temp;
@@ -320,8 +319,8 @@ int ourself;		/* true if file handle was generated on this host */
 
 		memset((char *)tempa, 0, sizeof(tempa));
 		memcpy((char *)tempa, fh, 14);	/* ensure alignment */
-		fsidp->fsid_dev.Minor = tempa[0] + (tempa[1]<<1);
-		fsidp->fsid_dev.Major = tempa[2] + (tempa[3]<<1);
+		fsidp->Fsid_dev.Minor = tempa[0] + (tempa[1]<<1);
+		fsidp->Fsid_dev.Major = tempa[2] + (tempa[3]<<1);
 		fsidp->fsid_code = 0;
 	    }
 
@@ -337,8 +336,8 @@ int ourself;		/* true if file handle was generated on this host */
 	    break;
 
 	case FHT_AIX32:
-	    fsidp->fsid_dev.Minor = make_uint16(fhp[2], fhp[3]);
-	    fsidp->fsid_dev.Major = make_uint16(fhp[0], fhp[1]);
+	    fsidp->Fsid_dev.Minor = make_uint16(fhp[2], fhp[3]);
+	    fsidp->Fsid_dev.Major = make_uint16(fhp[0], fhp[1]);
 	    fsidp->fsid_code = make_uint32(fhp[4], fhp[5], fhp[6], fhp[7]);
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -349,9 +348,9 @@ int ourself;		/* true if file handle was generated on this host */
 	    break;
 
 	case FHT_HPUX9:
-	    fsidp->fsid_dev.Major = fhp[0];
+	    fsidp->Fsid_dev.Major = fhp[0];
 	    temp = make_uint24(fhp[1], fhp[2], fhp[3]);
-	    fsidp->fsid_dev.Minor = temp;
+	    fsidp->Fsid_dev.Minor = temp;
 	    fsidp->fsid_code = make_uint32(fhp[4], fhp[5], fhp[6], fhp[7]);
 
 	    temp = make_uint32(fhp[12], fhp[13], fhp[14], fhp[15]);
@@ -373,8 +372,8 @@ int ourself;		/* true if file handle was generated on this host */
 #endif
 	    /* XXX for now, give "bogus" values to aid debugging */
 	    fsidp->fsid_code = 0;
-	    fsidp->fsid_dev.Minor = 257;
-	    fsidp->fsid_dev.Major = 257;
+	    fsidp->Fsid_dev.Minor = 257;
+	    fsidp->Fsid_dev.Major = 257;
 	    *inop = 1;
 
 	    /* display will show this string instead of (257,257) */
diff --git a/usr.sbin/tcpdump/print-arp.c b/usr.sbin/tcpdump/print-arp.c
index ce70238085f..677e59de0c3 100644
--- a/usr.sbin/tcpdump/print-arp.c
+++ b/usr.sbin/tcpdump/print-arp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-arp.c,v 1.4 1996/07/13 11:01:15 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-arp.c,v 1.35 96/06/20 21:07:34 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-arp.c,v 1.5 1996/12/12 16:22:43 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
@@ -44,16 +42,21 @@ struct rtentry;
 
 #include "interface.h"
 #include "addrtoname.h"
+#include "ethertype.h"
 #include "extract.h"			/* must come after interface.h */
 
-#ifndef ETHERTYPE_TRAIL
-#define ETHERTYPE_TRAIL 0x1000
+/* Compatibility */
+#ifndef REVARP_REQUEST
+#define REVARP_REQUEST		3
+#endif
+#ifndef REVARP_REPLY
+#define REVARP_REPLY		4
 #endif
 
 static u_char ezero[6];
 
 void
-arp_print(register const u_char *bp, int length, int caplen)
+arp_print(register const u_char *bp, u_int length, u_int caplen)
 {
 	register const struct ether_arp *ap;
 	register const struct ether_header *eh;
@@ -70,9 +73,9 @@ arp_print(register const u_char *bp, int length, int caplen)
 		return;
 	}
 
-	pro = EXTRACT_SHORT(&ap->arp_pro);
-	hrd = EXTRACT_SHORT(&ap->arp_hrd);
-	op = EXTRACT_SHORT(&ap->arp_op);
+	pro = EXTRACT_16BITS(&ap->arp_pro);
+	hrd = EXTRACT_16BITS(&ap->arp_hrd);
+	op = EXTRACT_16BITS(&ap->arp_op);
 
 	if ((pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL)
 	    || ap->arp_hln != sizeof(SHA(ap))
@@ -123,5 +126,5 @@ arp_print(register const u_char *bp, int length, int caplen)
 		return;
 	}
 	if (hrd != ARPHRD_ETHER)
-		printf(" hardware #%d", ap->arp_hrd);
+		printf(" hardware #%d", hrd);
 }
diff --git a/usr.sbin/tcpdump/print-atalk.c b/usr.sbin/tcpdump/print-atalk.c
index 3f096fc6e82..9a85411da87 100644
--- a/usr.sbin/tcpdump/print-atalk.c
+++ b/usr.sbin/tcpdump/print-atalk.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-atalk.c,v 1.4 1996/07/13 11:01:15 mickey Exp $	*/
-
 /*
- * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995
+ * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,14 +20,14 @@
  *
  * Format and print AppleTalk packets.
  */
+
 #ifndef lint
-static  char rcsid[] =
-	"@(#)Header: print-atalk.c,v 1.40 95/10/07 22:13:43 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-atalk.c,v 1.5 1996/12/12 16:22:43 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -80,9 +78,9 @@ struct aarp {
 
 static char tstr[] = "[|atalk]";
 
-static void atp_print(const struct atATP *, int);
+static void atp_print(const struct atATP *, u_int);
 static void atp_bitmap_print(u_char);
-static void nbp_print(const struct atNBP *, int, u_short, u_char, u_char);
+static void nbp_print(const struct atNBP *, u_int, u_short, u_char, u_char);
 static const char *print_cstring(const char *, const u_char *);
 static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *,
 						const u_char *,
@@ -90,14 +88,14 @@ static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *,
 static const struct atNBPtuple *nbp_name_print(const struct atNBPtuple *,
 					       const u_char *);
 static const char *ataddr_string(u_short, u_char);
-static void ddp_print(const u_char *, int, int, u_short, u_char, u_char);
+static void ddp_print(const u_char *, u_int, int, u_short, u_char, u_char);
 static const char *ddpskt_string(int);
 
 /*
  * Print AppleTalk Datagram Delivery Protocol packets.
  */
 void
-atalk_print(register const u_char *bp, int length)
+atalk_print(register const u_char *bp, u_int length)
 {
 	register const struct LAP *lp;
 	register const struct atDDP *dp;
@@ -130,11 +128,11 @@ atalk_print(register const u_char *bp, int length)
 			return;
 		}
 		dp = (const struct atDDP *)bp;
-		snet = EXTRACT_SHORT(&dp->srcNet);
+		snet = EXTRACT_16BITS(&dp->srcNet);
 		printf("%s.%s", ataddr_string(snet, dp->srcNode),
 		    ddpskt_string(dp->srcSkt));
 		printf(" > %s.%s:",
-		    ataddr_string(EXTRACT_SHORT(&dp->dstNet), dp->dstNode),
+		    ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
 		    ddpskt_string(dp->dstSkt));
 		bp += ddpSize;
 		length -= ddpSize;
@@ -156,7 +154,7 @@ atalk_print(register const u_char *bp, int length)
 
 /* XXX should probably pass in the snap header and do checks like arp_print() */
 void
-aarp_print(register const u_char *bp, int length)
+aarp_print(register const u_char *bp, u_int length)
 {
 	register const struct aarp *ap;
 
@@ -188,7 +186,7 @@ aarp_print(register const u_char *bp, int length)
 }
 
 static void
-ddp_print(register const u_char *bp, register int length, register int t,
+ddp_print(register const u_char *bp, register u_int length, register int t,
 	  register u_short snet, register u_char snode, u_char skt)
 {
 
@@ -209,7 +207,7 @@ ddp_print(register const u_char *bp, register int length, register int t,
 }
 
 static void
-atp_print(register const struct atATP *ap, int length)
+atp_print(register const struct atATP *ap, u_int length)
 {
 	char c;
 	u_int32_t data;
@@ -225,7 +223,7 @@ atp_print(register const struct atATP *ap, int length)
 	case atpReqCode:
 		(void)printf(" atp-req%s %d",
 			     ap->control & atpXO? " " : "*",
-			     EXTRACT_SHORT(&ap->transID));
+			     EXTRACT_16BITS(&ap->transID));
 
 		atp_bitmap_print(ap->bitmap);
 
@@ -248,7 +246,7 @@ atp_print(register const struct atATP *ap, int length)
 	case atpRspCode:
 		(void)printf(" atp-resp%s%d:%d (%d)",
 			     ap->control & atpEOM? "*" : " ",
-			     EXTRACT_SHORT(&ap->transID), ap->bitmap, length);
+			     EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
 		switch (ap->control & (atpXO|atpSTS)) {
 		case atpXO:
 			(void)printf(" [XO]");
@@ -263,7 +261,7 @@ atp_print(register const struct atATP *ap, int length)
 		break;
 
 	case atpRelCode:
-		(void)printf(" atp-rel  %d", EXTRACT_SHORT(&ap->transID));
+		(void)printf(" atp-rel  %d", EXTRACT_16BITS(&ap->transID));
 
 		atp_bitmap_print(ap->bitmap);
 
@@ -292,10 +290,10 @@ atp_print(register const struct atATP *ap, int length)
 
 	default:
 		(void)printf(" atp-0x%x  %d (%d)", ap->control,
-			     EXTRACT_SHORT(&ap->transID), length);
+			     EXTRACT_16BITS(&ap->transID), length);
 		break;
 	}
-	data = EXTRACT_LONG(&ap->userData);
+	data = EXTRACT_32BITS(&ap->userData);
 	if (data != 0)
 		(void)printf(" 0x%x", data);
 }
@@ -332,12 +330,12 @@ atp_bitmap_print(register u_char bm)
 }
 
 static void
-nbp_print(register const struct atNBP *np, int length, register u_short snet,
+nbp_print(register const struct atNBP *np, u_int length, register u_short snet,
 	  register u_char snode, register u_char skt)
 {
 	register const struct atNBPtuple *tp =
 			(struct atNBPtuple *)((u_char *)np + nbpHeaderSize);
-	int i = length;
+	int i;
 	const u_char *ep;
 
 	length -= nbpHeaderSize;
@@ -372,10 +370,10 @@ nbp_print(register const struct atNBP *np, int length, register u_short snet,
 			(void)printf(" [ntup=%d]", np->control & 0xf);
 		if (tp->enumerator)
 			(void)printf(" [enum=%d]", tp->enumerator);
-		if (EXTRACT_SHORT(&tp->net) != snet ||
+		if (EXTRACT_16BITS(&tp->net) != snet ||
 		    tp->node != snode || tp->skt != skt)
 			(void)printf(" [addr=%s.%d]",
-			    ataddr_string(EXTRACT_SHORT(&tp->net),
+			    ataddr_string(EXTRACT_16BITS(&tp->net),
 			    tp->node), tp->skt);
 		break;
 
@@ -398,7 +396,7 @@ nbp_print(register const struct atNBP *np, int length, register u_short snet,
 static const char *
 print_cstring(register const char *cp, register const u_char *ep)
 {
-	register int length;
+	register u_int length;
 
 	if (cp >= (const char *)ep) {
 		fputs(tstr, stdout);
@@ -444,9 +442,9 @@ nbp_tuple_print(register const struct atNBPtuple *tp,
 		(void)printf(" %d", tp->skt);
 
 	/* if the address doesn't match the src address, it's an anomaly */
-	if (EXTRACT_SHORT(&tp->net) != snet || tp->node != snode)
+	if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode)
 		(void)printf(" [addr=%s]",
-		    ataddr_string(EXTRACT_SHORT(&tp->net), tp->node));
+		    ataddr_string(EXTRACT_16BITS(&tp->net), tp->node));
 
 	return (tpn);
 }
diff --git a/usr.sbin/tcpdump/print-atm.c b/usr.sbin/tcpdump/print-atm.c
index 65e35c81224..4d4f94f9365 100644
--- a/usr.sbin/tcpdump/print-atm.c
+++ b/usr.sbin/tcpdump/print-atm.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-atm.c,v 1.1 1996/07/13 11:01:15 mickey Exp $	*/
-
 /*
- * Copyright (c) 1994, 1995
+ * Copyright (c) 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -21,13 +19,12 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-atm.c,v 1.4 95/10/07 22:13:49 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-atm.c,v 1.2 1996/12/12 16:22:42 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -49,8 +46,9 @@ struct rtentry;
 #include <stdio.h>
 #include <pcap.h>
 
-#include "interface.h"
 #include "addrtoname.h"
+#include "ethertype.h"
+#include "interface.h"
 
 /*
  * This is the top level routine of the printer.  'p' is the points
@@ -61,8 +59,8 @@ struct rtentry;
 void
 atm_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 {
-	int caplen = h->caplen;
-	int length = h->len;
+	u_int caplen = h->caplen;
+	u_int length = h->len;
 	u_short ethertype;
 
 	ts_print(&h->ts);
diff --git a/usr.sbin/tcpdump/print-bootp.c b/usr.sbin/tcpdump/print-bootp.c
index 3deff920d10..f983089d7be 100644
--- a/usr.sbin/tcpdump/print-bootp.c
+++ b/usr.sbin/tcpdump/print-bootp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-bootp.c,v 1.4 1996/07/13 11:01:16 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -23,13 +21,12 @@
  * Format and print bootp packets.
  */
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-bootp.c,v 1.38 96/06/23 02:11:45 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-bootp.c,v 1.5 1996/12/12 16:22:41 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -49,8 +46,8 @@ struct rtentry;
 #include "addrtoname.h"
 #include "bootp.h"
 
-static void rfc1048_print(const u_char *, int);
-static void cmu_print(const u_char *, int);
+static void rfc1048_print(const u_char *, u_int);
+static void cmu_print(const u_char *, u_int);
 
 static char tstr[] = " [|bootp]";
 
@@ -58,21 +55,15 @@ static char tstr[] = " [|bootp]";
  * Print bootp requests
  */
 void
-bootp_print(register const u_char *cp, int length,
+bootp_print(register const u_char *cp, u_int length,
 	    u_short sport, u_short dport)
 {
 	register const struct bootp *bp;
 	static u_char vm_cmu[4] = VM_CMU;
 	static u_char vm_rfc1048[4] = VM_RFC1048;
-	const u_char *ep;
-
-#define TCHECK(var, l) if ((u_char *)&(var) > ep - l) goto trunc
 
 	bp = (struct bootp *)cp;
-	/* 'ep' points to the end of available data. */
-	ep = snapend;
-
-	TCHECK(bp->bp_op, sizeof(bp->bp_op));
+	TCHECK(bp->bp_op);
 	switch (bp->bp_op) {
 
 	case BOOTREQUEST:
@@ -91,7 +82,7 @@ bootp_print(register const u_char *cp, int length,
 		printf(" bootp-#%d", bp->bp_op);
 	}
 
-	TCHECK(bp->bp_secs, sizeof(bp->bp_secs));
+	TCHECK(bp->bp_secs);
 
 	/* The usual hardware address type is 1 (10Mb Ethernet) */
 	if (bp->bp_htype != 1)
@@ -110,22 +101,22 @@ bootp_print(register const u_char *cp, int length,
 		printf(" secs:%d", ntohs(bp->bp_secs));
 
 	/* Client's ip address */
-	TCHECK(bp->bp_ciaddr, sizeof(bp->bp_ciaddr));
+	TCHECK(bp->bp_ciaddr);
 	if (bp->bp_ciaddr.s_addr)
 		printf(" C:%s", ipaddr_string(&bp->bp_ciaddr));
 
 	/* 'your' ip address (bootp client) */
-	TCHECK(bp->bp_yiaddr, sizeof(bp->bp_yiaddr));
+	TCHECK(bp->bp_yiaddr);
 	if (bp->bp_yiaddr.s_addr)
 		printf(" Y:%s", ipaddr_string(&bp->bp_yiaddr));
 
 	/* Server's ip address */
-	TCHECK(bp->bp_siaddr, sizeof(bp->bp_siaddr));
+	TCHECK(bp->bp_siaddr);
 	if (bp->bp_siaddr.s_addr)
 		printf(" S:%s", ipaddr_string(&bp->bp_siaddr));
 
 	/* Gateway's ip address */
-	TCHECK(bp->bp_giaddr, sizeof(bp->bp_giaddr));
+	TCHECK(bp->bp_giaddr);
 	if (bp->bp_giaddr.s_addr)
 		printf(" G:%s", ipaddr_string(&bp->bp_giaddr));
 
@@ -134,7 +125,7 @@ bootp_print(register const u_char *cp, int length,
 		register const struct ether_header *eh;
 		register const char *e;
 
-		TCHECK(bp->bp_chaddr[0], 6);
+		TCHECK2(bp->bp_chaddr[0], 6);
 		eh = (struct ether_header *)packetp;
 		if (bp->bp_op == BOOTREQUEST)
 			e = (const char *)ESRC(eh);
@@ -146,25 +137,27 @@ bootp_print(register const u_char *cp, int length,
 			printf(" ether %s", etheraddr_string(bp->bp_chaddr));
 	}
 
-	TCHECK(bp->bp_sname[0], 1);		/* check first char only */
+	TCHECK2(bp->bp_sname[0], 1);		/* check first char only */
 	if (*bp->bp_sname) {
-		printf(" sname ");
-		if (fn_print(bp->bp_sname, ep)) {
+		printf(" sname \"");
+		if (fn_print(bp->bp_sname, snapend)) {
+			putchar('"');
 			fputs(tstr + 1, stdout);
 			return;
 		}
 	}
-	TCHECK(bp->bp_sname[0], 1);		/* check first char only */
+	TCHECK2(bp->bp_sname[0], 1);		/* check first char only */
 	if (*bp->bp_file) {
-		printf(" file ");
-		if (fn_print(bp->bp_file, ep)) {
+		printf(" file \"");
+		if (fn_print(bp->bp_file, snapend)) {
+			putchar('"');
 			fputs(tstr + 1, stdout);
 			return;
 		}
 	}
 
 	/* Decode the vendor buffer */
-	TCHECK(bp->bp_vend[0], sizeof(bp->bp_vend));
+	TCHECK(bp->bp_vend[0]);
 	length -= sizeof(*bp) - sizeof(bp->bp_vend);
 	if (memcmp((char *)bp->bp_vend, (char *)vm_rfc1048,
 		 sizeof(u_int32_t)) == 0)
@@ -183,7 +176,6 @@ bootp_print(register const u_char *cp, int length,
 	return;
 trunc:
 	fputs(tstr, stdout);
-#undef TCHECK
 }
 
 /* The first character specifies the format to print */
@@ -214,10 +206,9 @@ static struct tok tag2str[] = {
 };
 
 static void
-rfc1048_print(register const u_char *bp, register int length)
+rfc1048_print(register const u_char *bp, register u_int length)
 {
 	register u_char tag;
-	register const u_char *ep;
 	register u_int len, size;
 	register const char *cp;
 	register char c;
@@ -227,14 +218,11 @@ rfc1048_print(register const u_char *bp, register int length)
 
 	printf(" vend-rfc1048");
 
-	/* Setup end pointer */
-	ep = bp + length;
-
 	/* Step over magic cookie */
 	bp += sizeof(int32_t);
 
 	/* Loop while we there is a tag left in the buffer */
-	while (bp + 1 < ep) {
+	while (bp + 1 < snapend) {
 		tag = *bp++;
 		if (tag == TAG_PAD)
 			continue;
@@ -245,12 +233,12 @@ rfc1048_print(register const u_char *bp, register int length)
 		printf(" %s:", cp);
 
 		/* Get the length; check for truncation */
-		if (bp + 1 >= ep) {
+		if (bp + 1 >= snapend) {
 			fputs(tstr, stdout);
 			return;
 		}
 		len = *bp++;
-		if (bp + len >= ep) {
+		if (bp + len >= snapend) {
 			fputs(tstr, stdout);
 			return;
 		}
@@ -271,7 +259,9 @@ rfc1048_print(register const u_char *bp, register int length)
 
 		case 'a':
 			/* ascii strings */
+			putchar('"');
 			(void)fn_printn(bp, size, NULL);
+			putchar('"');
 			bp += size;
 			size = 0;
 			break;
@@ -326,25 +316,20 @@ rfc1048_print(register const u_char *bp, register int length)
 }
 
 static void
-cmu_print(register const u_char *bp, register int length)
+cmu_print(register const u_char *bp, register u_int length)
 {
 	register const struct cmu_vend *cmu;
-	register const u_char *ep;
 	char *fmt = " %s:%s";
 
-#define TCHECK(var, l) if ((u_char *)&(var) > ep - l) goto trunc
-#define PRINTCMUADDR(m, s) { TCHECK(cmu->m, sizeof(cmu->m)); \
+#define PRINTCMUADDR(m, s) { TCHECK(cmu->m); \
     if (cmu->m.s_addr != 0) \
 	printf(fmt, s, ipaddr_string(&cmu->m.s_addr)); }
 
-	/* Setup end pointer */
-	ep = bp + length;
-
 	printf(" vend-cmu");
 	cmu = (struct cmu_vend *)bp;
 
 	/* Only print if there are unknown bits */
-	TCHECK(cmu->v_flags, sizeof(cmu->v_flags));
+	TCHECK(cmu->v_flags);
 	if ((cmu->v_flags & ~(VF_SMASK)) != 0)
 		printf(" F:0x%x", cmu->v_flags);
 	PRINTCMUADDR(v_dgate, "DG");
@@ -359,6 +344,5 @@ cmu_print(register const u_char *bp, register int length)
 
 trunc:
 	fputs(tstr, stdout);
-#undef TCHECK
 #undef PRINTCMUADDR
 }
diff --git a/usr.sbin/tcpdump/print-decnet.c b/usr.sbin/tcpdump/print-decnet.c
index cb05cace8e3..f9408fe02f9 100644
--- a/usr.sbin/tcpdump/print-decnet.c
+++ b/usr.sbin/tcpdump/print-decnet.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-decnet.c,v 1.4 1996/07/13 11:01:17 mickey Exp $	*/
-
 /*
- * Copyright (c) 1992, 1993, 1994, 1995
+ * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,11 +20,11 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-decnet.c,v 1.19 95/10/07 22:15:12 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-decnet.c,v 1.5 1996/12/12 16:22:41 bitblt Exp $ (LBL)";
 #endif
 
-#include <sys/types.h>
+#include <sys/param.h>
 #include <sys/time.h>
 #include <sys/socket.h>
 
@@ -47,17 +45,18 @@ struct rtentry;
 #include <unistd.h>
 
 #include "decnet.h"
+#include "extract.h"
 #include "interface.h"
 #include "addrtoname.h"
 
 /* Forwards */
-static void print_decnet_ctlmsg(const union routehdr *, int);
+static void print_decnet_ctlmsg(const union routehdr *, u_int);
 static void print_t_info(int);
-static void print_l1_routes(const char *, int);
-static void print_l2_routes(const char *, int);
+static void print_l1_routes(const char *, u_int);
+static void print_l2_routes(const char *, u_int);
 static void print_i_info(int);
-static void print_elist(const char *, int);
-static void print_nsp(const u_char *, int);
+static void print_elist(const char *, u_int);
+static void print_nsp(const u_char *, u_int);
 static void print_reason(int);
 #ifdef	PRINT_NSPDATA
 static void pdata(u_char *, int);
@@ -68,34 +67,32 @@ extern char *dnet_htoa(struct dn_naddr *);
 #endif
 
 void
-decnet_print(register const u_char *ap, register int length,
-	     register int caplen)
+decnet_print(register const u_char *ap, register u_int length,
+	     register u_int caplen)
 {
 	static union routehdr rhcopy;
 	register union routehdr *rhp = &rhcopy;
 	register int mflags;
 	int dst, src, hops;
-	int rhlen;
+	u_int rhlen, nsplen, pktlen;
 	const u_char *nspp;
-	int nsplen;
-	int pktlen;
 
 	if (length < sizeof(struct shorthdr)) {
 		(void)printf("[|decnet]");
 		return;
 	}
 
-	pktlen = EXTRACT_16BITS(ap);
+	pktlen = EXTRACT_LE_16BITS(ap);
 
 	rhlen = min(length, caplen);
 	rhlen = min(rhlen, sizeof(*rhp));
 	memcpy((char *)rhp, (char *)&(ap[sizeof(short)]), rhlen);
 
-	mflags = EXTRACT_8BITS(rhp->rh_short.sh_flags);
+	mflags = EXTRACT_LE_8BITS(rhp->rh_short.sh_flags);
 
 	if (mflags & RMF_PAD) {
 	    /* pad bytes of some sort in front of message */
-	    int padlen = mflags & RMF_PADMASK;
+	    u_int padlen = mflags & RMF_PADMASK;
 	    if (vflag)
 		(void) printf("[pad:%d] ", padlen);
 	    ap += padlen;
@@ -104,7 +101,7 @@ decnet_print(register const u_char *ap, register int length,
 	    rhlen = min(length, caplen);
 	    rhlen = min(rhlen, sizeof(*rhp));
 	    memcpy((char *)rhp, (char *)&(ap[sizeof(short)]), rhlen);
-	    mflags = EXTRACT_8BITS(rhp->rh_short.sh_flags);
+	    mflags = EXTRACT_LE_8BITS(rhp->rh_short.sh_flags);
 	}
 
 	if (mflags & RMF_FVER) {
@@ -121,17 +118,19 @@ decnet_print(register const u_char *ap, register int length,
 
 	switch (mflags & RMF_MASK) {
 	case RMF_LONG:
-	    dst = EXTRACT_16BITS(rhp->rh_long.lg_dst.dne_remote.dne_nodeaddr);
-	    src = EXTRACT_16BITS(rhp->rh_long.lg_src.dne_remote.dne_nodeaddr);
-	    hops = EXTRACT_8BITS(rhp->rh_long.lg_visits);
+	    dst =
+		EXTRACT_LE_16BITS(rhp->rh_long.lg_dst.dne_remote.dne_nodeaddr);
+	    src =
+		EXTRACT_LE_16BITS(rhp->rh_long.lg_src.dne_remote.dne_nodeaddr);
+	    hops = EXTRACT_LE_8BITS(rhp->rh_long.lg_visits);
 	    nspp = &(ap[sizeof(short) + sizeof(struct longhdr)]);
 	    nsplen = min((length - sizeof(struct longhdr)),
 			 (caplen - sizeof(struct longhdr)));
 	    break;
 	case RMF_SHORT:
-	    dst = EXTRACT_16BITS(rhp->rh_short.sh_dst);
-	    src = EXTRACT_16BITS(rhp->rh_short.sh_src);
-	    hops = (EXTRACT_8BITS(rhp->rh_short.sh_visits) & VIS_MASK)+1;
+	    dst = EXTRACT_LE_16BITS(rhp->rh_short.sh_dst);
+	    src = EXTRACT_LE_16BITS(rhp->rh_short.sh_src);
+	    hops = (EXTRACT_LE_8BITS(rhp->rh_short.sh_visits) & VIS_MASK)+1;
 	    nspp = &(ap[sizeof(short) + sizeof(struct shorthdr)]);
 	    nsplen = min((length - sizeof(struct shorthdr)),
 			 (caplen - sizeof(struct shorthdr)));
@@ -158,9 +157,9 @@ decnet_print(register const u_char *ap, register int length,
 }
 
 static void
-print_decnet_ctlmsg(register const union routehdr *rhp, int length)
+print_decnet_ctlmsg(register const union routehdr *rhp, u_int length)
 {
-	int mflags = EXTRACT_8BITS(rhp->rh_short.sh_flags);
+	int mflags = EXTRACT_LE_8BITS(rhp->rh_short.sh_flags);
 	register union controlmsg *cmp = (union controlmsg *)rhp;
 	int src, dst, info, blksize, eco, ueco, hello, other, vers;
 	etheraddr srcea, rtea;
@@ -170,13 +169,13 @@ print_decnet_ctlmsg(register const union routehdr *rhp, int length)
 	switch (mflags & RMF_CTLMASK) {
 	case RMF_INIT:
 	    (void)printf("init ");
-	    src = EXTRACT_16BITS(cmp->cm_init.in_src);
-	    info = EXTRACT_8BITS(cmp->cm_init.in_info);
-	    blksize = EXTRACT_16BITS(cmp->cm_init.in_blksize);
-	    vers = EXTRACT_8BITS(cmp->cm_init.in_vers);
-	    eco = EXTRACT_8BITS(cmp->cm_init.in_eco);
-	    ueco = EXTRACT_8BITS(cmp->cm_init.in_ueco);
-	    hello = EXTRACT_16BITS(cmp->cm_init.in_hello);
+	    src = EXTRACT_LE_16BITS(cmp->cm_init.in_src);
+	    info = EXTRACT_LE_8BITS(cmp->cm_init.in_info);
+	    blksize = EXTRACT_LE_16BITS(cmp->cm_init.in_blksize);
+	    vers = EXTRACT_LE_8BITS(cmp->cm_init.in_vers);
+	    eco = EXTRACT_LE_8BITS(cmp->cm_init.in_eco);
+	    ueco = EXTRACT_LE_8BITS(cmp->cm_init.in_ueco);
+	    hello = EXTRACT_LE_16BITS(cmp->cm_init.in_hello);
 	    print_t_info(info);
 	    (void)printf(
 		"src %sblksize %d vers %d eco %d ueco %d hello %d",
@@ -185,42 +184,42 @@ print_decnet_ctlmsg(register const union routehdr *rhp, int length)
 	    break;
 	case RMF_VER:
 	    (void)printf("verification ");
-	    src = EXTRACT_16BITS(cmp->cm_ver.ve_src);
-	    other = EXTRACT_8BITS(cmp->cm_ver.ve_fcnval);
+	    src = EXTRACT_LE_16BITS(cmp->cm_ver.ve_src);
+	    other = EXTRACT_LE_8BITS(cmp->cm_ver.ve_fcnval);
 	    (void)printf("src %s fcnval %o", dnaddr_string(src), other);
 	    break;
 	case RMF_TEST:
 	    (void)printf("test ");
-	    src = EXTRACT_16BITS(cmp->cm_test.te_src);
-	    other = EXTRACT_8BITS(cmp->cm_test.te_data);
+	    src = EXTRACT_LE_16BITS(cmp->cm_test.te_src);
+	    other = EXTRACT_LE_8BITS(cmp->cm_test.te_data);
 	    (void)printf("src %s data %o", dnaddr_string(src), other);
 	    break;
 	case RMF_L1ROUT:
 	    (void)printf("lev-1-routing ");
-	    src = EXTRACT_16BITS(cmp->cm_l1rou.r1_src);
+	    src = EXTRACT_LE_16BITS(cmp->cm_l1rou.r1_src);
 	    (void)printf("src %s ", dnaddr_string(src));
 	    print_l1_routes(&(rhpx[sizeof(struct l1rout)]),
 				length - sizeof(struct l1rout));
 	    break;
 	case RMF_L2ROUT:
 	    (void)printf("lev-2-routing ");
-	    src = EXTRACT_16BITS(cmp->cm_l2rout.r2_src);
+	    src = EXTRACT_LE_16BITS(cmp->cm_l2rout.r2_src);
 	    (void)printf("src %s ", dnaddr_string(src));
 	    print_l2_routes(&(rhpx[sizeof(struct l2rout)]),
 				length - sizeof(struct l2rout));
 	    break;
 	case RMF_RHELLO:
 	    (void)printf("router-hello ");
-	    vers = EXTRACT_8BITS(cmp->cm_rhello.rh_vers);
-	    eco = EXTRACT_8BITS(cmp->cm_rhello.rh_eco);
-	    ueco = EXTRACT_8BITS(cmp->cm_rhello.rh_ueco);
+	    vers = EXTRACT_LE_8BITS(cmp->cm_rhello.rh_vers);
+	    eco = EXTRACT_LE_8BITS(cmp->cm_rhello.rh_eco);
+	    ueco = EXTRACT_LE_8BITS(cmp->cm_rhello.rh_ueco);
 	    memcpy((char *)&srcea, (char *)&(cmp->cm_rhello.rh_src),
 		sizeof(srcea));
-	    src = EXTRACT_16BITS(srcea.dne_remote.dne_nodeaddr);
-	    info = EXTRACT_8BITS(cmp->cm_rhello.rh_info);
-	    blksize = EXTRACT_16BITS(cmp->cm_rhello.rh_blksize);
-	    priority = EXTRACT_8BITS(cmp->cm_rhello.rh_priority);
-	    hello = EXTRACT_16BITS(cmp->cm_rhello.rh_hello);
+	    src = EXTRACT_LE_16BITS(srcea.dne_remote.dne_nodeaddr);
+	    info = EXTRACT_LE_8BITS(cmp->cm_rhello.rh_info);
+	    blksize = EXTRACT_LE_16BITS(cmp->cm_rhello.rh_blksize);
+	    priority = EXTRACT_LE_8BITS(cmp->cm_rhello.rh_priority);
+	    hello = EXTRACT_LE_16BITS(cmp->cm_rhello.rh_hello);
 	    print_i_info(info);
 	    (void)printf(
 	    "vers %d eco %d ueco %d src %s blksize %d pri %d hello %d",
@@ -231,20 +230,20 @@ print_decnet_ctlmsg(register const union routehdr *rhp, int length)
 	    break;
 	case RMF_EHELLO:
 	    (void)printf("endnode-hello ");
-	    vers = EXTRACT_8BITS(cmp->cm_ehello.eh_vers);
-	    eco = EXTRACT_8BITS(cmp->cm_ehello.eh_eco);
-	    ueco = EXTRACT_8BITS(cmp->cm_ehello.eh_ueco);
+	    vers = EXTRACT_LE_8BITS(cmp->cm_ehello.eh_vers);
+	    eco = EXTRACT_LE_8BITS(cmp->cm_ehello.eh_eco);
+	    ueco = EXTRACT_LE_8BITS(cmp->cm_ehello.eh_ueco);
 	    memcpy((char *)&srcea, (char *)&(cmp->cm_ehello.eh_src),
 		sizeof(srcea));
-	    src = EXTRACT_16BITS(srcea.dne_remote.dne_nodeaddr);
-	    info = EXTRACT_8BITS(cmp->cm_ehello.eh_info);
-	    blksize = EXTRACT_16BITS(cmp->cm_ehello.eh_blksize);
+	    src = EXTRACT_LE_16BITS(srcea.dne_remote.dne_nodeaddr);
+	    info = EXTRACT_LE_8BITS(cmp->cm_ehello.eh_info);
+	    blksize = EXTRACT_LE_16BITS(cmp->cm_ehello.eh_blksize);
 	    /*seed*/
 	    memcpy((char *)&rtea, (char *)&(cmp->cm_ehello.eh_router),
 		sizeof(rtea));
-	    dst = EXTRACT_16BITS(rtea.dne_remote.dne_nodeaddr);
-	    hello = EXTRACT_16BITS(cmp->cm_ehello.eh_hello);
-	    other = EXTRACT_8BITS(cmp->cm_ehello.eh_data);
+	    dst = EXTRACT_LE_16BITS(rtea.dne_remote.dne_nodeaddr);
+	    hello = EXTRACT_LE_16BITS(cmp->cm_ehello.eh_hello);
+	    other = EXTRACT_LE_8BITS(cmp->cm_ehello.eh_data);
 	    print_i_info(info);
 	    (void)printf(
 	"vers %d eco %d ueco %d src %s blksize %d rtr %s hello %d data %o",
@@ -276,7 +275,7 @@ print_t_info(int info)
 }
 
 static void
-print_l1_routes(const char *rp, int len)
+print_l1_routes(const char *rp, u_int len)
 {
 	int count;
 	int id;
@@ -284,15 +283,15 @@ print_l1_routes(const char *rp, int len)
 
 	/* The last short is a checksum */
 	while (len > (3 * sizeof(short))) {
-	    count = EXTRACT_16BITS(rp);
+	    count = EXTRACT_LE_16BITS(rp);
 	    if (count > 1024)
 		return;	/* seems to be bogus from here on */
 	    rp += sizeof(short);
 	    len -= sizeof(short);
-	    id = EXTRACT_16BITS(rp);
+	    id = EXTRACT_LE_16BITS(rp);
 	    rp += sizeof(short);
 	    len -= sizeof(short);
-	    info = EXTRACT_16BITS(rp);
+	    info = EXTRACT_LE_16BITS(rp);
 	    rp += sizeof(short);
 	    len -= sizeof(short);
 	    (void)printf("{ids %d-%d cost %d hops %d} ", id, id + count,
@@ -301,7 +300,7 @@ print_l1_routes(const char *rp, int len)
 }
 
 static void
-print_l2_routes(const char *rp, int len)
+print_l2_routes(const char *rp, u_int len)
 {
 	int count;
 	int area;
@@ -309,15 +308,15 @@ print_l2_routes(const char *rp, int len)
 
 	/* The last short is a checksum */
 	while (len > (3 * sizeof(short))) {
-	    count = EXTRACT_16BITS(rp);
+	    count = EXTRACT_LE_16BITS(rp);
 	    if (count > 1024)
 		return;	/* seems to be bogus from here on */
 	    rp += sizeof(short);
 	    len -= sizeof(short);
-	    area = EXTRACT_16BITS(rp);
+	    area = EXTRACT_LE_16BITS(rp);
 	    rp += sizeof(short);
 	    len -= sizeof(short);
-	    info = EXTRACT_16BITS(rp);
+	    info = EXTRACT_LE_16BITS(rp);
 	    rp += sizeof(short);
 	    len -= sizeof(short);
 	    (void)printf("{areas %d-%d cost %d hops %d} ", area, area + count,
@@ -344,20 +343,20 @@ print_i_info(int info)
 }
 
 static void
-print_elist(const char *elp, int len)
+print_elist(const char *elp, u_int len)
 {
 	/* Not enough examples available for me to debug this */
 }
 
 static void
-print_nsp(const u_char *nspp, int nsplen)
+print_nsp(const u_char *nspp, u_int nsplen)
 {
 	const struct nsphdr *nsphp = (struct nsphdr *)nspp;
 	int dst, src, flags;
 
-	flags = EXTRACT_8BITS(nsphp->nh_flags);
-	dst = EXTRACT_16BITS(nsphp->nh_dst);
-	src = EXTRACT_16BITS(nsphp->nh_src);
+	flags = EXTRACT_LE_8BITS(nsphp->nh_flags);
+	dst = EXTRACT_LE_16BITS(nsphp->nh_dst);
+	src = EXTRACT_LE_16BITS(nsphp->nh_src);
 
 	switch (flags & NSP_TYPEMASK) {
 	case MFT_DATA:
@@ -373,22 +372,22 @@ print_nsp(const u_char *nspp, int nsplen)
 #ifdef	PRINT_NSPDATA
 		    u_char *dp;
 #endif
-		    int data_off = sizeof(struct minseghdr);
+		    u_int data_off = sizeof(struct minseghdr);
 
-		    ack = EXTRACT_16BITS(shp->sh_seq[0]);
+		    ack = EXTRACT_LE_16BITS(shp->sh_seq[0]);
 		    if (ack & SGQ_ACK) {	/* acknum field */
 			if ((ack & SGQ_NAK) == SGQ_NAK)
 			    (void)printf("nak %d ", ack & SGQ_MASK);
 			else
 			    (void)printf("ack %d ", ack & SGQ_MASK);
-		        ack = EXTRACT_16BITS(shp->sh_seq[1]);
+		        ack = EXTRACT_LE_16BITS(shp->sh_seq[1]);
 			data_off += sizeof(short);
 			if (ack & SGQ_OACK) {	/* ackoth field */
 			    if ((ack & SGQ_ONAK) == SGQ_ONAK)
 				(void)printf("onak %d ", ack & SGQ_MASK);
 			    else
 				(void)printf("oack %d ", ack & SGQ_MASK);
-			    ack = EXTRACT_16BITS(shp->sh_seq[2]);
+			    ack = EXTRACT_LE_16BITS(shp->sh_seq[2]);
 			    data_off += sizeof(short);
 			}
 		    }
@@ -407,22 +406,22 @@ print_nsp(const u_char *nspp, int nsplen)
 #ifdef	PRINT_NSPDATA
 		    u_char *dp;
 #endif
-		    int data_off = sizeof(struct minseghdr);
+		    u_int data_off = sizeof(struct minseghdr);
 
-		    ack = EXTRACT_16BITS(shp->sh_seq[0]);
+		    ack = EXTRACT_LE_16BITS(shp->sh_seq[0]);
 		    if (ack & SGQ_ACK) {	/* acknum field */
 			if ((ack & SGQ_NAK) == SGQ_NAK)
 			    (void)printf("nak %d ", ack & SGQ_MASK);
 			else
 			    (void)printf("ack %d ", ack & SGQ_MASK);
-		        ack = EXTRACT_16BITS(shp->sh_seq[1]);
+		        ack = EXTRACT_LE_16BITS(shp->sh_seq[1]);
 			data_off += sizeof(short);
 			if (ack & SGQ_OACK) {	/* ackdat field */
 			    if ((ack & SGQ_ONAK) == SGQ_ONAK)
 				(void)printf("nakdat %d ", ack & SGQ_MASK);
 			    else
 				(void)printf("ackdat %d ", ack & SGQ_MASK);
-			    ack = EXTRACT_16BITS(shp->sh_seq[2]);
+			    ack = EXTRACT_LE_16BITS(shp->sh_seq[2]);
 			    data_off += sizeof(short);
 			}
 		    }
@@ -442,24 +441,24 @@ print_nsp(const u_char *nspp, int nsplen)
 		    int ack;
 		    int lsflags, fcval;
 
-		    ack = EXTRACT_16BITS(shp->sh_seq[0]);
+		    ack = EXTRACT_LE_16BITS(shp->sh_seq[0]);
 		    if (ack & SGQ_ACK) {	/* acknum field */
 			if ((ack & SGQ_NAK) == SGQ_NAK)
 			    (void)printf("nak %d ", ack & SGQ_MASK);
 			else
 			    (void)printf("ack %d ", ack & SGQ_MASK);
-		        ack = EXTRACT_16BITS(shp->sh_seq[1]);
+		        ack = EXTRACT_LE_16BITS(shp->sh_seq[1]);
 			if (ack & SGQ_OACK) {	/* ackdat field */
 			    if ((ack & SGQ_ONAK) == SGQ_ONAK)
 				(void)printf("nakdat %d ", ack & SGQ_MASK);
 			    else
 				(void)printf("ackdat %d ", ack & SGQ_MASK);
-			    ack = EXTRACT_16BITS(shp->sh_seq[2]);
+			    ack = EXTRACT_LE_16BITS(shp->sh_seq[2]);
 			}
 		    }
 		    (void)printf("seg %d ", ack & SGQ_MASK);
-		    lsflags = EXTRACT_8BITS(lsmp->ls_lsflags);
-		    fcval = EXTRACT_8BITS(lsmp->ls_fcval);
+		    lsflags = EXTRACT_LE_8BITS(lsmp->ls_lsflags);
+		    fcval = EXTRACT_LE_8BITS(lsmp->ls_fcval);
 		    switch (lsflags & LSI_MASK) {
 		    case LSI_DATA:
 			(void)printf("dat seg count %d ", fcval);
@@ -499,13 +498,13 @@ print_nsp(const u_char *nspp, int nsplen)
 		    struct ackmsg *amp = (struct ackmsg *)nspp;
 		    int ack;
 
-		    ack = EXTRACT_16BITS(amp->ak_acknum[0]);
+		    ack = EXTRACT_LE_16BITS(amp->ak_acknum[0]);
 		    if (ack & SGQ_ACK) {	/* acknum field */
 			if ((ack & SGQ_NAK) == SGQ_NAK)
 			    (void)printf("nak %d ", ack & SGQ_MASK);
 			else
 			    (void)printf("ack %d ", ack & SGQ_MASK);
-		        ack = EXTRACT_16BITS(amp->ak_acknum[1]);
+		        ack = EXTRACT_LE_16BITS(amp->ak_acknum[1]);
 			if (ack & SGQ_OACK) {	/* ackoth field */
 			    if ((ack & SGQ_ONAK) == SGQ_ONAK)
 				(void)printf("onak %d ", ack & SGQ_MASK);
@@ -521,13 +520,13 @@ print_nsp(const u_char *nspp, int nsplen)
 		    struct ackmsg *amp = (struct ackmsg *)nspp;
 		    int ack;
 
-		    ack = EXTRACT_16BITS(amp->ak_acknum[0]);
+		    ack = EXTRACT_LE_16BITS(amp->ak_acknum[0]);
 		    if (ack & SGQ_ACK) {	/* acknum field */
 			if ((ack & SGQ_NAK) == SGQ_NAK)
 			    (void)printf("nak %d ", ack & SGQ_MASK);
 			else
 			    (void)printf("ack %d ", ack & SGQ_MASK);
-		        ack = EXTRACT_16BITS(amp->ak_acknum[1]);
+		        ack = EXTRACT_LE_16BITS(amp->ak_acknum[1]);
 			if (ack & SGQ_OACK) {	/* ackdat field */
 			    if ((ack & SGQ_ONAK) == SGQ_ONAK)
 				(void)printf("nakdat %d ", ack & SGQ_MASK);
@@ -561,9 +560,9 @@ print_nsp(const u_char *nspp, int nsplen)
 		    u_char *dp;
 #endif
 
-		    services = EXTRACT_8BITS(cimp->ci_services);
-		    info = EXTRACT_8BITS(cimp->ci_info);
-		    segsize = EXTRACT_16BITS(cimp->ci_segsize);
+		    services = EXTRACT_LE_8BITS(cimp->ci_services);
+		    info = EXTRACT_LE_8BITS(cimp->ci_info);
+		    segsize = EXTRACT_LE_16BITS(cimp->ci_segsize);
 
 		    switch (services & COS_MASK) {
 		    case COS_NONE:
@@ -603,15 +602,16 @@ print_nsp(const u_char *nspp, int nsplen)
 		(void)printf("conn-confirm %d>%d ", src, dst);
 		{
 		    struct ccmsg *ccmp = (struct ccmsg *)nspp;
-		    int services, info, segsize, optlen;
+		    int services, info;
+		    u_int segsize, optlen;
 #ifdef	PRINT_NSPDATA
 		    u_char *dp;
 #endif
 
-		    services = EXTRACT_8BITS(ccmp->cc_services);
-		    info = EXTRACT_8BITS(ccmp->cc_info);
-		    segsize = EXTRACT_16BITS(ccmp->cc_segsize);
-		    optlen = EXTRACT_8BITS(ccmp->cc_optlen);
+		    services = EXTRACT_LE_8BITS(ccmp->cc_services);
+		    info = EXTRACT_LE_8BITS(ccmp->cc_info);
+		    segsize = EXTRACT_LE_16BITS(ccmp->cc_segsize);
+		    optlen = EXTRACT_LE_8BITS(ccmp->cc_optlen);
 
 		    switch (services & COS_MASK) {
 		    case COS_NONE:
@@ -655,13 +655,14 @@ print_nsp(const u_char *nspp, int nsplen)
 		(void)printf("disconn-initiate %d>%d ", src, dst);
 		{
 		    struct dimsg *dimp = (struct dimsg *)nspp;
-		    int reason, optlen;
+		    int reason;
+		    u_int optlen;
 #ifdef	PRINT_NSPDATA
 		    u_char *dp;
 #endif
 
-		    reason = EXTRACT_16BITS(dimp->di_reason);
-		    optlen = EXTRACT_8BITS(dimp->di_optlen);
+		    reason = EXTRACT_LE_16BITS(dimp->di_reason);
+		    optlen = EXTRACT_LE_8BITS(dimp->di_optlen);
 
 		    print_reason(reason);
 		    if (optlen) {
@@ -680,7 +681,7 @@ print_nsp(const u_char *nspp, int nsplen)
 		    struct dcmsg *dcmp = (struct dcmsg *)nspp;
 		    int reason;
 
-		    reason = EXTRACT_16BITS(dcmp->dc_reason);
+		    reason = EXTRACT_LE_16BITS(dcmp->dc_reason);
 
 		    print_reason(reason);
 		}
@@ -732,7 +733,7 @@ char *
 dnnum_string(u_short dnaddr)
 {
 	char *str;
-	int area = (dnaddr & AREAMASK) >> AREASHIFT;
+	int area = (u_short)(dnaddr & AREAMASK) >> AREASHIFT;
 	int node = dnaddr & NODEMASK;
 
 	str = (char *)malloc(sizeof("00.0000"));
@@ -758,10 +759,10 @@ dnname_string(u_short dnaddr)
 
 #ifdef	PRINT_NSPDATA
 static void
-pdata(u_char *dp, int maxlen)
+pdata(u_char *dp, u_int maxlen)
 {
 	char c;
-	int x = maxlen;
+	u_int x = maxlen;
 
 	while (x-- > 0) {
 	    c = *dp++;
diff --git a/usr.sbin/tcpdump/print-domain.c b/usr.sbin/tcpdump/print-domain.c
index c8ba519d90e..d2d34d092f0 100644
--- a/usr.sbin/tcpdump/print-domain.c
+++ b/usr.sbin/tcpdump/print-domain.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-domain.c,v 1.4 1996/07/13 11:01:18 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-domain.c,v 1.29 96/06/19 00:49:25 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-domain.c,v 1.5 1996/12/12 16:22:40 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -48,6 +45,7 @@ struct rtentry;
 #include <netinet/tcpip.h>
 
 #undef NOERROR					/* Solaris sucks */
+#undef T_UNSPEC					/* SINIX does too */
 #include <arpa/nameser.h>
 
 #include <stdio.h>
@@ -56,7 +54,7 @@ struct rtentry;
 #include "addrtoname.h"
 #include "extract.h"                    /* must come after interface.h */
 
-/* Compatiblity */
+/* Compatibility */
 #ifndef T_TXT
 #define T_TXT		16		/* text strings */
 #endif
@@ -164,9 +162,9 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 				i = *cp++;
 				continue;
 			}
-			do {
-				putchar(*cp++);
-			} while (--i);
+			if (fn_printn(cp, i, snapend))
+				break;
+			cp += i;
 			putchar('.');
 			i = *cp++;
 			if (!compress)
@@ -184,11 +182,8 @@ ns_cprint(register const u_char *cp, register const u_char *bp)
 	register u_int i;
 
 	i = *cp++;
-	if (cp + i < snapend)
-		do {
-			putchar(*cp++);
-		} while (--i);
-	return (cp);
+	(void)fn_printn(cp, i, snapend);
+	return (cp + i);
 }
 
 static struct tok type2str[] = {
@@ -316,7 +311,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 	case T_MX:
 		putchar(' ');
 		(void)ns_nprint(cp + 2, bp);
-		printf(" %d", EXTRACT_SHORT(cp));
+		printf(" %d", EXTRACT_16BITS(cp));
 		break;
 
 	case T_TXT:
@@ -328,11 +323,11 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 	        printf(" %.*s", len, cp);
 		break;
 	}
-	return (rp);		/* XXX This isn't always right*/
+	return (rp);		/* XXX This isn't always right */
 }
 
 void
-ns_print(register const u_char *bp, int length)
+ns_print(register const u_char *bp, u_int length)
 {
 	register const HEADER *np;
 	register int qdcount, ancount, nscount, arcount;
diff --git a/usr.sbin/tcpdump/print-dvmrp.c b/usr.sbin/tcpdump/print-dvmrp.c
index 45cd5a4b8aa..52a257cc40b 100644
--- a/usr.sbin/tcpdump/print-dvmrp.c
+++ b/usr.sbin/tcpdump/print-dvmrp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-dvmrp.c,v 1.1 1996/07/13 11:01:19 mickey Exp $	*/
-
 /*
  * Copyright (c) 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-"@(#) Header: print-dvmrp.c,v 1.7 96/06/03 02:52:39 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-dvmrp.c,v 1.2 1996/12/12 16:22:39 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -74,17 +71,18 @@ static char rcsid[] =
 #define DVMRP_NF_DISABLED	0x20	/* administratively disabled */
 #define DVMRP_NF_QUERIER	0x40	/* I am the subnet's querier */
 
-static void print_report(const u_char *, const u_char *, int);
-static void print_neighbors(const u_char *, const u_char *, int);
-static void print_neighbors2(const u_char *, const u_char *, int);
-static void print_prune(const u_char *, const u_char *, int);
-static void print_graft(const u_char *, const u_char *, int);
-static void print_graft_ack(const u_char *, const u_char *, int);
+static void print_probe(const u_char *, const u_char *, u_int);
+static void print_report(const u_char *, const u_char *, u_int);
+static void print_neighbors(const u_char *, const u_char *, u_int);
+static void print_neighbors2(const u_char *, const u_char *, u_int);
+static void print_prune(const u_char *, const u_char *, u_int);
+static void print_graft(const u_char *, const u_char *, u_int);
+static void print_graft_ack(const u_char *, const u_char *, u_int);
 
 static u_int32_t target_level;
 
 void
-dvmrp_print(register const u_char *bp, register int len)
+dvmrp_print(register const u_char *bp, register u_int len)
 {
 	register const u_char *ep;
 	register u_char type;
@@ -102,8 +100,11 @@ dvmrp_print(register const u_char *bp, register int len)
 	len -= 8;
 
 	switch (type) {
+
 	case DVMRP_PROBE:
 		printf(" Probe");
+		if (vflag)
+			print_probe(bp, ep, len);
 		break;
 
 	case DVMRP_REPORT:
@@ -122,25 +123,19 @@ dvmrp_print(register const u_char *bp, register int len)
 		break;
 
 	case DVMRP_ASK_NEIGHBORS2:
-		printf(" Ask-neighbors");
+		printf(" Ask-neighbors2");
 		break;
 
 	case DVMRP_NEIGHBORS2:
-		printf(" Neighbors");
-		bp -= 4;
-		target_level = ((u_int32_t) * bp++ << 24);
+		printf(" Neighbors2");
 		/*
-		 * Group address in IGMP
+		 * extract version and capabilities from IGMP group
+		 * address field
 		 */
-
-		target_level += ((u_int32_t) * bp++ << 16);
-		/*
-		 * header is version number
-		 */
-
-		target_level += ((u_int32_t) * bp++ << 8);
-		target_level += ((u_int32_t) * bp++);
-		target_level = htonl(target_level);
+		bp -= 4;
+		target_level = (bp[0] << 24) | (bp[1] << 16) |
+		    (bp[2] << 8) | bp[3];
+		bp += 4;
 		print_neighbors2(bp, ep, len);
 		break;
 
@@ -166,20 +161,18 @@ dvmrp_print(register const u_char *bp, register int len)
 }
 
 static void
-print_report(const u_char *bp, const u_char *ep, int len)
+print_report(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
-	u_int32_t mask, origin;
-	int metric;
-	int i;
-	int width;
-	int done;
+	register u_int32_t mask, origin;
+	register int metric, i, width, done;
 
 	while (len > 0) {
 		if (len < 3) {
 			printf(" [|]");
 			return;
 		}
-		mask = 0xff << 24 | bp[0] << 16 | bp[1] << 8 | bp[2];
+		mask = (u_int32_t)0xff << 24 | bp[0] << 16 | bp[1] << 8 | bp[2];
 		width = 1;
 		if (bp[0])
 			width = 2;
@@ -216,18 +209,45 @@ print_report(const u_char *bp, const u_char *ep, int len)
 	}
 }
 
-#define GET_ADDR(to) (memcpy((char*)to, (char*)bp, 4), bp += 4)
+#define GET_ADDR(to) (memcpy((char *)to, (char *)bp, 4), bp += 4)
+
+static void
+print_probe(register const u_char *bp, register const u_char *ep,
+    register u_int len)
+{
+	register u_int32_t genid;
+	u_char neighbor[4];
+
+	if ((len < 4) || ((bp + 4) > ep)) {
+		/* { (ctags) */
+		printf(" [|}");
+		return;
+	}
+	genid = (bp[0] << 24) | (bp[1] << 16) | (bp[2] << 8) | bp[3];
+	bp += 4;
+	len -= 4;
+	printf("\n\tgenid %u", genid);
+
+	while ((len > 0) && (bp < ep)) {
+		if ((len < 4) || ((bp + 4) > ep)) {
+			printf(" [|]");
+			return;
+		}
+		GET_ADDR(neighbor);
+		len -= 4;
+		printf("\n\tneighbor %s", ipaddr_string(neighbor));
+	}
+}
 
 static void
-print_neighbors(const u_char *bp, const u_char *ep, int len)
+print_neighbors(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
 	u_char laddr[4], neighbor[4];
-	u_char metric;
-	u_char thresh;
-	u_char save_nflag;
-	int ncount;
+	register u_char metric;
+	register u_char thresh;
+	register int ncount;
 
-	save_nflag = nflag;
 	while (len > 0 && bp < ep) {
 		if (len < 7 || (bp + 7) >= ep) {
 			printf(" [|]");
@@ -240,9 +260,7 @@ print_neighbors(const u_char *bp, const u_char *ep, int len)
 		len -= 7;
 		while (--ncount >= 0 && (len >= 4) && (bp + 4) < ep) {
 			GET_ADDR(neighbor);
-			nflag = 0;
 			printf(" [%s ->", ipaddr_string(laddr));
-			nflag = save_nflag;
 			printf(" %s, (%d/%d)]",
 				   ipaddr_string(neighbor), metric, thresh);
 			len -= 4;
@@ -251,20 +269,17 @@ print_neighbors(const u_char *bp, const u_char *ep, int len)
 }
 
 static void
-print_neighbors2(const u_char *bp, const u_char *ep, int len)
+print_neighbors2(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
 	u_char laddr[4], neighbor[4];
-	u_char metric;
-	u_char thresh;
-	u_char flags;
-	u_char save_nflag;
-	int ncount;
+	register u_char metric, thresh, flags;
+	register int ncount;
 
 	printf(" (v %d.%d):",
 	       (int)target_level & 0xff,
 	       (int)(target_level >> 8) & 0xff);
 
-	save_nflag = nflag;
 	while (len > 0 && bp < ep) {
 		if (len < 8 || (bp + 8) >= ep) {
 			printf(" [|]");
@@ -276,11 +291,9 @@ print_neighbors2(const u_char *bp, const u_char *ep, int len)
 		flags = *bp++;
 		ncount = *bp++;
 		len -= 8;
-		while (--ncount >= 0 && (len >= 4) && (bp + 4) < ep) {
+		while (--ncount >= 0 && (len >= 4) && (bp + 4) <= ep) {
 			GET_ADDR(neighbor);
-			nflag = 0;
 			printf(" [%s -> ", ipaddr_string(laddr));
-			nflag = save_nflag;
 			printf("%s (%d/%d", ipaddr_string(neighbor),
 				     metric, thresh);
 			if (flags & DVMRP_NF_TUNNEL)
@@ -304,14 +317,15 @@ print_neighbors2(const u_char *bp, const u_char *ep, int len)
 }
 
 static void
-print_prune(const u_char *bp, const u_char *ep, int len)
+print_prune(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
 	union a {
 		u_char b[4];
 		u_int32_t i;
 	} prune_timer;
 
-	if (len < 12 || (bp + 12) >= ep) {
+	if (len < 12 || (bp + 12) > ep) {
 		printf(" [|]");
 		return;
 	}
@@ -322,10 +336,11 @@ print_prune(const u_char *bp, const u_char *ep, int len)
 }
 
 static void
-print_graft(const u_char *bp, const u_char *ep, int len)
+print_graft(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
 
-	if (len < 8 || (bp + 8) >= ep) {
+	if (len < 8 || (bp + 8) > ep) {
 		printf(" [|]");
 		return;
 	}
@@ -333,10 +348,11 @@ print_graft(const u_char *bp, const u_char *ep, int len)
 }
 
 static void
-print_graft_ack(const u_char *bp, const u_char *ep, int len)
+print_graft_ack(register const u_char *bp, register const u_char *ep,
+    register u_int len)
 {
 
-	if (len < 8 || (bp + 8) >= ep) {
+	if (len < 8 || (bp + 8) > ep) {
 		printf(" [|]");
 		return;
 	}
diff --git a/usr.sbin/tcpdump/print-egp.c b/usr.sbin/tcpdump/print-egp.c
index 24df9ffc530..fc1fc18fcef 100644
--- a/usr.sbin/tcpdump/print-egp.c
+++ b/usr.sbin/tcpdump/print-egp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-egp.c,v 1.4 1996/07/13 11:01:20 mickey Exp $	*/
-
 /*
  * Copyright (c) 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -21,8 +19,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-egp.c,v 1.19 96/06/23 02:11:45 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/print-egp.c,v 1.5 1996/12/12 16:22:39 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
@@ -138,13 +136,12 @@ char *egp_reasons[] = {
 };
 
 static void
-egpnrprint(register const struct egp_packet *egp, register int length)
+egpnrprint(register const struct egp_packet *egp, register u_int length)
 {
-	register const u_char *cp, *ep;
-#define TCHECK(n) if (cp > ep - n) goto trunc
+	register const u_char *cp;
 	u_int32_t addr;
 	register u_int32_t net;
-	register int netlen;
+	register u_int netlen;
 	int gateways, distances, networks;
 	int t_gateways;
 	char *comma;
@@ -164,13 +161,12 @@ egpnrprint(register const struct egp_packet *egp, register int length)
 		netlen = 0;
 	}
 	cp = (u_char *)(egp + 1);
-	ep = snapend;
 
 	t_gateways = egp->egp_intgw + egp->egp_extgw;
 	for (gateways = 0; gateways < t_gateways; ++gateways) {
 		/* Pickup host part of gateway address */
 		addr = 0;
-		TCHECK(4 - netlen);
+		TCHECK2(cp[0], 4 - netlen);
 		switch (netlen) {
 
 		case 1:
@@ -183,28 +179,28 @@ egpnrprint(register const struct egp_packet *egp, register int length)
 			addr = (addr << 8) | *cp++;
 		}
 		addr |= net;
-		TCHECK(1);
+		TCHECK2(cp[0], 1);
 		distances = *cp++;
 		printf(" %s %s ",
-		       gateways < egp->egp_intgw ? "int" : "ext",
+		       gateways < (int)egp->egp_intgw ? "int" : "ext",
 		       ipaddr_string(&addr));
 
 		comma = "";
 		putchar('(');
 		while (--distances >= 0) {
-			TCHECK(2);
+			TCHECK2(cp[0], 2);
 			printf("%sd%d:", comma, (int)*cp++);
 			comma = ", ";
 			networks = *cp++;
 			while (--networks >= 0) {
 				/* Pickup network number */
-				TCHECK(1);
+				TCHECK2(cp[0], 1);
 				addr = (u_int32_t)*cp++ << 24;
 				if (IN_CLASSB(addr)) {
-					TCHECK(1);
+					TCHECK2(cp[0], 1);
 					addr |= (u_int32_t)*cp++ << 16;
 				} else if (!IN_CLASSA(addr)) {
-					TCHECK(2);
+					TCHECK2(cp[0], 2);
 					addr |= (u_int32_t)*cp++ << 16;
 					addr |= (u_int32_t)*cp++ << 8;
 				}
@@ -219,7 +215,7 @@ trunc:
 }
 
 void
-egp_print(register const u_char *bp, register int length,
+egp_print(register const u_char *bp, register u_int length,
 	  register const u_char *bp2)
 {
 	register const struct egp_packet *egp;
diff --git a/usr.sbin/tcpdump/print-ether.c b/usr.sbin/tcpdump/print-ether.c
index 9c8211e7dce..ab033274ec0 100644
--- a/usr.sbin/tcpdump/print-ether.c
+++ b/usr.sbin/tcpdump/print-ether.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ether.c,v 1.5 1996/11/12 08:31:57 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -21,13 +19,12 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-ether.c,v 1.39 96/06/03 03:05:27 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ether.c,v 1.6 1996/12/12 16:22:38 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -57,7 +54,7 @@ const u_char *packetp;
 const u_char *snapend;
 
 static inline void
-ether_print(register const u_char *bp, int length)
+ether_print(register const u_char *bp, u_int length)
 {
 	register const struct ether_header *ep;
 
@@ -84,8 +81,8 @@ ether_print(register const u_char *bp, int length)
 void
 ether_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 {
-	int caplen = h->caplen;
-	int length = h->len;
+	u_int caplen = h->caplen;
+	u_int length = h->len;
 	struct ether_header *ep;
 	u_short ether_type;
 	extern u_short extracted_ethertype;
@@ -158,7 +155,8 @@ ether_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 u_short	extracted_ethertype;
 
 int
-ether_encap_print(u_short ethertype, const u_char *p, int length, int caplen)
+ether_encap_print(u_short ethertype, const u_char *p,
+    u_int length, u_int caplen)
 {
 	extracted_ethertype = ethertype;
 
@@ -187,11 +185,8 @@ ether_encap_print(u_short ethertype, const u_char *p, int length, int caplen)
 		aarp_print(p, length);
 		return (1);
 
-	case ETHERTYPE_8022:
-		netbios_print(p, length);
-		return (1);
-
 	case ETHERTYPE_LAT:
+	case ETHERTYPE_SCA:
 	case ETHERTYPE_MOPRC:
 	case ETHERTYPE_MOPDL:
 		/* default_print for now */
@@ -199,4 +194,3 @@ ether_encap_print(u_short ethertype, const u_char *p, int length, int caplen)
 		return (0);
 	}
 }
-
diff --git a/usr.sbin/tcpdump/print-fddi.c b/usr.sbin/tcpdump/print-fddi.c
index 0c45079c867..2b7d1c59925 100644
--- a/usr.sbin/tcpdump/print-fddi.c
+++ b/usr.sbin/tcpdump/print-fddi.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-fddi.c,v 1.4 1996/07/13 11:01:22 mickey Exp $	*/
-
 /*
  * Copyright (c) 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static  char rcsid[] =
-	"@(#)Header: print-fddi.c,v 1.30 96/06/03 03:05:50 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-fddi.c,v 1.5 1996/12/12 16:22:38 bitblt Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_FDDI
@@ -229,7 +227,7 @@ extract_fddi_addrs(const struct fddi_header *fddip, char *fsrc, char *fdst)
  * Print the FDDI MAC header
  */
 static inline void
-fddi_print(register const struct fddi_header *fddip, register int length,
+fddi_print(register const struct fddi_header *fddip, register u_int length,
 	   register const u_char *fsrc, register const u_char *fdst)
 {
 	char *srcname, *dstname;
@@ -251,7 +249,7 @@ fddi_print(register const struct fddi_header *fddip, register int length,
 }
 
 static inline void
-fddi_smt_print(const u_char *p, int length)
+fddi_smt_print(const u_char *p, u_int length)
 {
 	printf("<SMT printer not yet implemented>");
 }
@@ -266,8 +264,8 @@ void
 fddi_if_print(u_char *pcap, const struct pcap_pkthdr *h,
 	      register const u_char *p)
 {
-	int caplen = h->caplen;
-	int length = h->len;
+	u_int caplen = h->caplen;
+	u_int length = h->len;
 	const struct fddi_header *fddip = (struct fddi_header *)p;
 	extern u_short extracted_ethertype;
 	struct ether_header ehdr;
@@ -281,7 +279,7 @@ fddi_if_print(u_char *pcap, const struct pcap_pkthdr *h,
 	/*
 	 * Get the FDDI addresses into a canonical form
 	 */
-	extract_fddi_addrs(fddip, (char*)ESRC(&ehdr), (char*)EDST(&ehdr));
+	extract_fddi_addrs(fddip, (char *)ESRC(&ehdr), (char *)EDST(&ehdr));
 	/*
 	 * Some printers want to get back at the link level addresses,
 	 * and/or check that they're not walking off the end of the packet.
diff --git a/usr.sbin/tcpdump/print-gre.c b/usr.sbin/tcpdump/print-gre.c
new file mode 100644
index 00000000000..9d7969b877a
--- /dev/null
+++ b/usr.sbin/tcpdump/print-gre.c
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 1996
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that the above copyright notice and this paragraph are
+ * duplicated in all such forms and that any documentation,
+ * advertising materials, and other materials related to such
+ * distribution and use acknowledge that the software was developed
+ * by the University of California, Lawrence Berkeley Laboratory,
+ * Berkeley, CA.  The name of the University may not be used to
+ * endorse or promote products derived from this software without
+ * specific prior written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * Initial contribution from John Hawkinson <jhawk@bbnplanet.com>
+ *
+ * This module implements support for decoding GRE (Generic Routing
+ * Encapsulation) tunnels; they're documented in RFC1701 and RFC1702.
+ * This code only supports the IP encapsulation thereof.
+ */
+
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-gre.c,v 1.1 1996/12/12 16:22:37 bitblt Exp $";
+#endif
+
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+
+#include <netdb.h>
+#include <stdio.h>
+
+#include "interface.h"
+#include "addrtoname.h"
+#include "extract.h"		/* must come after interface.h */
+
+#define GRE_SIZE (20)
+
+struct gre {
+	u_short flags;
+	u_short proto;
+	union {
+		struct gre_ckof {
+			u_short cksum;
+			u_short offset;
+		}        gre_ckof;
+		u_int32_t key;
+		u_int32_t seq;
+	}     gre_void1;
+	union {
+		u_int32_t key;
+		u_int32_t seq;
+		u_int32_t routing;
+	}     gre_void2;
+	union {
+		u_int32_t seq;
+		u_int32_t routing;
+	}     gre_void3;
+	union {
+		u_int32_t routing;
+	}     gre_void4;
+};
+
+#define GRE_CP		0x8000	/* Checksum Present */
+#define GRE_RP		0x4000	/* Routing Present */
+#define GRE_KP		0x2000	/* Key Present */
+#define GRE_SP		0x1000	/* Sequence Present */
+
+
+#define GREPROTO_IP	0x0800
+
+
+/*
+ * Deencapsulate and print a GRE-tunneled IP datagram
+ */
+void
+gre_print(const u_char *bp, u_int length)
+{
+	const u_char *cp = bp + 4;
+	const struct gre *gre;
+	u_short flags, proto;
+
+	gre = (const struct gre *)bp;
+
+	if (length < GRE_SIZE) {
+		goto trunc;
+	}
+	flags = EXTRACT_16BITS(&gre->flags);
+	proto = EXTRACT_16BITS(&gre->proto);
+
+	if (vflag) {
+		/* Decode the flags */
+		putchar('[');
+		if (flags & GRE_CP)
+			putchar('C');
+		if (flags & GRE_RP)
+			putchar('R');
+		if (flags & GRE_KP)
+			putchar('K');
+		if (flags & GRE_SP)
+			putchar('S');
+		fputs("] ", stdout);
+	}
+	/* Checksum & Offset are present */
+	if ((flags & GRE_CP) | (flags & GRE_RP))
+		cp += 4;
+
+	/* We don't support routing fields (variable length) now. Punt. */
+	if (flags & GRE_RP)
+		return;
+
+	if (flags & GRE_KP)
+		cp += 4;
+	if (flags & GRE_SP)
+		cp += 4;
+
+	switch (proto) {
+
+	case GREPROTO_IP:
+		ip_print(cp, length - ((cp - bp) / sizeof(u_char)));
+		break;
+
+	default:
+		printf("gre-proto-0x%04X", proto);
+		break;
+	}
+	return;
+
+trunc:
+	fputs("[|gre]", stdout);
+
+}
diff --git a/usr.sbin/tcpdump/print-icmp.c b/usr.sbin/tcpdump/print-icmp.c
index e53cc66a83c..1730b2a0292 100644
--- a/usr.sbin/tcpdump/print-icmp.c
+++ b/usr.sbin/tcpdump/print-icmp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-icmp.c,v 1.4 1996/07/13 11:01:23 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-icmp.c,v 1.27 96/06/24 22:14:23 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-icmp.c,v 1.5 1996/12/12 16:22:37 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -49,11 +46,13 @@ struct rtentry;
 #include <netinet/tcpip.h>
 
 #include <stdio.h>
+#include <string.h>
 
 #include "interface.h"
 #include "addrtoname.h"
+#include "extract.h"			/* must come after interface.h */
 
-/* Compatibility */
+/* rfc1700 */
 #ifndef ICMP_UNREACH_NET_UNKNOWN
 #define ICMP_UNREACH_NET_UNKNOWN	6	/* destination net unknown */
 #endif
@@ -76,11 +75,31 @@ struct rtentry;
 #define ICMP_UNREACH_TOSHOST		12	/* tos prohibited host */
 #endif
 
+/* rfc1716 */
+#ifndef ICMP_UNREACH_FILTER_PROHIB
+#define ICMP_UNREACH_FILTER_PROHIB	13	/* admin prohibited filter */
+#endif
+#ifndef ICMP_UNREACH_HOST_PRECEDENCE
+#define ICMP_UNREACH_HOST_PRECEDENCE	14	/* host precedence violation */
+#endif
+#ifndef ICMP_UNREACH_PRECEDENCE_CUTOFF
+#define ICMP_UNREACH_PRECEDENCE_CUTOFF	15	/* precedence cutoff */
+#endif
+
+/* rfc1256 */
+#ifndef ICMP_ROUTERADVERT
+#define ICMP_ROUTERADVERT		9	/* router advertisement */
+#endif
+#ifndef ICMP_ROUTERSOLICIT
+#define ICMP_ROUTERSOLICIT		10	/* router solicitation */
+#endif
+
 /* Most of the icmp types */
 static struct tok icmp2str[] = {
 	{ ICMP_ECHOREPLY,		"echo reply" },
 	{ ICMP_SOURCEQUENCH,		"source quench" },
 	{ ICMP_ECHO,			"echo request" },
+	{ ICMP_ROUTERSOLICIT,		"router solicitation" },
 	{ ICMP_TSTAMP,			"time stamp request" },
 	{ ICMP_TSTAMPREPLY,		"time stamp reply" },
 	{ ICMP_IREQ,			"information request" },
@@ -93,7 +112,6 @@ static struct tok icmp2str[] = {
 static struct tok unreach2str[] = {
 	{ ICMP_UNREACH_NET,		"net %s unreachable" },
 	{ ICMP_UNREACH_HOST,		"host %s unreachable" },
-	{ ICMP_UNREACH_NEEDFRAG,	"%s unreachable - need to frag" },
 	{ ICMP_UNREACH_SRCFAIL,
 	    "%s unreachable - source route failed" },
 	{ ICMP_UNREACH_NET_UNKNOWN,	"net %s unreachable - unknown" },
@@ -108,6 +126,12 @@ static struct tok unreach2str[] = {
 	    "net %s unreachable - tos prohibited" },
 	{ ICMP_UNREACH_TOSHOST,
 	    "host %s unreachable - tos prohibited" },
+	{ ICMP_UNREACH_FILTER_PROHIB,
+	    "host %s unreachable - admin prohibited filter" },
+	{ ICMP_UNREACH_HOST_PRECEDENCE,
+	    "host %s unreachable - host precedence violation" },
+	{ ICMP_UNREACH_PRECEDENCE_CUTOFF,
+	    "host %s unreachable - precedence cutoff" },
 	{ 0,				NULL }
 };
 
@@ -120,19 +144,36 @@ static struct tok type2str[] = {
 	{ 0,				NULL }
 };
 
+/* rfc1191 */
+struct mtu_discovery {
+	short unused;
+	short nexthopmtu;
+};
+
+/* rfc1256 */
+struct ih_rdiscovery {
+	u_char ird_addrnum;
+	u_char ird_addrsiz;
+	u_short ird_lifetime;
+};
+
+struct id_rdiscovery {
+	u_int32_t ird_addr;
+	u_int32_t ird_pref;
+};
+
 void
 icmp_print(register const u_char *bp, register const u_char *bp2)
 {
+	register char *cp;
 	register const struct icmp *dp;
 	register const struct ip *ip;
 	register const char *str, *fmt;
 	register const struct ip *oip;
 	register const struct udphdr *ouh;
-	register int hlen, dport;
+	register u_int hlen, dport, mtu;
 	char buf[256];
 
-#define TCHECK(var, l) if ((u_char *)&(var) > snapend - l) goto trunc
-
 	dp = (struct icmp *)bp;
 	ip = (struct ip *)bp2;
 	str = buf;
@@ -141,22 +182,22 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 		ipaddr_string(&ip->ip_src),
 		ipaddr_string(&ip->ip_dst));
 
-	TCHECK(dp->icmp_code, sizeof(dp->icmp_code));
+	TCHECK(dp->icmp_code);
 	switch (dp->icmp_type) {
 
 	case ICMP_UNREACH:
-		TCHECK(dp->icmp_ip.ip_dst, sizeof(dp->icmp_ip.ip_dst));
+		TCHECK(dp->icmp_ip.ip_dst);
 		switch (dp->icmp_code) {
 
 		case ICMP_UNREACH_PROTOCOL:
-			TCHECK(dp->icmp_ip.ip_p, sizeof(dp->icmp_ip.ip_p));
+			TCHECK(dp->icmp_ip.ip_p);
 			(void)sprintf(buf, "%s protocol %d unreachable",
 				       ipaddr_string(&dp->icmp_ip.ip_dst),
 				       dp->icmp_ip.ip_p);
 			break;
 
 		case ICMP_UNREACH_PORT:
-			TCHECK(dp->icmp_ip.ip_p, sizeof(dp->icmp_ip.ip_p));
+			TCHECK(dp->icmp_ip.ip_p);
 			oip = &dp->icmp_ip;
 			hlen = oip->ip_hl * 4;
 			ouh = (struct udphdr *)(((u_char *)oip) + hlen);
@@ -186,6 +227,23 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 			}
 			break;
 
+		case ICMP_UNREACH_NEEDFRAG:
+			{
+			register const struct mtu_discovery *mp;
+
+			mp = (struct mtu_discovery *)&dp->icmp_void;
+                        mtu = EXTRACT_16BITS(&mp->nexthopmtu);
+                        if (mtu)
+			    (void)sprintf(buf,
+				"%s unreachable - need to frag (mtu %d)",
+				ipaddr_string(&dp->icmp_ip.ip_dst), mtu);
+                        else
+			    (void)sprintf(buf,
+				"%s unreachable - need to frag",
+				ipaddr_string(&dp->icmp_ip.ip_dst));
+			}
+			break;
+
 		default:
 			fmt = tok2str(unreach2str, "#%d %%s unreachable",
 			    dp->icmp_code);
@@ -196,7 +254,7 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 		break;
 
 	case ICMP_REDIRECT:
-		TCHECK(dp->icmp_ip.ip_dst, sizeof(dp->icmp_ip.ip_dst));
+		TCHECK(dp->icmp_ip.ip_dst);
 		fmt = tok2str(type2str, "redirect-#%d %%s to net %%s",
 		    dp->icmp_code);
 		(void)sprintf(buf, fmt,
@@ -204,8 +262,54 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 		    ipaddr_string(&dp->icmp_gwaddr));
 		break;
 
+	case ICMP_ROUTERADVERT:
+		{
+		register const struct ih_rdiscovery *ihp;
+		register const struct id_rdiscovery *idp;
+		u_int lifetime, num, size;
+
+		(void)strcpy(buf, "router advertisement");
+		cp = buf + strlen(buf);
+
+		ihp = (struct ih_rdiscovery *)&dp->icmp_void;
+		TCHECK(*ihp);
+		(void)strcpy(cp, " lifetime ");
+		cp = buf + strlen(buf);
+		lifetime = EXTRACT_16BITS(&ihp->ird_lifetime);
+		if (lifetime < 60)
+			(void)sprintf(cp, "%u", lifetime);
+		else if (lifetime < 60 * 60)
+			(void)sprintf(cp, "%u:%02u",
+			    lifetime / 60, lifetime % 60);
+		else
+			(void)sprintf(cp, "%u:%02u:%02u",
+			    lifetime / 3600,
+			    (lifetime % 3600) / 60,
+			    lifetime % 60);
+		cp = buf + strlen(buf);
+
+		num = ihp->ird_addrnum;
+		(void)sprintf(cp, " %d:", num);
+		cp = buf + strlen(buf);
+
+		size = ihp->ird_addrsiz;
+		if (size != 2) {
+			(void)sprintf(cp, " [size %d]", size);
+			break;
+		}
+		idp = (struct id_rdiscovery *)&dp->icmp_data;
+		while (num-- > 0) {
+			TCHECK(*idp);
+			(void)sprintf(cp, " {%s %u}",
+			    ipaddr_string(&idp->ird_addr),
+			    EXTRACT_32BITS(&idp->ird_pref));
+			cp = buf + strlen(buf);
+		}
+		}
+		break;
+
 	case ICMP_TIMXCEED:
-		TCHECK(dp->icmp_ip.ip_dst, sizeof(dp->icmp_ip.ip_dst));
+		TCHECK(dp->icmp_ip.ip_dst);
 		switch (dp->icmp_code) {
 
 		case ICMP_TIMXCEED_INTRANS:
@@ -227,14 +331,14 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 			(void)sprintf(buf, "parameter problem - code %d",
 					dp->icmp_code);
 		else {
-			TCHECK(dp->icmp_pptr, sizeof(dp->icmp_pptr));
+			TCHECK(dp->icmp_pptr);
 			(void)sprintf(buf, "parameter problem - octet %d",
 					dp->icmp_pptr);
 		}
 		break;
 
 	case ICMP_MASKREPLY:
-		TCHECK(dp->icmp_mask, sizeof(dp->icmp_mask));
+		TCHECK(dp->icmp_mask);
 		(void)sprintf(buf, "address mask is 0x%08x",
 		    (u_int32_t)ntohl(dp->icmp_mask));
 		break;
@@ -247,5 +351,4 @@ icmp_print(register const u_char *bp, register const u_char *bp2)
 	return;
 trunc:
 	fputs("[|icmp]", stdout);
-#undef TCHECK
 }
diff --git a/usr.sbin/tcpdump/print-igrp.c b/usr.sbin/tcpdump/print-igrp.c
new file mode 100644
index 00000000000..6ef84e38f0e
--- /dev/null
+++ b/usr.sbin/tcpdump/print-igrp.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 1996
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * Initial contribution from Francis Dupont (francis.dupont@inria.fr)
+ */
+
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-igrp.c,v 1.1 1996/12/12 16:22:36 bitblt Exp $ (LBL)";
+#endif
+
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/udp.h>
+#include <netinet/udp_var.h>
+
+#include <errno.h>
+#include <stdio.h>
+
+#include "addrtoname.h"
+#include "interface.h"
+#include "igrp.h"
+#include "extract.h"			/* must come after interface.h */
+
+static void
+igrp_entry_print(register struct igrprte *igr, register int is_interior,
+    register int is_exterior)
+{
+	register u_int delay, bandwidth;
+	u_int metric, mtu;
+
+	if (is_interior)
+		printf(" *.%d.%d.%d", igr->igr_net[0],
+		    igr->igr_net[1], igr->igr_net[2]);
+	else if (is_exterior)
+		printf(" X%d.%d.%d.0", igr->igr_net[0],
+		    igr->igr_net[1], igr->igr_net[2]);
+	else
+		printf(" %d.%d.%d.0", igr->igr_net[0],
+		    igr->igr_net[1], igr->igr_net[2]);
+
+	delay = EXTRACT_24BITS(igr->igr_dly);
+	bandwidth = EXTRACT_24BITS(igr->igr_bw);
+	metric = bandwidth + delay;
+	if (metric > 0xffffff)
+		metric = 0xffffff;
+	mtu = EXTRACT_16BITS(igr->igr_mtu);
+
+	printf(" d=%d b=%d r=%d l=%d M=%d mtu=%d in %d hops",
+	    10 * delay, bandwidth == 0 ? 0 : 10000000 / bandwidth,
+	    igr->igr_rel, igr->igr_ld, metric,
+	    mtu, igr->igr_hct);
+}
+
+static struct tok op2str[] = {
+	{ IGRP_UPDATE,		"update" },
+	{ IGRP_REQUEST,		"request" },
+	{ 0,			NULL }
+};
+
+void
+igrp_print(register const u_char *bp, u_int length, register const u_char *bp2)
+{
+	register struct igrphdr *hdr;
+	register struct ip *ip;
+	register u_char *cp;
+	u_int nint, nsys, next;
+
+	hdr = (struct igrphdr *)bp;
+	ip = (struct ip *)bp2;
+	cp = (u_char *)(hdr + 1);
+        (void)printf("%s > %s: igrp: ",
+	    ipaddr_string(&ip->ip_src),
+	    ipaddr_string(&ip->ip_dst));
+
+	/* Header */
+	TCHECK(*hdr);
+	nint = EXTRACT_16BITS(&hdr->ig_ni);
+	nsys = EXTRACT_16BITS(&hdr->ig_ns);
+	next = EXTRACT_16BITS(&hdr->ig_nx);
+
+	(void)printf(" %s V%d edit=%d AS=%d (%d/%d/%d)",
+	    tok2str(op2str, "op-#%d", hdr->ig_op),
+	    hdr->ig_v,
+	    hdr->ig_ed,
+	    EXTRACT_16BITS(&hdr->ig_as),
+	    nint,
+	    nsys,
+	    next);
+
+	length -= sizeof(*hdr);
+	while (length >= IGRP_RTE_SIZE) {
+		if (nint > 0) {
+			TCHECK2(*cp, IGRP_RTE_SIZE);
+			igrp_entry_print((struct igrprte *)cp, 1, 0);
+			--nint;
+		} else if (nsys > 0) {
+			TCHECK2(*cp, IGRP_RTE_SIZE);
+			igrp_entry_print((struct igrprte *)cp, 0, 0);
+			--nsys;
+		} else if (next > 0) {
+			TCHECK2(*cp, IGRP_RTE_SIZE);
+			igrp_entry_print((struct igrprte *)cp, 0, 1);
+			--next;
+		} else {
+			(void)printf("[extra bytes %d]", length);
+			break;
+		}
+		cp += IGRP_RTE_SIZE;
+		length -= IGRP_RTE_SIZE;
+	}
+	if (nint == 0 && nsys == 0 && next == 0)
+		return;
+trunc:
+	fputs("[|igrp]", stdout);
+}
diff --git a/usr.sbin/tcpdump/print-ip.c b/usr.sbin/tcpdump/print-ip.c
index 8668e0d01a7..838d4cb1560 100644
--- a/usr.sbin/tcpdump/print-ip.c
+++ b/usr.sbin/tcpdump/print-ip.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ip.c,v 1.4 1996/07/13 11:01:23 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-ip.c,v 1.49 96/06/20 22:01:23 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ip.c,v 1.5 1996/12/12 16:22:35 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -45,8 +42,9 @@ static char rcsid[] =
 #include <string.h>
 #include <unistd.h>
 
-#include "interface.h"
 #include "addrtoname.h"
+#include "interface.h"
+#include "extract.h"			/* must come after interface.h */
 
 /* Compatibility */
 #ifndef	IPPROTO_ND
@@ -63,20 +61,20 @@ static char rcsid[] =
  * The packet format for a traceroute request.
  */
 struct tr_query {
-    u_int  tr_src;		/* traceroute source */
-    u_int  tr_dst;		/* traceroute destination */
-    u_int  tr_raddr;		/* traceroute response address */
-#if defined(BYTE_ORDER) && (BYTE_ORDER == LITTLE_ENDIAN)
-    struct {
-	u_int	qid : 24;	/* traceroute query id */
-	u_int	ttl : 8;	/* traceroute response ttl */
-    } q;
+	u_int  tr_src;			/* traceroute source */
+	u_int  tr_dst;			/* traceroute destination */
+	u_int  tr_raddr;		/* traceroute response address */
+#ifdef WORDS_BIGENDIAN
+	struct {
+		u_int   ttl : 8;	/* traceroute response ttl */
+		u_int   qid : 24;	/* traceroute query id */
+	} q;
 #else
-    struct {
-	u_int   ttl : 8;	/* traceroute response ttl */
-	u_int   qid : 24;	/* traceroute query id */
-    } q;
-#endif /* BYTE_ORDER */
+	struct {
+		u_int	qid : 24;	/* traceroute query id */
+		u_int	ttl : 8;	/* traceroute response ttl */
+	} q;
+#endif
 };
 
 #define tr_rttl q.ttl
@@ -87,17 +85,17 @@ struct tr_query {
  * beginning, followed by one tr_resp for each hop taken.
  */
 struct tr_resp {
-    u_int tr_qarr;		/* query arrival time */
-    u_int tr_inaddr;		/* incoming interface address */
-    u_int tr_outaddr;		/* outgoing interface address */
-    u_int tr_rmtaddr;		/* parent address in source tree */
-    u_int tr_vifin;		/* input packet count on interface */
-    u_int tr_vifout;		/* output packet count on interface */
-    u_int tr_pktcnt;		/* total incoming packets for src-grp */
-    u_char  tr_rproto;		/* routing protocol deployed on router */
-    u_char  tr_fttl;		/* ttl required to forward on outvif */
-    u_char  tr_smask;		/* subnet mask for src addr */
-    u_char  tr_rflags;		/* forwarding error codes */
+	u_int tr_qarr;			/* query arrival time */
+	u_int tr_inaddr;		/* incoming interface address */
+	u_int tr_outaddr;		/* outgoing interface address */
+	u_int tr_rmtaddr;		/* parent address in source tree */
+	u_int tr_vifin;			/* input packet count on interface */
+	u_int tr_vifout;		/* output packet count on interface */
+	u_int tr_pktcnt;		/* total incoming packets for src-grp */
+	u_char  tr_rproto;		/* routing proto deployed on router */
+	u_char  tr_fttl;		/* ttl required to forward on outvif */
+	u_char  tr_smask;		/* subnet mask for src addr */
+	u_char  tr_rflags;		/* forwarding error codes */
 };
 
 /* defs within mtrace */
@@ -121,9 +119,9 @@ struct tr_resp {
 #define TR_PROTO_PIM	3
 #define TR_PROTO_CBT	4
 
-static void print_mtrace(register const u_char *bp, register int len)
+static void print_mtrace(register const u_char *bp, register u_int len)
 {
-	register struct tr_query* tr = (struct tr_query*)(bp + 8);
+	register struct tr_query *tr = (struct tr_query *)(bp + 8);
 
 	printf("mtrace %d: %s to %s reply-to %s", tr->tr_qid,
 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
@@ -132,9 +130,9 @@ static void print_mtrace(register const u_char *bp, register int len)
 		printf(" with-ttl %d", tr->tr_rttl);
 }
 
-static void print_mresp(register const u_char *bp, register int len)
+static void print_mresp(register const u_char *bp, register u_int len)
 {
-	register struct tr_query* tr = (struct tr_query*)(bp + 8);
+	register struct tr_query *tr = (struct tr_query *)(bp + 8);
 
 	printf("mresp %d: %s to %s reply-to %s", tr->tr_qid,
 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
@@ -144,22 +142,17 @@ static void print_mresp(register const u_char *bp, register int len)
 }
 
 static void
-igmp_print(register const u_char *bp, register int len,
+igmp_print(register const u_char *bp, register u_int len,
 	   register const u_char *bp2)
 {
 	register const struct ip *ip;
-	register const u_char *ep;
 
 	ip = (const struct ip *)bp2;
-	ep = (const u_char *)snapend;
         (void)printf("%s > %s: ",
 		ipaddr_string(&ip->ip_src),
 		ipaddr_string(&ip->ip_dst));
 
-	if (bp + 7 > ep) {
-		(void)printf("[|igmp]");
-		return;
-	}
+	TCHECK2(bp[0], 8);
 	switch (bp[0]) {
 	case 0x11:
 		(void)printf("igmp query");
@@ -202,16 +195,37 @@ igmp_print(register const u_char *bp, register int len,
 	}
 	if ((bp[0] >> 4) != 1)
 		(void)printf(" [v%d]", bp[0] >> 4);
+
+	TCHECK2(bp[0], len);
+	if (vflag) {
+		/* Check the IGMP checksum */
+		u_int32_t sum = 0;
+		int count;
+		const u_short *sp = (u_short *)bp;
+		
+		for (count = len / 2; --count >= 0; )
+			sum += *sp++;
+		if (len & 1)
+			sum += ntohs(*(u_char *) sp << 8);
+		while (sum >> 16)
+			sum = (sum & 0xffff) + (sum >> 16);
+		sum = 0xffff & ~sum;
+		if (sum != 0)
+			printf(" bad igmp cksum %x!", EXTRACT_16BITS(&bp[2]));
+	}
+	return;
+trunc:
+	fputs("[|igmp]", stdout);
 }
 
 /*
  * print the recorded route in an IP RR, LSRR or SSRR option.
  */
 static void
-ip_printroute(const char *type, register const u_char *cp, int length)
+ip_printroute(const char *type, register const u_char *cp, u_int length)
 {
-	int ptr = cp[2] - 1;
-	int len;
+	register u_int ptr = cp[2] - 1;
+	register u_int len;
 
 	printf(" %s{", type);
 	if ((length + 1) & 3)
@@ -223,15 +237,7 @@ ip_printroute(const char *type, register const u_char *cp, int length)
 	for (len = 3; len < length; len += 4) {
 		if (ptr == len)
 			type = "#";
-#ifdef TCPDUMP_ALIGN
-		{
-		struct in_addr addr;
-		memcpy((char *)&addr, (char *)&cp[len], sizeof(addr));
-		printf("%s%s", type, ipaddr_string(&addr));
-		}
-#else
 		printf("%s%s", type, ipaddr_string(&cp[len]));
-#endif
 		type = " ";
 	}
 	printf("%s}", ptr == len? "#" : "");
@@ -241,9 +247,9 @@ ip_printroute(const char *type, register const u_char *cp, int length)
  * print IP options.
  */
 static void
-ip_optprint(register const u_char *cp, int length)
+ip_optprint(register const u_char *cp, u_int length)
 {
-	int len;
+	register u_int len;
 
 	for (; length > 0; cp += len, length -= len) {
 		int tt = *cp;
@@ -324,23 +330,22 @@ in_cksum(const struct ip *ip)
  * print an IP datagram.
  */
 void
-ip_print(register const u_char *bp, register int length)
+ip_print(register const u_char *bp, register u_int length)
 {
 	register const struct ip *ip;
-	register int hlen;
-	register int len;
-	register int off;
+	register u_int hlen, len, off;
 	register const u_char *cp;
 
 	ip = (const struct ip *)bp;
-#ifdef TCPDUMP_ALIGN
+#ifdef LBL_ALIGN
 	/*
-	 * The IP header is not word aligned, so copy into abuf.
+	 * If the IP header is not aligned, copy into abuf.
 	 * This will never happen with BPF.  It does happen raw packet
 	 * dumps from -r.
 	 */
-	if ((long)ip & (sizeof(long)-1)) {
+	if ((long)ip & 3) {
 		static u_char *abuf = NULL;
+		static int didwarn = 0;
 
 		if (abuf == NULL) {
 			abuf = (u_char *)malloc(snaplen);
@@ -351,6 +356,11 @@ ip_print(register const u_char *bp, register int length)
 		snapend += abuf - (u_char *)ip;
 		packetp = abuf;
 		ip = (struct ip *)abuf;
+		/* We really want libpcap to give us aligned packets */
+		if (!didwarn) {
+			warning("compensating for unaligned libpcap packets");
+			++didwarn;
+		}
 	}
 #endif
 	if ((u_char *)(ip + 1) > snapend) {
@@ -381,32 +391,46 @@ ip_print(register const u_char *bp, register int length)
 		case IPPROTO_TCP:
 			tcp_print(cp, len, (const u_char *)ip);
 			break;
+
 		case IPPROTO_UDP:
 			udp_print(cp, len, (const u_char *)ip);
 			break;
+
 		case IPPROTO_ICMP:
 			icmp_print(cp, (const u_char *)ip);
 			break;
+
+#ifndef IPPROTO_IGRP
+#define IPPROTO_IGRP 9
+#endif
+		case IPPROTO_IGRP:
+			igrp_print(cp, len, (const u_char *)ip);
+			break;
+
 		case IPPROTO_ND:
 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
 				ipaddr_string(&ip->ip_dst));
 			(void)printf(" nd %d", len);
 			break;
+
 		case IPPROTO_EGP:
 			egp_print(cp, len, (const u_char *)ip);
 			break;
+
 #ifndef IPPROTO_OSPF
 #define IPPROTO_OSPF 89
 #endif
 		case IPPROTO_OSPF:
 			ospf_print(cp, len, (const u_char *)ip);
 			break;
+
 #ifndef IPPROTO_IGMP
 #define IPPROTO_IGMP 2
 #endif
 		case IPPROTO_IGMP:
 			igmp_print(cp, len, (const u_char *)ip);
 			break;
+
 #ifndef IPPROTO_ENCAP
 #define IPPROTO_ENCAP 4
 #endif
@@ -422,6 +446,23 @@ ip_print(register const u_char *bp, register int length)
 				return;
 			}
 			break;
+
+#ifndef IPPROTO_GRE
+#define IPPROTO_GRE 47
+#endif
+		case IPPROTO_GRE:
+			if (vflag)
+				(void)printf("gre %s > %s: ",
+					     ipaddr_string(&ip->ip_src),
+					     ipaddr_string(&ip->ip_dst));
+			/* do it */
+			gre_print(cp, len);
+			if (! vflag) {
+				printf(" (gre encap)");
+				return;
+  			}
+  			break;
+
 		default:
 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
 				ipaddr_string(&ip->ip_dst));
diff --git a/usr.sbin/tcpdump/print-ipx.c b/usr.sbin/tcpdump/print-ipx.c
index 2f9728ae429..ff1eca43e19 100644
--- a/usr.sbin/tcpdump/print-ipx.c
+++ b/usr.sbin/tcpdump/print-ipx.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ipx.c,v 1.4 1996/07/13 11:01:24 mickey Exp $	*/
-
 /*
  * Copyright (c) 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -19,20 +17,18 @@
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-/*
+ *
  * Format and print Novell IPX packets.
  * Contributed by Brad Parker (brad@fcr.com).
  */
+
 #ifndef lint
-static  char rcsid[] =
-    "@(#)Header: print-ipx.c,v 1.10 96/05/16 12:46:02 leres Exp";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ipx.c,v 1.5 1996/12/12 16:22:35 bitblt Exp $";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -56,40 +52,36 @@ static  char rcsid[] =
 #include "extract.h"
 
 
-static const char *ipxaddr_string(u_int32_t net, const u_char *node);
-void ipx_decode(const struct ipxHdr *ipx, const u_char *datap, int length);
-void ipx_sap_print(const u_short *ipx, int length);
-void ipx_rip_print(const u_short *ipx, int length);
+static const char *ipxaddr_string(u_int32_t, const u_char *);
+void ipx_decode(const struct ipxHdr *, const u_char *, u_int);
+void ipx_sap_print(const u_short *, u_int);
+void ipx_rip_print(const u_short *, u_int);
 
 /*
  * Print IPX datagram packets.
  */
 void
-ipx_print(const u_char *p, int length)
+ipx_print(const u_char *p, u_int length)
 {
 	const struct ipxHdr *ipx = (const struct ipxHdr *)p;
 
-	if (length < ipxSize) {
-		(void)printf(" truncated-ipx %d", length);
-		return;
-	}
+	TCHECK(ipx->srcSkt);
 	(void)printf("%s.%x > ",
-		     ipxaddr_string(EXTRACT_LONG(ipx->srcNet), ipx->srcNode),
-		     EXTRACT_SHORT(&ipx->srcSkt));
+		     ipxaddr_string(EXTRACT_32BITS(ipx->srcNet), ipx->srcNode),
+		     EXTRACT_16BITS(&ipx->srcSkt));
 
 	(void)printf("%s.%x:",
-		     ipxaddr_string(EXTRACT_LONG(ipx->dstNet), ipx->dstNode),
-		     EXTRACT_SHORT(&ipx->dstSkt));
-
-	if ((u_char *)(ipx + 1) > snapend) {
-		printf(" [|ipx]");
-		return;
-	}
+		     ipxaddr_string(EXTRACT_32BITS(ipx->dstNet), ipx->dstNode),
+		     EXTRACT_16BITS(&ipx->dstSkt));
 
 	/* take length from ipx header */
-	length = EXTRACT_SHORT(&ipx->length);
+	TCHECK(ipx->length);
+	length = EXTRACT_16BITS(&ipx->length);
 
 	ipx_decode(ipx, (u_char *)ipx + ipxSize, length - ipxSize);
+	return;
+trunc:
+	printf("[|ipx %d]", length);
 }
 
 static const char *
@@ -97,18 +89,18 @@ ipxaddr_string(u_int32_t net, const u_char *node)
 {
     static char line[256];
 
-    sprintf(line, "%u.%02x:%02x:%02x:%02x:%02x:%02x",
+    sprintf(line, "%x.%02x:%02x:%02x:%02x:%02x:%02x",
 	    net, node[0], node[1], node[2], node[3], node[4], node[5]);
 
     return line;
 }
 
 void
-ipx_decode(const struct ipxHdr *ipx, const u_char *datap, int length)
+ipx_decode(const struct ipxHdr *ipx, const u_char *datap, u_int length)
 {
     register u_short dstSkt;
 
-    dstSkt = EXTRACT_SHORT(&ipx->dstSkt);
+    dstSkt = EXTRACT_16BITS(&ipx->dstSkt);
     switch (dstSkt) {
       case IPX_SKT_NCP:
 	(void)printf(" ipx-ncp %d", length);
@@ -132,16 +124,12 @@ ipx_decode(const struct ipxHdr *ipx, const u_char *datap, int length)
 }
 
 void
-ipx_sap_print(const u_short *ipx, int length)
+ipx_sap_print(const u_short *ipx, u_int length)
 {
     int command, i;
 
-    if (length < 2) {
-	(void)printf(" truncated-sap %d", length);
-	return;
-    }
-
-    command = EXTRACT_SHORT(ipx);
+    TCHECK(ipx[0]);
+    command = EXTRACT_16BITS(ipx);
     ipx++;
     length -= 2;
 
@@ -153,9 +141,12 @@ ipx_sap_print(const u_short *ipx, int length)
 	else
 	    (void)printf("ipx-sap-nearest-req");
 
-	if (length > 0)
-	    (void)printf(" %x '%.48s'", EXTRACT_SHORT(&ipx[0]),
-			 (char*)&ipx[1]);
+	if (length > 0) {
+	    TCHECK(ipx[1]);
+	    (void)printf(" %x '", EXTRACT_16BITS(&ipx[0]));
+	    fn_print((u_char *)&ipx[1], (u_char *)&ipx[1] + 48);
+	    putchar('\'');
+	}
 	break;
 
       case 2:
@@ -166,10 +157,11 @@ ipx_sap_print(const u_short *ipx, int length)
 	    (void)printf("ipx-sap-nearest-resp");
 
 	for (i = 0; i < 8 && length > 0; i++) {
-	    (void)printf(" %x '%.48s' addr %s",
-			 EXTRACT_SHORT(&ipx[0]), (char *)&ipx[1],
-			 ipxaddr_string(EXTRACT_LONG(&ipx[25]),
-					(u_char *)&ipx[27]));
+	    TCHECK2(ipx[27], 1);
+	    (void)printf(" %x '", EXTRACT_16BITS(&ipx[0]));
+	    fn_print((u_char *)&ipx[1], (u_char *)&ipx[1] + 48);
+	    printf("' addr %s",
+		ipxaddr_string(EXTRACT_32BITS(&ipx[25]), (u_char *)&ipx[27]));
 	    ipx += 32;
 	    length -= 64;
 	}
@@ -178,34 +170,36 @@ ipx_sap_print(const u_short *ipx, int length)
 	    (void)printf("ipx-sap-?%x", command);
 	break;
     }
+	return;
+trunc:
+	printf("[|ipx %d]", length);
 }
 
 void
-ipx_rip_print(const u_short *ipx, int length)
+ipx_rip_print(const u_short *ipx, u_int length)
 {
     int command, i;
 
-    if (length < 2) {
-	(void)printf(" truncated-ipx %d", length);
-	return;
-    }
-
-    command = EXTRACT_SHORT(ipx);
+    TCHECK(ipx[0]);
+    command = EXTRACT_16BITS(ipx);
     ipx++;
     length -= 2;
 
     switch (command) {
       case 1:
 	(void)printf("ipx-rip-req");
-	if (length > 0)
-	    (void)printf(" %u/%d.%d", EXTRACT_LONG(&ipx[0]),
-			 EXTRACT_SHORT(&ipx[2]), EXTRACT_SHORT(&ipx[3]));
+	if (length > 0) {
+	    TCHECK(ipx[3]);
+	    (void)printf(" %u/%d.%d", EXTRACT_32BITS(&ipx[0]),
+			 EXTRACT_16BITS(&ipx[2]), EXTRACT_16BITS(&ipx[3]));
+	}
 	break;
       case 2:
 	(void)printf("ipx-rip-resp");
 	for (i = 0; i < 50 && length > 0; i++) {
-	    (void)printf(" %u/%d.%d", EXTRACT_LONG(&ipx[0]),
-			 EXTRACT_SHORT(&ipx[2]), EXTRACT_SHORT(&ipx[3]));
+	    TCHECK(ipx[3]);
+	    (void)printf(" %u/%d.%d", EXTRACT_32BITS(&ipx[0]),
+			 EXTRACT_16BITS(&ipx[2]), EXTRACT_16BITS(&ipx[3]));
 
 	    ipx += 4;
 	    length -= 8;
@@ -214,5 +208,8 @@ ipx_rip_print(const u_short *ipx, int length)
       default:
 	    (void)printf("ipx-rip-?%x", command);
     }
+	return;
+trunc:
+	printf("[|ipx %d]", length);
 }
 
diff --git a/usr.sbin/tcpdump/print-isoclns.c b/usr.sbin/tcpdump/print-isoclns.c
index 7da20c48109..e6e7ea91105 100644
--- a/usr.sbin/tcpdump/print-isoclns.c
+++ b/usr.sbin/tcpdump/print-isoclns.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-isoclns.c,v 1.4 1996/07/13 11:01:24 mickey Exp $	*/
-
 /*
- * Copyright (c) 1992, 1993, 1994, 1995
+ * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -19,15 +17,13 @@
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-/*
+ *
  * Original code by Matt Thomas, Digital Equipment Corporation
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-isoclns.c,v 1.11 95/10/19 20:27:45 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-isoclns.c,v 1.5 1996/12/12 16:22:34 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/types.h>
@@ -54,11 +50,11 @@ struct rtentry;
 #define	ISIS	131
 #define	NULLNS	0
 
-static int osi_cksum(const u_char *, int, const u_char *, u_char *, u_char *);
-static void esis_print(const u_char *, int);
+static int osi_cksum(const u_char *, u_int, const u_char *, u_char *, u_char *);
+static void esis_print(const u_char *, u_int);
 
 void
-isoclns_print(const u_char *p, int length, int caplen,
+isoclns_print(const u_char *p, u_int length, u_int caplen,
 	      const u_char *esrc, const u_char *edst)
 {
 	if (caplen < 1) {
@@ -136,7 +132,7 @@ struct esis_hdr {
 };
 
 static void
-esis_print(const u_char *p, int length)
+esis_print(const u_char *p, u_int length)
 {
 	const u_char *ep;
 	int li = p[1];
@@ -287,7 +283,7 @@ esis_print(const u_char *p, int length)
 }
 
 static int
-osi_cksum(register const u_char *p, register int len,
+osi_cksum(register const u_char *p, register u_int len,
 	  const u_char *toff, u_char *cksum, u_char *off)
 {
 	int x, y, f = (len - ((toff - p) + 1));
diff --git a/usr.sbin/tcpdump/print-krb.c b/usr.sbin/tcpdump/print-krb.c
index 299013acc98..db42edeb637 100644
--- a/usr.sbin/tcpdump/print-krb.c
+++ b/usr.sbin/tcpdump/print-krb.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-krb.c,v 1.1 1996/07/13 11:01:25 mickey Exp $	*/
-
 /*
- * Copyright (c) 1995
+ * Copyright (c) 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -24,13 +22,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-krb.c,v 1.3 95/10/08 15:15:17 leres Exp";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-krb.c,v 1.2 1996/12/12 16:22:33 bitblt Exp $";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -47,10 +44,10 @@ static char rcsid[] =
 #include "interface.h"
 #include "addrtoname.h"
 
-const u_char *c_print(register const u_char *s, register const u_char *ep);
-const u_char *krb4_print_hdr(const u_char *cp);
-void krb4_print(const u_char *cp);
-void krb_print(const u_char *dat, int length);
+const u_char *c_print(register const u_char *, register const u_char *);
+const u_char *krb4_print_hdr(const u_char *);
+void krb4_print(const u_char *);
+void krb_print(const u_char *, u_int);
 
 
 #define AUTH_MSG_KDC_REQUEST			1<<1
@@ -113,19 +110,19 @@ static struct tok kerr2str[] = {
 
 /* little endian (unaligned) to host byte order */
 /* XXX need to look at this... */
-#define vtohlp(x)	    ((( ((char*)(x))[0] )      )  | \
-			     (( ((char*)(x))[1] ) <<  8)  | \
-			     (( ((char*)(x))[2] ) << 16)  | \
-			     (( ((char*)(x))[3] ) << 24))
-#define vtohsp(x)          ((( ((char*)(x))[0] )      )  | \
-			     (( ((char*)(x))[1] ) <<  8))
+#define vtohlp(x)	    ((( ((char *)(x))[0] )      )  | \
+			     (( ((char *)(x))[1] ) <<  8)  | \
+			     (( ((char *)(x))[2] ) << 16)  | \
+			     (( ((char *)(x))[3] ) << 24))
+#define vtohsp(x)          ((( ((char *)(x))[0] )      )  | \
+			     (( ((char *)(x))[1] ) <<  8))
 /* network (big endian) (unaligned) to host byte order */
-#define ntohlp(x)	    ((( ((char*)(x))[3] )      )  | \
-			     (( ((char*)(x))[2] ) <<  8)  | \
-			     (( ((char*)(x))[1] ) << 16)  | \
-			     (( ((char*)(x))[0] ) << 24))
-#define ntohsp(x)          ((( ((char*)(x))[1] )      )  | \
-			     (( ((char*)(x))[0] ) <<  8))
+#define ntohlp(x)	    ((( ((char *)(x))[3] )      )  | \
+			     (( ((char *)(x))[2] ) <<  8)  | \
+			     (( ((char *)(x))[1] ) << 16)  | \
+			     (( ((char *)(x))[0] ) << 24))
+#define ntohsp(x)          ((( ((char *)(x))[1] )      )  | \
+			     (( ((char *)(x))[0] ) <<  8))
 
 
 
@@ -163,14 +160,13 @@ krb4_print_hdr(const u_char *cp)
 {
 	cp+=2;
 
-#define TCHECK		if (cp >= snapend)  goto trunc
 #define PRINT		if ((cp=c_print(cp, snapend))==NULL) goto trunc
 
-	TCHECK;
+	TCHECK2(cp, 0);
 	PRINT;
-	TCHECK;
+	TCHECK2(cp, 0);
 	putchar('.'); PRINT;
-	TCHECK;
+	TCHECK2(cp, 0);
 	putchar('@'); PRINT;
 	return(cp);
 
@@ -178,7 +174,6 @@ trunc:
 	fputs(tstr, stdout);
 	return(NULL);
 
-#undef TCHECK
 #undef PRINT
 }
 
@@ -189,7 +184,6 @@ krb4_print(const u_char *cp)
 	u_char type;
 	u_short len;
 
-#define TCHECK		if (cp >= snapend) goto trunc
 #define PRINT		if ((cp=c_print(cp, snapend))==NULL) goto trunc
 /*  True if struct krb is little endian */
 #define IS_LENDIAN(kp)	(((kp)->type & 0x01) != 0)
@@ -213,45 +207,45 @@ krb4_print(const u_char *cp)
 		if ((cp = krb4_print_hdr(cp)) == NULL)
 			return;
 		 cp += 4; 	  /* ctime */
-		 TCHECK;
+		 TCHECK2(cp, 0);
 		 printf(" %dmin ", *cp++ * 5);
-		 TCHECK;
+		 TCHECK2(cp, 0);
 		 PRINT;
-		 TCHECK;
+		 TCHECK2(cp, 0);
 		 putchar('.');  PRINT;
 		 break;
 
 	case AUTH_MSG_APPL_REQUEST:
 		cp += 2;
-		TCHECK;
+		TCHECK2(cp, 0);
 		printf("v%d ", *cp++);
-		TCHECK;
+		TCHECK2(cp, 0);
 		PRINT;
-		TCHECK;
+		TCHECK2(cp, 0);
 		printf(" (%d)", *cp++);
-		TCHECK;
+		TCHECK2(cp, 0);
 		printf(" (%d)", *cp);
-		TCHECK;
+		TCHECK2(cp, 0);
 		break;
 
 	case AUTH_MSG_KDC_REPLY:
 		if ((cp = krb4_print_hdr(cp)) == NULL)
 			return;
 		cp += 10;	/* timestamp + n + exp + kvno */
-		TCHECK;
+		TCHECK2(cp, 0);
 		len = KTOHSP(kp, cp);
 		printf(" (%d)", len);
-		TCHECK;
+		TCHECK2(cp, 0);
 		break;
 
 	case AUTH_MSG_ERR_REPLY:
 		if ((cp = krb4_print_hdr(cp)) == NULL)
 			return;
 		cp += 4; 	  /* timestamp */
-		TCHECK;
+		TCHECK2(cp, 0);
 		printf(" %s ", tok2str(kerr2str, NULL, KTOHSP(kp, cp)));
 		cp += 4;
-		TCHECK;
+		TCHECK2(cp, 0);
 		PRINT;
 		break;
 
@@ -263,11 +257,10 @@ krb4_print(const u_char *cp)
 	return;
 trunc:
 	fputs(tstr, stdout);
-#undef TCHECK
 }
 
 void
-krb_print(const u_char *dat, int length)
+krb_print(const u_char *dat, u_int length)
 {
 	register const struct krb *kp;
 
@@ -288,7 +281,7 @@ krb_print(const u_char *dat, int length)
 
 	case 4:
 		printf(" v%d", kp->pvno);
-		krb4_print((const u_char*)kp);
+		krb4_print((const u_char *)kp);
 		break;
 
 	case 106:
diff --git a/usr.sbin/tcpdump/print-llc.c b/usr.sbin/tcpdump/print-llc.c
index 3aca65d0f30..19282e8b015 100644
--- a/usr.sbin/tcpdump/print-llc.c
+++ b/usr.sbin/tcpdump/print-llc.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-llc.c,v 1.4 1996/07/13 11:01:25 mickey Exp $	*/
-
 /*
- * Copyright (c) 1992, 1993, 1994, 1995
+ * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -19,21 +17,18 @@
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-/*
+ *
  * Code by Matt Thomas, Digital Equipment Corporation
  *	with an awful lot of hacking by Jeffrey Mogul, DECWRL
  */
 
 #ifndef lint
-static  char rcsid[] =
-	"@(#)Header: print-llc.c,v 1.17 95/09/26 02:03:40 leres Exp";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-llc.c,v 1.5 1996/12/12 16:22:33 bitblt Exp $";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 
 #include <netinet/in.h>
 
@@ -65,7 +60,7 @@ static struct tok cmd2str[] = {
  * Returns non-zero IFF it succeeds in printing the header
  */
 int
-llc_print(const u_char *p, int length, int caplen,
+llc_print(const u_char *p, u_int length, u_int caplen,
 	  const u_char *esrc, const u_char *edst)
 {
 	struct llc llc;
@@ -110,7 +105,7 @@ llc_print(const u_char *p, int length, int caplen,
 		p += sizeof(llc);
 
 		/* This is an encapsulated Ethernet packet */
-		et = EXTRACT_SHORT(&llc.ethertype[0]);
+		et = EXTRACT_16BITS(&llc.ethertype[0]);
 		ret = ether_encap_print(et, p, length, caplen);
 		if (ret)
 			return (ret);
diff --git a/usr.sbin/tcpdump/print-netbios.c b/usr.sbin/tcpdump/print-netbios.c
index f384170c801..ec7f219e1bc 100644
--- a/usr.sbin/tcpdump/print-netbios.c
+++ b/usr.sbin/tcpdump/print-netbios.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-netbios.c,v 1.1 1996/11/12 07:54:55 mickey Exp $	*/
-
 /*
  * Copyright (c) 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -19,25 +17,19 @@
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- */
-
-/*
+ *
  * Format and print NETBIOS packets.
  * Contributed by Brad Parker (brad@fcr.com).
  */
-#ifndef lint
-static  char rcsid[] =
-    "@(#)Header: print-netbios.c,v 1.5 96/06/03 02:53:36 leres Exp";
-#endif
 
-#ifdef __STDC__
-#include <stdlib.h>
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-netbios.c,v 1.2 1996/12/12 16:22:32 bitblt Exp $";
 #endif
-#include <stdio.h>
 
 #include <sys/param.h>
-#include <sys/types.h>
 #include <sys/socket.h>
+
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
@@ -47,6 +39,10 @@ static  char rcsid[] =
 #include <netinet/tcp.h>
 #include <netinet/tcpip.h>
 
+#ifdef __STDC__
+#include <stdlib.h>
+#endif
+#include <stdio.h>
 #include <string.h>
 
 #include "interface.h"
@@ -58,10 +54,8 @@ static  char rcsid[] =
  * Print NETBIOS packets.
  */
 void
-netbios_print(const u_char *p, int length)
+netbios_print(struct p8022Hdr *nb, u_int length)
 {
-	struct p8022Hdr *nb = (struct p8022Hdr *)p;
-
 	if (length < p8022Size) {
 		(void)printf(" truncated-netbios %d", length);
 		return;
@@ -85,12 +79,12 @@ netbios_print(const u_char *p, int length)
 
 #ifdef never
 	(void)printf("%s.%d > ",
-		     ipxaddr_string(EXTRACT_LONG(ipx->srcNet), ipx->srcNode),
-		     EXTRACT_SHORT(ipx->srcSkt));
+		     ipxaddr_string(EXTRACT_32BITS(ipx->srcNet), ipx->srcNode),
+		     EXTRACT_16BITS(ipx->srcSkt));
 
 	(void)printf("%s.%d:",
-		     ipxaddr_string(EXTRACT_LONG(ipx->dstNet), ipx->dstNode),
-		     EXTRACT_SHORT(ipx->dstSkt));
+		     ipxaddr_string(EXTRACT_32BITS(ipx->dstNet), ipx->dstNode),
+		     EXTRACT_16BITS(ipx->dstSkt));
 
 	if ((u_char *)(ipx + 1) > snapend) {
 		printf(" [|ipx]");
@@ -98,7 +92,7 @@ netbios_print(const u_char *p, int length)
 	}
 
 	/* take length from ipx header */
-	length = EXTRACT_SHORT(&ipx->length);
+	length = EXTRACT_16BITS(&ipx->length);
 
 	ipx_decode(ipx, (u_char *)ipx + ipxSize, length - ipxSize);
 #endif
diff --git a/usr.sbin/tcpdump/print-nfs.c b/usr.sbin/tcpdump/print-nfs.c
index 3dd8deb2a7f..61447c11441 100644
--- a/usr.sbin/tcpdump/print-nfs.c
+++ b/usr.sbin/tcpdump/print-nfs.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-nfs.c,v 1.4 1996/07/13 11:01:26 mickey Exp $	*/
-
 /*
- * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995
+ * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-nfs.c,v 1.52 95/10/22 02:46:29 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-nfs.c,v 1.5 1996/12/12 16:22:32 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -59,16 +56,19 @@ struct rtentry;
 static void nfs_printfh(const u_int32_t *);
 static void xid_map_enter(const struct rpc_msg *, const struct ip *);
 static int32_t xid_map_find(const struct rpc_msg *, const struct ip *);
-static void interp_reply(const struct rpc_msg *, u_int32_t, int);
+static void interp_reply(const struct rpc_msg *, u_int32_t, u_int);
+
+static int nfserr;		/* true if we error rather than trunc */
 
 void
-nfsreply_print(register const u_char *bp, int length,
+nfsreply_print(register const u_char *bp, u_int length,
 	       register const u_char *bp2)
 {
 	register const struct rpc_msg *rp;
 	register const struct ip *ip;
 	int32_t proc;
 
+	nfserr = 0;		/* assume no error */
 	rp = (const struct rpc_msg *)bp;
 	ip = (const struct ip *)bp2;
 
@@ -100,31 +100,29 @@ nfsreply_print(register const u_char *bp, int length,
  * If the packet was truncated, return 0.
  */
 static const u_int32_t *
-parsereq(register const struct rpc_msg *rp, register int length)
+parsereq(register const struct rpc_msg *rp, register u_int length)
 {
-	register const u_int32_t *dp = (u_int32_t *)&rp->rm_call.cb_cred;
-	register const u_int32_t *ep = (u_int32_t *)snapend;
+	register const u_int32_t *dp;
 	register u_int len;
 
-	if (&dp[2] >= ep)
-		return (0);
 	/*
 	 * find the start of the req data (if we captured it)
 	 */
-	len =  ntohl(dp[1]);
-	if (dp < ep && len < length) {
-		dp += (len + (2 * sizeof(u_int32_t) + 3)) / sizeof(u_int32_t);
-		if (&dp[2] < ep) {
-			len = ntohl(dp[1]);
-			if (dp < ep && len < length) {
-				dp += (len + (2 * sizeof(u_int32_t) + 3)) /
-					sizeof(u_int32_t);
-				if (dp < ep)
-					return (dp);
-			}
+	dp = (u_int32_t *)&rp->rm_call.cb_cred;
+	TCHECK(dp[1]);
+	len = ntohl(dp[1]);
+	if (len < length) {
+		dp += (len + (2 * sizeof(*dp) + 3)) / sizeof(*dp);
+		TCHECK(dp[1]);
+		len = ntohl(dp[1]);
+		if (len < length) {
+			dp += (len + (2 * sizeof(*dp) + 3)) / sizeof(*dp);
+			TCHECK2(dp[0], 0);
+			return (dp);
 		}
 	}
-	return (0);
+trunc:
+	return (NULL);
 }
 
 /*
@@ -138,7 +136,7 @@ parsefh(register const u_int32_t *dp)
 		nfs_printfh(dp);
 		return (dp + 8);
 	}
-	return (0);
+	return (NULL);
 }
 
 /*
@@ -153,7 +151,7 @@ parsefn(register const u_int32_t *dp)
 
 	/* Bail if we don't have the string length */
 	if ((u_char *)dp > snapend - sizeof(*dp))
-		return(0);
+		return (NULL);
 
 	/* Fetch string length; convert to host order */
 	len = *dp++;
@@ -163,9 +161,11 @@ parsefn(register const u_int32_t *dp)
 	/* Update 32-bit pointer (NFS filenames padded to 32-bit boundaries) */
 	dp += ((len + 3) & ~3) / sizeof(*dp);
 	if ((u_char *)dp > snapend)
-		return (0);
+		return (NULL);
 	/* XXX seems like we should be checking the length */
+	putchar('"');
 	(void) fn_printn(cp, len, NULL);
+	putchar('"');
 
 	return (dp);
 }
@@ -179,25 +179,23 @@ static const u_int32_t *
 parsefhn(register const u_int32_t *dp)
 {
 	dp = parsefh(dp);
-	if (dp == 0)
-		return (0);
+	if (dp == NULL)
+		return (NULL);
 	putchar(' ');
 	return (parsefn(dp));
 }
 
 void
-nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
+nfsreq_print(register const u_char *bp, u_int length,
+    register const u_char *bp2)
 {
 	register const struct rpc_msg *rp;
 	register const struct ip *ip;
 	register const u_int32_t *dp;
-	register const u_char *ep;
-
-#define TCHECK(p, l) if ((u_char *)(p) > ep - l) break
 
+	nfserr = 0;		/* assume no error */
 	rp = (const struct rpc_msg *)bp;
 	ip = (const struct ip *)bp2;
-	ep = snapend;
 	if (!nflag)
 		(void)printf("%s.%x > %s.nfs: %d",
 			     ipaddr_string(&ip->ip_src),
@@ -228,13 +226,13 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 
 	case NFSPROC_GETATTR:
 		printf(" getattr");
-		if ((dp = parsereq(rp, length)) != 0 && parsefh(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefh(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_SETATTR:
 		printf(" setattr");
-		if ((dp = parsereq(rp, length)) != 0 && parsefh(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefh(dp) != NULL)
 			return;
 		break;
 
@@ -245,21 +243,21 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 #endif
 	case NFSPROC_LOOKUP:
 		printf(" lookup");
-		if ((dp = parsereq(rp, length)) != 0 && parsefhn(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefhn(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_READLINK:
 		printf(" readlink");
-		if ((dp = parsereq(rp, length)) != 0 && parsefh(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefh(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_READ:
 		printf(" read");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefh(dp)) != 0) {
-			TCHECK(dp, 3 * sizeof(*dp));
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefh(dp)) != NULL) {
+			TCHECK2(dp[0], 3 * sizeof(*dp));
 			printf(" %u bytes @ %u",
 			    (u_int32_t)ntohl(dp[1]),
 			    (u_int32_t)ntohl(dp[0]));
@@ -270,9 +268,9 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 #if NFSPROC_WRITECACHE != NFSPROC_NOOP
 	case NFSPROC_WRITECACHE:
 		printf(" writecache");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefh(dp)) != 0) {
-			TCHECK(dp, 4 * sizeof(*dp));
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefh(dp)) != NULL) {
+			TCHECK2(dp[0], 4 * sizeof(*dp));
 			printf(" %u (%u) bytes @ %u (%u)",
 			    (u_int32_t)ntohl(dp[3]),
 			    (u_int32_t)ntohl(dp[2]),
@@ -284,9 +282,9 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 #endif
 	case NFSPROC_WRITE:
 		printf(" write");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefh(dp)) != 0) {
-			TCHECK(dp, 4 * sizeof(*dp));
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefh(dp)) != NULL) {
+			TCHECK2(dp[0], 4 * sizeof(*dp));
 			printf(" %u (%u) bytes @ %u (%u)",
 			    (u_int32_t)ntohl(dp[3]),
 			    (u_int32_t)ntohl(dp[2]),
@@ -298,63 +296,63 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 
 	case NFSPROC_CREATE:
 		printf(" create");
-		if ((dp = parsereq(rp, length)) != 0 && parsefhn(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefhn(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_REMOVE:
 		printf(" remove");
-		if ((dp = parsereq(rp, length)) != 0 && parsefhn(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefhn(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_RENAME:
 		printf(" rename");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefhn(dp)) != 0) {
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefhn(dp)) != NULL) {
 			fputs(" ->", stdout);
-			if (parsefhn(dp) != 0)
+			if (parsefhn(dp) != NULL)
 				return;
 		}
 		break;
 
 	case NFSPROC_LINK:
 		printf(" link");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefh(dp)) != 0) {
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefh(dp)) != NULL) {
 			fputs(" ->", stdout);
-			if (parsefhn(dp) != 0)
+			if (parsefhn(dp) != NULL)
 				return;
 		}
 		break;
 
 	case NFSPROC_SYMLINK:
 		printf(" symlink");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefhn(dp)) != 0) {
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefhn(dp)) != NULL) {
 			fputs(" -> ", stdout);
-			if (parsefn(dp) != 0)
+			if (parsefn(dp) != NULL)
 				return;
 		}
 		break;
 
 	case NFSPROC_MKDIR:
 		printf(" mkdir");
-		if ((dp = parsereq(rp, length)) != 0 && parsefhn(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefhn(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_RMDIR:
 		printf(" rmdir");
-		if ((dp = parsereq(rp, length)) != 0 && parsefhn(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefhn(dp) != NULL)
 			return;
 		break;
 
 	case NFSPROC_READDIR:
 		printf(" readdir");
-		if ((dp = parsereq(rp, length)) != 0 &&
-		    (dp = parsefh(dp)) != 0) {
-			TCHECK(dp, 2 * sizeof(*dp));
+		if ((dp = parsereq(rp, length)) != NULL &&
+		    (dp = parsefh(dp)) != NULL) {
+			TCHECK2(dp[0], 2 * sizeof(*dp));
 			/*
 			 * Print the offset as signed, since -1 is common,
 			 * but offsets > 2^31 aren't.
@@ -368,7 +366,7 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 
 	case NFSPROC_STATFS:
 		printf(" statfs");
-		if ((dp = parsereq(rp, length)) != 0 && parsefh(dp) != 0)
+		if ((dp = parsereq(rp, length)) != NULL && parsefh(dp) != NULL)
 			return;
 		break;
 
@@ -376,8 +374,9 @@ nfsreq_print(register const u_char *bp, int length, register const u_char *bp2)
 		printf(" proc-%u", (u_int32_t)ntohl(rp->rm_call.cb_proc));
 		return;
 	}
-	fputs(" [|nfs]", stdout);
-#undef TCHECK
+trunc:
+	if (!nfserr)
+		fputs(" [|nfs]", stdout);
 }
 
 /*
@@ -396,26 +395,23 @@ nfs_printfh(register const u_int32_t *dp)
 	ino_t ino;
 	char *sfsname = NULL;
 
-	Parse_fh((caddr_t*)dp, &fsid, &ino, NULL, &sfsname, 0);
+	Parse_fh((caddr_t *)dp, &fsid, &ino, NULL, &sfsname, 0);
 
 	if (sfsname) {
-	    /* file system ID is ASCII, not numeric, for this server OS */
-	    static char temp[NFS_FHSIZE+1];
-
-	    /* Make sure string is null-terminated */
-	    strncpy(temp, sfsname, NFS_FHSIZE);
-	    /* Remove trailing spaces */
-	    sfsname = strchr(temp, ' ');
-	    if (sfsname)
-		*sfsname = 0;
-
-	    (void)printf(" fh %s/%u", temp, (u_int32_t)ino);
-	}
-	else {
-	    (void)printf(" fh %u,%u/%u",
-		fsid.fsid_dev.Major,
-		fsid.fsid_dev.Minor,
-		(u_int32_t)ino);
+		/* file system ID is ASCII, not numeric, for this server OS */
+		static char temp[NFS_FHSIZE+1];
+
+		/* Make sure string is null-terminated */
+		strncpy(temp, sfsname, NFS_FHSIZE);
+		/* Remove trailing spaces */
+		sfsname = strchr(temp, ' ');
+		if (sfsname)
+			*sfsname = 0;
+
+		(void)printf(" fh %s/%u", temp, (u_int32_t)ino);
+	} else {
+		(void)printf(" fh %u,%u/%u",
+		    fsid.Fsid_dev.Major, fsid.Fsid_dev.Minor, (u_int32_t)ino);
 	}
 }
 
@@ -486,7 +482,7 @@ xid_map_find(const struct rpc_msg *rp, const struct ip *ip)
 	} while (i != xid_map_hint);
 
 	/* search failed */
-	return(-1);
+	return (-1);
 }
 
 /*
@@ -498,11 +494,10 @@ xid_map_find(const struct rpc_msg *rp, const struct ip *ip)
  * If the packet was truncated, return 0.
  */
 static const u_int32_t *
-parserep(register const struct rpc_msg *rp, register int length)
+parserep(register const struct rpc_msg *rp, register u_int length)
 {
 	register const u_int32_t *dp;
-	register const u_int32_t *ep = (const u_int32_t *)snapend;
-	int len;
+	u_int len;
 	enum accept_stat astat;
 
 	/*
@@ -521,17 +516,15 @@ parserep(register const struct rpc_msg *rp, register int length)
 	 * which is an "enum" and so occupies one 32-bit word.
 	 */
 	dp = ((const u_int32_t *)&rp->rm_reply) + 1;
-	if (&dp[1] >= ep)
-		return(0);
+	TCHECK2(dp[0], 1);
 	len = ntohl(dp[1]);
 	if (len >= length)
-		return(0);
+		return (NULL);
 	/*
 	 * skip past the ar_verf credentials.
 	 */
 	dp += (len + (2*sizeof(u_int32_t) + 3)) / sizeof(u_int32_t);
-	if (dp >= ep)
-		return(0);
+	TCHECK2(dp[0], 0);
 
 	/*
 	 * now we can check the ar_stat field
@@ -544,55 +537,58 @@ parserep(register const struct rpc_msg *rp, register int length)
 
 	case PROG_UNAVAIL:
 		printf(" PROG_UNAVAIL");
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 
 	case PROG_MISMATCH:
 		printf(" PROG_MISMATCH");
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 
 	case PROC_UNAVAIL:
 		printf(" PROC_UNAVAIL");
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 
 	case GARBAGE_ARGS:
 		printf(" GARBAGE_ARGS");
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 
 	case SYSTEM_ERR:
 		printf(" SYSTEM_ERR");
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 
 	default:
 		printf(" ar_stat %d", astat);
-		return(0);
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 	}
 	/* successful return */
-	if ((sizeof(astat) + ((char *)dp)) < (char *)ep)
-		return((u_int32_t *) (sizeof(astat) + ((char *)dp)));
+	if ((sizeof(astat) + ((u_char *)dp)) < snapend)
+		return ((u_int32_t *) (sizeof(astat) + ((char *)dp)));
 
-	return (0);
+trunc:
+	return (NULL);
 }
 
-#define T2CHECK(p, l) if ((u_char *)(p) > ((u_char *)snapend) - l) return(0)
-
 static const u_int32_t *
 parsestatus(const u_int32_t *dp)
 {
-	int errnum;
-	T2CHECK(dp, 4);
+	register int errnum;
 
+	TCHECK(dp[0]);
 	errnum = ntohl(dp[0]);
 	if (errnum != 0) {
-		char *errmsg;
-
-		if (qflag)
-			return(0);
-
-		errmsg = pcap_strerror(errnum);
-		printf(" ERROR: %s", errmsg);
-		return(0);
+		if (!qflag)
+			printf(" ERROR: %s", pcap_strerror(errnum));
+		nfserr = 1;		/* suppress trunc string */
+		return (NULL);
 	}
 	return (dp + 1);
+trunc:
+	return (NULL);
 }
 
 static struct tok type2str[] = {
@@ -610,10 +606,9 @@ parsefattr(const u_int32_t *dp, int verbose)
 {
 	const struct nfsv2_fattr *fap;
 
-	T2CHECK(dp, 4);
-
 	fap = (const struct nfsv2_fattr *)dp;
-	if (verbose)
+	if (verbose) {
+		TCHECK(fap->fa_nfssize);
 		printf(" %s %o ids %u/%u sz %u ",
 		    tok2str(type2str, "unk-ft %d ",
 		    (u_int32_t)ntohl(fap->fa_type)),
@@ -621,29 +616,37 @@ parsefattr(const u_int32_t *dp, int verbose)
 		    (u_int32_t)ntohl(fap->fa_uid),
 		    (u_int32_t)ntohl(fap->fa_gid),
 		    (u_int32_t)ntohl(fap->fa_nfssize));
+	}
 	/* print lots more stuff */
 	if (verbose > 1) {
+		TCHECK(fap->fa_nfsfileid);
 		printf("nlink %u rdev %x fsid %x nodeid %x a/m/ctime ",
 		    (u_int32_t)ntohl(fap->fa_nlink),
 		    (u_int32_t)ntohl(fap->fa_nfsrdev),
 		    (u_int32_t)ntohl(fap->fa_nfsfsid),
 		    (u_int32_t)ntohl(fap->fa_nfsfileid));
+		TCHECK(fap->fa_nfsatime);
 		printf("%u.%06u ",
 		    (u_int32_t)ntohl(fap->fa_nfsatime.nfs_sec),
 		    (u_int32_t)ntohl(fap->fa_nfsatime.nfs_usec));
+		TCHECK(fap->fa_nfsmtime);
 		printf("%u.%06u ",
 		    (u_int32_t)ntohl(fap->fa_nfsmtime.nfs_sec),
 		    (u_int32_t)ntohl(fap->fa_nfsmtime.nfs_usec));
+		TCHECK(fap->fa_nfsctime);
 		printf("%u.%06u ",
 		    (u_int32_t)ntohl(fap->fa_nfsctime.nfs_sec),
 		    (u_int32_t)ntohl(fap->fa_nfsctime.nfs_usec));
 	}
 	return ((const u_int32_t *)&fap[1]);
+trunc:
+	return (NULL);
 }
 
 static int
 parseattrstat(const u_int32_t *dp, int verbose)
 {
+
 	dp = parsestatus(dp);
 	if (dp == NULL)
 		return (0);
@@ -654,6 +657,7 @@ parseattrstat(const u_int32_t *dp, int verbose)
 static int
 parsediropres(const u_int32_t *dp)
 {
+
 	dp = parsestatus(dp);
 	if (dp == NULL)
 		return (0);
@@ -670,7 +674,7 @@ parselinkres(const u_int32_t *dp)
 {
 	dp = parsestatus(dp);
 	if (dp == NULL)
-		return(0);
+		return (0);
 
 	putchar(' ');
 	return (parsefn(dp) != NULL);
@@ -683,45 +687,47 @@ parsestatfs(const u_int32_t *dp)
 
 	dp = parsestatus(dp);
 	if (dp == NULL)
-		return(0);
-
-	if (qflag)
-		return(1);
-
-	T2CHECK(dp, 20);
+		return (0);
 
-	sfsp = (const struct nfsv2_statfs *)dp;
-	printf(" tsize %u bsize %u blocks %u bfree %u bavail %u",
-	    (u_int32_t)ntohl(sfsp->sf_tsize),
-	    (u_int32_t)ntohl(sfsp->sf_bsize),
-	    (u_int32_t)ntohl(sfsp->sf_blocks),
-	    (u_int32_t)ntohl(sfsp->sf_bfree),
-	    (u_int32_t)ntohl(sfsp->sf_bavail));
+	if (!qflag) {
+		sfsp = (const struct nfsv2_statfs *)dp;
+		TCHECK(sfsp->sf_bavail);
+		printf(" tsize %u bsize %u blocks %u bfree %u bavail %u",
+		    (u_int32_t)ntohl(sfsp->sf_tsize),
+		    (u_int32_t)ntohl(sfsp->sf_bsize),
+		    (u_int32_t)ntohl(sfsp->sf_blocks),
+		    (u_int32_t)ntohl(sfsp->sf_bfree),
+		    (u_int32_t)ntohl(sfsp->sf_bavail));
+	}
 
 	return (1);
+trunc:
+	return (0);
 }
 
 static int
 parserddires(const u_int32_t *dp)
 {
 	dp = parsestatus(dp);
-	if (dp == 0)
+	if (dp == NULL)
 		return (0);
-	if (qflag)
-		return (1);
-
-	T2CHECK(dp, 12);
-	printf(" offset %x size %u ",
-	    (u_int32_t)ntohl(dp[0]),
-	    (u_int32_t)ntohl(dp[1]));
-	if (dp[2] != 0)
-		printf("eof");
+	if (!qflag) {
+		TCHECK(dp[0]);
+		printf(" offset %x", (u_int32_t)ntohl(dp[0]));
+		TCHECK(dp[1]);
+		printf(" size %u", (u_int32_t)ntohl(dp[1]));
+		TCHECK(dp[2]);
+		if (dp[2] != 0)
+			printf(" eof");
+	}
 
 	return (1);
+trunc:
+	return (0);
 }
 
 static void
-interp_reply(const struct rpc_msg *rp, u_int32_t proc, int length)
+interp_reply(const struct rpc_msg *rp, u_int32_t proc, u_int length)
 {
 	register const u_int32_t *dp;
 
@@ -741,14 +747,14 @@ interp_reply(const struct rpc_msg *rp, u_int32_t proc, int length)
 	case NFSPROC_GETATTR:
 		printf(" getattr");
 		dp = parserep(rp, length);
-		if (dp != 0 && parseattrstat(dp, !qflag) != 0)
+		if (dp != NULL && parseattrstat(dp, !qflag) != 0)
 			return;
 		break;
 
 	case NFSPROC_SETATTR:
 		printf(" setattr");
 		dp = parserep(rp, length);
-		if (dp != 0 && parseattrstat(dp, !qflag) != 0)
+		if (dp != NULL && parseattrstat(dp, !qflag) != 0)
 			return;
 		break;
 
@@ -760,21 +766,21 @@ interp_reply(const struct rpc_msg *rp, u_int32_t proc, int length)
 	case NFSPROC_LOOKUP:
 		printf(" lookup");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsediropres(dp) != 0)
+		if (dp != NULL && parsediropres(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_READLINK:
 		printf(" readlink");
 		dp = parserep(rp, length);
-		if (dp != 0 && parselinkres(dp) != 0)
+		if (dp != NULL && parselinkres(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_READ:
 		printf(" read");
 		dp = parserep(rp, length);
-		if (dp != 0 && parseattrstat(dp, vflag) != 0)
+		if (dp != NULL && parseattrstat(dp, vflag) != 0)
 			return;
 		break;
 
@@ -786,70 +792,70 @@ interp_reply(const struct rpc_msg *rp, u_int32_t proc, int length)
 	case NFSPROC_WRITE:
 		printf(" write");
 		dp = parserep(rp, length);
-		if (dp != 0 && parseattrstat(dp, vflag) != 0)
+		if (dp != NULL && parseattrstat(dp, vflag) != 0)
 			return;
 		break;
 
 	case NFSPROC_CREATE:
 		printf(" create");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsediropres(dp) != 0)
+		if (dp != NULL && parsediropres(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_REMOVE:
 		printf(" remove");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatus(dp) != 0)
+		if (dp != NULL && parsestatus(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_RENAME:
 		printf(" rename");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatus(dp) != 0)
+		if (dp != NULL && parsestatus(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_LINK:
 		printf(" link");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatus(dp) != 0)
+		if (dp != NULL && parsestatus(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_SYMLINK:
 		printf(" symlink");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatus(dp) != 0)
+		if (dp != NULL && parsestatus(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_MKDIR:
 		printf(" mkdir");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsediropres(dp) != 0)
+		if (dp != NULL && parsediropres(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_RMDIR:
 		printf(" rmdir");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatus(dp) != 0)
+		if (dp != NULL && parsestatus(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_READDIR:
 		printf(" readdir");
 		dp = parserep(rp, length);
-		if (dp != 0 && parserddires(dp) != 0)
+		if (dp != NULL && parserddires(dp) != 0)
 			return;
 		break;
 
 	case NFSPROC_STATFS:
 		printf(" statfs");
 		dp = parserep(rp, length);
-		if (dp != 0 && parsestatfs(dp) != 0)
+		if (dp != NULL && parsestatfs(dp) != 0)
 			return;
 		break;
 
@@ -857,5 +863,6 @@ interp_reply(const struct rpc_msg *rp, u_int32_t proc, int length)
 		printf(" proc-%u", proc);
 		return;
 	}
-	fputs(" [|nfs]", stdout);
+	if (!nfserr)
+		fputs(" [|nfs]", stdout);
 }
diff --git a/usr.sbin/tcpdump/print-ntp.c b/usr.sbin/tcpdump/print-ntp.c
index 87e74ba1791..9787cb12900 100644
--- a/usr.sbin/tcpdump/print-ntp.c
+++ b/usr.sbin/tcpdump/print-ntp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ntp.c,v 1.4 1996/07/13 11:01:26 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -26,13 +24,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-ntp.c,v 1.20 96/06/23 02:11:46 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ntp.c,v 1.5 1996/12/12 16:22:31 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -61,26 +58,20 @@ static void p_ntp_delta(const struct l_fixedpt *, const struct l_fixedpt *);
  * Print ntp requests
  */
 void
-ntp_print(register const u_char *cp, int length)
+ntp_print(register const u_char *cp, u_int length)
 {
 	register const struct ntpdata *bp;
-	register const u_char *ep;
 	int mode, version, leapind;
 	static char rclock[5];
 
-#define TCHECK(var, l) if ((u_char *)&(var) > ep - l) goto trunc
-
 	bp = (struct ntpdata *)cp;
 	/* Note funny sized packets */
 	if (length != sizeof(struct ntpdata))
 		(void)printf(" [len=%d]", length);
 
-	/* 'ep' points to the end of available data. */
-	ep = snapend;
-
-	TCHECK(bp->status, sizeof(bp->status));
+	TCHECK(bp->status);
 
-	version = (bp->status & VERSIONMASK) >> 3;
+	version = (int)(bp->status & VERSIONMASK) >> 3;
 	printf(" v%d", version);
 
 	leapind = bp->status & LEAPMASK;
@@ -135,28 +126,28 @@ ntp_print(register const u_char *cp, int length)
 
 	}
 
-	TCHECK(bp->stratum, sizeof(bp->stratum));
+	TCHECK(bp->stratum);
 	printf(" strat %d", bp->stratum);
 
-	TCHECK(bp->ppoll, sizeof(bp->ppoll));
+	TCHECK(bp->ppoll);
 	printf(" poll %d", bp->ppoll);
 
 	/* Can't TCHECK bp->precision bitfield so bp->distance + 0 instead */
-	TCHECK(bp->distance, 0);
+	TCHECK2(bp->distance, 0);
 	printf(" prec %d", bp->precision);
 
 	if (!vflag)
 		return;
 
-	TCHECK(bp->distance, sizeof(bp->distance));
+	TCHECK(bp->distance);
 	fputs(" dist ", stdout);
 	p_sfix(&bp->distance);
 
-	TCHECK(bp->dispersion, sizeof(bp->dispersion));
+	TCHECK(bp->dispersion);
 	fputs(" disp ", stdout);
 	p_sfix(&bp->dispersion);
 
-	TCHECK(bp->refid, sizeof(bp->refid));
+	TCHECK(bp->refid);
 	fputs(" ref ", stdout);
 	/* Interpretation depends on stratum */
 	switch (bp->stratum) {
@@ -186,19 +177,19 @@ ntp_print(register const u_char *cp, int length)
 		break;
 	}
 
-	TCHECK(bp->reftime, sizeof(bp->reftime));
+	TCHECK(bp->reftime);
 	putchar('@');
 	p_ntp_time(&(bp->reftime));
 
-	TCHECK(bp->org, sizeof(bp->org));
+	TCHECK(bp->org);
 	fputs(" orig ", stdout);
 	p_ntp_time(&(bp->org));
 
-	TCHECK(bp->rec, sizeof(bp->rec));
+	TCHECK(bp->rec);
 	fputs(" rec ", stdout);
 	p_ntp_delta(&(bp->org), &(bp->rec));
 
-	TCHECK(bp->xmt, sizeof(bp->xmt));
+	TCHECK(bp->xmt);
 	fputs(" xmt ", stdout);
 	p_ntp_delta(&(bp->org), &(bp->xmt));
 
@@ -206,7 +197,6 @@ ntp_print(register const u_char *cp, int length)
 
 trunc:
 	fputs(" [|ntp]", stdout);
-#undef TCHECK
 }
 
 static void
diff --git a/usr.sbin/tcpdump/print-null.c b/usr.sbin/tcpdump/print-null.c
index 8adfc6bfcfd..86d2f6f9a6a 100644
--- a/usr.sbin/tcpdump/print-null.c
+++ b/usr.sbin/tcpdump/print-null.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-null.c,v 1.4 1996/07/13 11:01:27 mickey Exp $	*/
-
 /*
  * Copyright (c) 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#)Header: print-null.c,v 1.18 96/06/03 02:53:51 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-null.c,v 1.5 1996/12/12 16:22:30 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
@@ -48,17 +46,21 @@ struct rtentry;
 #include <netinet/tcp.h>
 #include <netinet/tcpip.h>
 
+#include <pcap.h>
 #include <stdio.h>
 #include <string.h>
 
-#include "interface.h"
 #include "addrtoname.h"
-#include "pcap.h"
+#include "interface.h"
 
 #define	NULL_HDRLEN 4
 
+#ifndef AF_NS
+#define AF_NS		6		/* XEROX NS protocols */
+#endif
+
 static void
-null_print(const u_char *p, const struct ip *ip, int length)
+null_print(const u_char *p, const struct ip *ip, u_int length)
 {
 	u_int family;
 
@@ -87,8 +89,8 @@ null_print(const u_char *p, const struct ip *ip, int length)
 void
 null_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 {
-	int length = h->len;
-	int caplen = h->caplen;
+	u_int length = h->len;
+	u_int caplen = h->caplen;
 	const struct ip *ip;
 
 	ts_print(&h->ts);
diff --git a/usr.sbin/tcpdump/print-ospf.c b/usr.sbin/tcpdump/print-ospf.c
index 259a801a72a..319a1e6baff 100644
--- a/usr.sbin/tcpdump/print-ospf.c
+++ b/usr.sbin/tcpdump/print-ospf.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ospf.c,v 1.4 1996/07/13 11:01:27 mickey Exp $	*/
-
 /*
  * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -24,8 +22,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-ospf.c,v 1.18 96/06/15 13:19:49 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ospf.c,v 1.5 1996/12/12 16:22:30 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
@@ -46,8 +44,8 @@ static char rcsid[] =
 #include "ospf.h"
 
 struct bits {
-    u_int32_t bit;
-    const char *str;
+	u_int32_t bit;
+	const char *str;
 };
 
 static const struct bits ospf_option_bits[] = {
@@ -65,506 +63,518 @@ static const struct bits ospf_rla_flag_bits[] = {
 	{ 0,			NULL }
 };
 
-static const char *ospf_types[OSPF_TYPE_MAX] = {
-  (char *) 0,
-  "hello",
-  "dd",
-  "ls_req",
-  "ls_upd",
-  "ls_ack"
+static struct tok type2str[] = {
+	{ OSPF_TYPE_UMD,	"umd" },
+	{ OSPF_TYPE_HELLO,	"hello" },
+	{ OSPF_TYPE_DB,		"dd" },
+	{ OSPF_TYPE_LSR,	"ls_req" },
+	{ OSPF_TYPE_LSU,	"ls_upd" },
+	{ OSPF_TYPE_LSA,	"ls_ack" },
+	{ 0,			NULL }
 };
 
+static char tstr[] = " [|ospf]";
+
+/* Forwards */
+static inline void ospf_print_seqage(u_int32_t, time_t);
+static inline void ospf_print_bits(const struct bits *, u_char);
+static void ospf_print_ls_type(u_int, const struct in_addr *,
+    const struct in_addr *, const char *);
+static int ospf_print_lshdr(const struct lsa_hdr *);
+static int ospf_print_lsa(const struct lsa *);
+static int ospf_decode_v2(const struct ospfhdr *, const u_char *);
+
 static inline void
 ospf_print_seqage(register u_int32_t seq, register time_t us)
 {
-    register time_t sec = us % 60;
-    register time_t mins = (us / 60) % 60;
-    register time_t hour = us/3600;
-
-    printf(" S %X age ", seq);
-    if (hour) {
-	printf("%u:%02u:%02u",
-	       (u_int32_t)hour,
-	       (u_int32_t)mins,
-	       (u_int32_t)sec);
-    } else if (mins) {
-	printf("%u:%02u",
-	       (u_int32_t)mins,
-	       (u_int32_t)sec);
-    } else {
-	printf("%u",
-	       (u_int32_t)sec);
-    }
+	register time_t sec = us % 60;
+	register time_t mins = (us / 60) % 60;
+	register time_t hour = us / 3600;
+
+	printf(" S %X age ", seq);
+	if (hour)
+		printf("%u:%02u:%02u",
+		    (u_int32_t) hour, (u_int32_t) mins, (u_int32_t) sec);
+	else if (mins)
+		printf("%u:%02u", (u_int32_t) mins, (u_int32_t) sec);
+	else
+		printf("%u", (u_int32_t) sec);
 }
 
 
 static inline void
 ospf_print_bits(register const struct bits *bp, register u_char options)
 {
-    char sep = ' ';
-
-    do {
-	if (options & bp->bit) {
-	    printf("%c%s",
-		   sep,
-		   bp->str);
-	    sep = '/';
-	}
-    } while ((++bp)->bit) ;
+	register char sep = ' ';
+
+	do {
+		if (options & bp->bit) {
+			printf("%c%s", sep, bp->str);
+			sep = '/';
+		}
+	} while ((++bp)->bit);
 }
 
+static void
+ospf_print_ls_type(register u_int ls_type,
+    register const struct in_addr *ls_stateid,
+    register const struct in_addr *ls_router, register const char *fmt)
+{
 
-#define	LS_PRINT(lsp, type) switch (type) { \
-    case LS_TYPE_ROUTER: \
-	printf(" rtr %s ", ipaddr_string(&lsp->ls_router)); break; \
-    case LS_TYPE_NETWORK: \
-	printf(" net dr %s if %s", ipaddr_string(&lsp->ls_router), ipaddr_string(&lsp->ls_stateid)); break; \
-    case LS_TYPE_SUM_IP: \
-	printf(" sum %s abr %s", ipaddr_string(&lsp->ls_stateid), ipaddr_string(&lsp->ls_router)); break; \
-    case LS_TYPE_SUM_ABR: \
-	printf(" abr %s rtr %s", ipaddr_string(&lsp->ls_router), ipaddr_string(&lsp->ls_stateid)); break; \
-    case LS_TYPE_ASE: \
-	printf(" ase %s asbr %s", ipaddr_string(&lsp->ls_stateid), ipaddr_string(&lsp->ls_router)); break; \
-    case LS_TYPE_GROUP: \
-	printf(" group %s rtr %s", ipaddr_string(&lsp->ls_stateid), ipaddr_string(&lsp->ls_router)); break; \
-    }
+	switch (ls_type) {
 
-static int
-ospf_print_lshdr(register const struct lsa_hdr *lshp, const caddr_t end)
-{
-    if ((caddr_t) (lshp + 1) > end) {
-	return 1;
-    }
+	case LS_TYPE_ROUTER:
+		printf(" rtr %s ", ipaddr_string(ls_router));
+		break;
+
+	case LS_TYPE_NETWORK:
+		printf(" net dr %s if %s",
+		    ipaddr_string(ls_router),
+		    ipaddr_string(ls_stateid));
+		break;
+
+	case LS_TYPE_SUM_IP:
+		printf(" sum %s abr %s",
+		    ipaddr_string(ls_stateid),
+		    ipaddr_string(ls_router));
+		break;
+
+	case LS_TYPE_SUM_ABR:
+		printf(" abr %s rtr %s",
+		    ipaddr_string(ls_router),
+		    ipaddr_string(ls_stateid));
+		break;
+
+	case LS_TYPE_ASE:
+		printf(" ase %s asbr %s",
+		    ipaddr_string(ls_stateid),
+		    ipaddr_string(ls_router));
+		break;
+
+	case LS_TYPE_GROUP:
+		printf(" group %s rtr %s",
+		    ipaddr_string(ls_stateid),
+		    ipaddr_string(ls_router));
+		break;
 
-    printf(" {");						/* } (ctags) */
+	default:
+		putchar(' ');
+		printf(fmt, ls_type);
+		break;
+	}
+}
 
-    if (!lshp->ls_type || lshp->ls_type >= LS_TYPE_MAX) {
-	printf(" ??LS type %d?? }", lshp->ls_type);		/* { (ctags) */
-	return 1;
-    }
+static int
+ospf_print_lshdr(register const struct lsa_hdr *lshp)
+{
 
-    ospf_print_bits(ospf_option_bits, lshp->ls_options);
-    ospf_print_seqage(ntohl(lshp->ls_seq), ntohs(lshp->ls_age));
+	TCHECK(lshp->ls_type);
+	printf(" {");						/* } (ctags) */
 
-    LS_PRINT(lshp, lshp->ls_type);
+	TCHECK(lshp->ls_options);
+	ospf_print_bits(ospf_option_bits, lshp->ls_options);
+	TCHECK(lshp->ls_seq);
+	ospf_print_seqage(ntohl(lshp->ls_seq), ntohs(lshp->ls_age));
+	ospf_print_ls_type(lshp->ls_type, &lshp->ls_stateid, &lshp->ls_router,
+	    "ls_type %d");
 
-    return 0;
+	return (0);
+trunc:
+	return (1);
 }
 
 
 /*
  * Print a single link state advertisement.  If truncated return 1, else 0.
  */
-
 static int
-ospf_print_lsa(register const struct lsa *lsap, const caddr_t end)
+ospf_print_lsa(register const struct lsa *lsap)
 {
-    register const char *ls_end;
-    const struct rlalink *rlp;
-    const struct tos_metric *tosp;
-    const struct in_addr *ap;
-    const struct aslametric *almp;
-    const struct mcla *mcp;
-    const u_int32_t *lp;
-    int j, k;
-
-    if (ospf_print_lshdr(&lsap->ls_hdr, end)) {
-	return 1;
-    }
-
-    ls_end = (caddr_t) lsap + ntohs(lsap->ls_hdr.ls_length);
-
-    if (ls_end > end) {
-	printf(" }");						/* { (ctags) */
-	return 1;
-    }
-
-    switch (lsap->ls_hdr.ls_type) {
-    case LS_TYPE_ROUTER:
-	ospf_print_bits(ospf_rla_flag_bits, lsap->lsa_un.un_rla.rla_flags);
-
-	j = ntohs(lsap->lsa_un.un_rla.rla_count);
-	rlp = lsap->lsa_un.un_rla.rla_link;
-	while (j--) {
-	    struct rlalink *rln = (struct rlalink *) ((caddr_t) (rlp + 1) + ((rlp->link_toscount) * sizeof (struct tos_metric)));
-
-	    if ((caddr_t) rln > ls_end) {
+	register const u_char *ls_end;
+	register const struct rlalink *rlp;
+	register const struct tos_metric *tosp;
+	register const struct in_addr *ap;
+	register const struct aslametric *almp;
+	register const struct mcla *mcp;
+	register const u_int32_t *lp;
+	register int j, k;
+
+	if (ospf_print_lshdr(&lsap->ls_hdr))
+		return (1);
+	TCHECK(lsap->ls_hdr.ls_length);
+	ls_end = (u_char *)lsap + ntohs(lsap->ls_hdr.ls_length);
+	switch (lsap->ls_hdr.ls_type) {
+
+	case LS_TYPE_ROUTER:
+		TCHECK(lsap->lsa_un.un_rla.rla_flags);
+		ospf_print_bits(ospf_rla_flag_bits,
+		    lsap->lsa_un.un_rla.rla_flags);
+
+		TCHECK(lsap->lsa_un.un_rla.rla_count);
+		j = ntohs(lsap->lsa_un.un_rla.rla_count);
+		TCHECK(lsap->lsa_un.un_rla.rla_link);
+		rlp = lsap->lsa_un.un_rla.rla_link;
+		while (j--) {
+			register struct rlalink *rln =
+			    (struct rlalink *)((u_char *)(rlp + 1) +
+			    ((rlp->link_toscount) * sizeof(*tosp)));
+
+			TCHECK(*rln);
+			printf(" {");				/* } (ctags) */
+			switch (rlp->link_type) {
+
+			case RLA_TYPE_VIRTUAL:
+				printf(" virt");
+				/* Fall through */
+
+			case RLA_TYPE_ROUTER:
+				printf(" nbrid %s if %s",
+				    ipaddr_string(&rlp->link_id),
+				    ipaddr_string(&rlp->link_data));
+				break;
+
+			case RLA_TYPE_TRANSIT:
+				printf(" dr %s if %s",
+				    ipaddr_string(&rlp->link_id),
+				    ipaddr_string(&rlp->link_data));
+				break;
+
+			case RLA_TYPE_STUB:
+				printf(" net %s mask %s",
+				    ipaddr_string(&rlp->link_id),
+				    ipaddr_string(&rlp->link_data));
+				break;
+
+			default:
+								/* { (ctags) */
+				printf(" ??RouterLinksType %d?? }",
+				    rlp->link_type);
+				return (0);
+			}
+			printf(" tos 0 metric %d", ntohs(rlp->link_tos0metric));
+			tosp = (struct tos_metric *)
+			    ((sizeof rlp->link_tos0metric) + (u_char *) rlp);
+			for (k = 0; k < (int) rlp->link_toscount; ++k, ++tosp) {
+				TCHECK(*tosp);
+				printf(" tos %d metric %d",
+				    tosp->tos_type,
+				    ntohs(tosp->tos_metric));
+			}
+								/* { (ctags) */
+			printf(" }");
+			rlp = rln;
+		}
 		break;
-	    }
-	    printf(" {");					/* } (ctags) */
-
-	    switch (rlp->link_type) {
-	    case RLA_TYPE_VIRTUAL:
-		printf(" virt");
-		/* Fall through */
 
-	    case RLA_TYPE_ROUTER:
-		printf(" nbrid %s if %s",
-		       ipaddr_string(&rlp->link_id),
-		       ipaddr_string(&rlp->link_data));
+	case LS_TYPE_NETWORK:
+		TCHECK(lsap->lsa_un.un_nla.nla_mask);
+		printf(" mask %s rtrs",
+		    ipaddr_string(&lsap->lsa_un.un_nla.nla_mask));
+		ap = lsap->lsa_un.un_nla.nla_router;
+		while ((u_char *)ap < ls_end) {
+			TCHECK(*ap);
+			printf(" %s", ipaddr_string(ap));
+			++ap;
+		}
 		break;
 
-	    case RLA_TYPE_TRANSIT:
-		printf(" dr %s if %s",
-		       ipaddr_string(&rlp->link_id),
-		       ipaddr_string(&rlp->link_data));
+	case LS_TYPE_SUM_IP:
+		TCHECK(lsap->lsa_un.un_nla.nla_mask);
+		printf(" mask %s",
+		    ipaddr_string(&lsap->lsa_un.un_sla.sla_mask));
+		/* Fall through */
+
+	case LS_TYPE_SUM_ABR:
+		TCHECK(lsap->lsa_un.un_sla.sla_tosmetric);
+		lp = lsap->lsa_un.un_sla.sla_tosmetric;
+		while ((u_char *)lp < ls_end) {
+			register u_int32_t ul;
+
+			TCHECK(*lp);
+			ul = ntohl(*lp);
+			printf(" tos %d metric %d",
+			    (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS,
+			    ul & SLA_MASK_METRIC);
+			++lp;
+		}
 		break;
 
-	    case RLA_TYPE_STUB:
-		printf(" net %s mask %s",
-		       ipaddr_string(&rlp->link_id),
-		       ipaddr_string(&rlp->link_data));
+	case LS_TYPE_ASE:
+		TCHECK(lsap->lsa_un.un_nla.nla_mask);
+		printf(" mask %s",
+		    ipaddr_string(&lsap->lsa_un.un_asla.asla_mask));
+
+		TCHECK(lsap->lsa_un.un_sla.sla_tosmetric);
+		almp = lsap->lsa_un.un_asla.asla_metric;
+		while ((u_char *)almp < ls_end) {
+			register u_int32_t ul;
+
+			TCHECK(almp->asla_tosmetric);
+			ul = ntohl(almp->asla_tosmetric);
+			printf(" type %d tos %d metric %d",
+			    (ul & ASLA_FLAG_EXTERNAL) ? 2 : 1,
+			    (ul & ASLA_MASK_TOS) >> ASLA_SHIFT_TOS,
+			    (ul & ASLA_MASK_METRIC));
+			TCHECK(almp->asla_forward);
+			if (almp->asla_forward.s_addr) {
+				printf(" forward %s",
+				    ipaddr_string(&almp->asla_forward));
+			}
+			TCHECK(almp->asla_tag);
+			if (almp->asla_tag.s_addr) {
+				printf(" tag %s",
+				    ipaddr_string(&almp->asla_tag));
+			}
+			++almp;
+		}
 		break;
 
-	    default:
-		printf(" ??RouterLinksType %d?? }",		/* { (ctags) */
-		       rlp->link_type);
-		return 0;
-	    }
-	    printf(" tos 0 metric %d",
-		   ntohs(rlp->link_tos0metric));
-	    tosp = (struct tos_metric *) ((sizeof rlp->link_tos0metric) + (caddr_t) rlp);
-	    for (k = 0; k < rlp->link_toscount; k++, tosp++) {
-		printf(" tos %d metric %d",
-		       tosp->tos_type,
-		       ntohs(tosp->tos_metric));
-	    }
-	    printf(" }");					/* { (ctags) */
-	    rlp = rln;
-	}
-	break;
-
-    case LS_TYPE_NETWORK:
-	printf(" mask %s rtrs",
-	       ipaddr_string(&lsap->lsa_un.un_nla.nla_mask));
-	for (ap = lsap->lsa_un.un_nla.nla_router;
-	     (caddr_t) (ap + 1) <= ls_end;
-	     ap++) {
-	    printf(" %s",
-		   ipaddr_string(ap));
+	case LS_TYPE_GROUP:
+		/* Multicast extensions as of 23 July 1991 */
+		mcp = lsap->lsa_un.un_mcla;
+		while ((u_char *)mcp < ls_end) {
+			TCHECK(mcp->mcla_vid);
+			switch (ntohl(mcp->mcla_vtype)) {
+
+			case MCLA_VERTEX_ROUTER:
+				printf(" rtr rtrid %s",
+				    ipaddr_string(&mcp->mcla_vid));
+				break;
+
+			case MCLA_VERTEX_NETWORK:
+				printf(" net dr %s",
+				    ipaddr_string(&mcp->mcla_vid));
+				break;
+
+			default:
+				printf(" ??VertexType %u??",
+				    (u_int32_t)ntohl(mcp->mcla_vtype));
+				break;
+			}
+		++mcp;
+		}
 	}
-	break;
 
-    case LS_TYPE_SUM_IP:
-	printf(" mask %s",
-	       ipaddr_string(&lsap->lsa_un.un_sla.sla_mask));
-	/* Fall through */
+								/* { (ctags) */
+	fputs(" }", stdout);
+	return (0);
+trunc:
+	fputs(" }", stdout);
+	return (1);
+}
 
-    case LS_TYPE_SUM_ABR:
+static int
+ospf_decode_v2(register const struct ospfhdr *op,
+    register const u_char *dataend)
+{
+	register const struct in_addr *ap;
+	register const struct lsr *lsrp;
+	register const struct lsa_hdr *lshp;
+	register const struct lsa *lsap;
+	register char sep;
+	register int i;
 
-	for (lp = lsap->lsa_un.un_sla.sla_tosmetric;
-	     (caddr_t) (lp + 1) <= ls_end;
-	     lp++) {
-	    u_int32_t ul = ntohl(*lp);
+	switch (op->ospf_type) {
 
-	    printf(" tos %d metric %d",
-		   (ul & SLA_MASK_TOS) >> SLA_SHIFT_TOS,
-		   ul & SLA_MASK_METRIC);
-	}
-	break;
-
-    case LS_TYPE_ASE:
-	printf(" mask %s",
-	       ipaddr_string(&lsap->lsa_un.un_asla.asla_mask));
-
-	for (almp = lsap->lsa_un.un_asla.asla_metric;
-	     (caddr_t) (almp + 1) <= ls_end;
-	     almp++) {
-	    u_int32_t ul = ntohl(almp->asla_tosmetric);
-
-	    printf(" type %d tos %d metric %d",
-		   (ul & ASLA_FLAG_EXTERNAL) ? 2 : 1,
-		   (ul & ASLA_MASK_TOS) >> ASLA_SHIFT_TOS,
-		   (ul & ASLA_MASK_METRIC));
-	    if (almp->asla_forward.s_addr) {
-		printf(" forward %s",
-		       ipaddr_string(&almp->asla_forward));
-	    }
-	    if (almp->asla_tag.s_addr) {
-		printf(" tag %s",
-		       ipaddr_string(&almp->asla_tag));
-	    }
-	}
-	break;
-
-    case LS_TYPE_GROUP:
-	/* Multicast extensions as of 23 July 1991 */
-	for (mcp = lsap->lsa_un.un_mcla;
-	     (caddr_t) (mcp + 1) <= ls_end;
-	     mcp++) {
-	    switch (ntohl(mcp->mcla_vtype)) {
-	    case MCLA_VERTEX_ROUTER:
-		printf(" rtr rtrid %s",
-		       ipaddr_string(&mcp->mcla_vid));
+	case OSPF_TYPE_UMD:
+		/*
+		 * Rob Coltun's special monitoring packets;
+		 * do nothing
+		 */
 		break;
 
-	    case MCLA_VERTEX_NETWORK:
-		printf(" net dr %s",
-		       ipaddr_string(&mcp->mcla_vid));
+	case OSPF_TYPE_HELLO:
+		if (vflag) {
+			TCHECK(op->ospf_hello.hello_deadint);
+			ospf_print_bits(ospf_option_bits,
+			    op->ospf_hello.hello_options);
+			printf(" mask %s int %d pri %d dead %u",
+			    ipaddr_string(&op->ospf_hello.hello_mask),
+			    ntohs(op->ospf_hello.hello_helloint),
+			    op->ospf_hello.hello_priority,
+			    (u_int32_t)ntohl(op->ospf_hello.hello_deadint));
+		}
+		TCHECK(op->ospf_hello.hello_dr);
+		if (op->ospf_hello.hello_dr.s_addr != 0)
+			printf(" dr %s",
+			    ipaddr_string(&op->ospf_hello.hello_dr));
+		TCHECK(op->ospf_hello.hello_bdr);
+		if (op->ospf_hello.hello_bdr.s_addr != 0)
+			printf(" bdr %s",
+			    ipaddr_string(&op->ospf_hello.hello_bdr));
+		if (vflag) {
+			printf(" nbrs");
+			ap = op->ospf_hello.hello_neighbor;
+			while ((u_char *)ap < dataend) {
+				TCHECK(*ap);
+				printf(" %s", ipaddr_string(ap));
+				++ap;
+			}
+		}
+		break;	/* HELLO */
+
+	case OSPF_TYPE_DB:
+		TCHECK(op->ospf_db.db_options);
+		ospf_print_bits(ospf_option_bits, op->ospf_db.db_options);
+		sep = ' ';
+		TCHECK(op->ospf_db.db_flags);
+		if (op->ospf_db.db_flags & OSPF_DB_INIT) {
+			printf("%cI", sep);
+			sep = '/';
+		}
+		if (op->ospf_db.db_flags & OSPF_DB_MORE) {
+			printf("%cM", sep);
+			sep = '/';
+		}
+		if (op->ospf_db.db_flags & OSPF_DB_MASTER) {
+			printf("%cMS", sep);
+			sep = '/';
+		}
+		TCHECK(op->ospf_db.db_seq);
+		printf(" S %X", (u_int32_t)ntohl(op->ospf_db.db_seq));
+
+		if (vflag) {
+			/* Print all the LS adv's */
+			lshp = op->ospf_db.db_lshdr;
+
+			while (!ospf_print_lshdr(lshp)) {
+							/* { (ctags) */
+				printf(" }");
+				++lshp;
+			}
+		}
 		break;
 
-	    default:
-		printf(" ??VertexType %u??",
-		       (u_int32_t)ntohl(mcp->mcla_vtype));
+	case OSPF_TYPE_LSR:
+		if (vflag) {
+			lsrp = op->ospf_lsr;
+			while ((u_char *)lsrp < dataend) {
+				TCHECK(*lsrp);
+				printf(" {");		/* } (ctags) */
+				ospf_print_ls_type(ntohl(lsrp->ls_type),
+				    &lsrp->ls_stateid,
+				    &lsrp->ls_router,
+				    "LinkStateType %d");
+							/* { (ctags) */
+				printf(" }");
+				++lsrp;
+			}
+		}
 		break;
-	    }
-	}
-    }
 
-    printf(" }");						/* { (ctags) */
-    return 0;
-}
+	case OSPF_TYPE_LSU:
+		if (vflag) {
+			lsap = op->ospf_lsu.lsu_lsa;
+			TCHECK(op->ospf_lsu.lsu_count);
+			i = ntohl(op->ospf_lsu.lsu_count);
+			while (i--) {
+				if (ospf_print_lsa(lsap))
+					goto trunc;
+				lsap = (struct lsa *)((u_char *)lsap +
+				    ntohs(lsap->ls_hdr.ls_length));
+			}
+		}
+		break;
 
 
-void
-ospf_print(register const u_char *bp, register int length,
-	   register const u_char *bp2)
-{
-    register const struct ospfhdr *op;
-    register const struct ip *ip;
-    register const caddr_t end = (caddr_t)snapend;
-    register const struct lsa *lsap;
-    register const struct lsa_hdr *lshp;
-    char sep;
-    int i, j;
-    const struct in_addr *ap;
-    const struct lsr *lsrp;
-
-    op = (struct ospfhdr *)bp;
-    ip = (struct ip  *)bp2;
-    /* Print the source and destination address	*/
-    (void) printf("%s > %s:",
-		  ipaddr_string(&ip->ip_src),
-		  ipaddr_string(&ip->ip_dst));
-
-    if ((caddr_t) (&op->ospf_len + 1) > end) {
-	goto trunc_test;
-    }
-
-    /* If the type is valid translate it, or just print the type */
-    /* value.  If it's not valid, say so and return */
-    if (op->ospf_type || op->ospf_type < OSPF_TYPE_MAX) {
-	printf(" OSPFv%d-%s %d:",
-	       op->ospf_version,
-	       ospf_types[op->ospf_type],
-	       length);
-    } else {
-	printf(" ospf-v%d-??type %d?? %d:",
-	       op->ospf_version,
-	       op->ospf_type,
-	       length);
-	return;
-    }
-
-    if (length != ntohs(op->ospf_len)) {
-	printf(" ??len %d??",
-	       ntohs(op->ospf_len));
-	goto trunc_test;
-    }
-
-    if ((caddr_t) (&op->ospf_routerid + 1) > end) {
-	goto trunc_test;
-    }
-
-    /* Print the routerid if it is not the same as the source */
-    if (ip->ip_src.s_addr != op->ospf_routerid.s_addr) {
-	printf(" rtrid %s",
-	       ipaddr_string(&op->ospf_routerid));
-    }
-
-    if ((caddr_t) (&op->ospf_areaid + 1) > end) {
-	goto trunc_test;
-    }
-
-    if (op->ospf_areaid.s_addr) {
-	printf(" area %s",
-	       ipaddr_string(&op->ospf_areaid));
-    } else {
-	printf(" backbone");
-    }
-
-    if ((caddr_t) (op->ospf_authdata + OSPF_AUTH_SIZE) > end) {
-	goto trunc_test;
-    }
-
-    if (vflag) {
-	/* Print authentication data (should we really do this?) */
-	switch (ntohs(op->ospf_authtype)) {
-	case OSPF_AUTH_NONE:
-	    break;
-
-	case OSPF_AUTH_SIMPLE:
-	    printf(" auth ");
-	    j = 0;
-	    for (i = 0; i < sizeof (op->ospf_authdata); i++) {
-		if (!isprint(op->ospf_authdata[i])) {
-		    j = 1;
-		    break;
+	case OSPF_TYPE_LSA:
+		if (vflag) {
+			lshp = op->ospf_lsa.lsa_lshdr;
+
+			while (!ospf_print_lshdr(lshp)) {
+							/* { (ctags) */
+				printf(" }");
+				++lshp;
+			}
 		}
-	    }
-	    if (j) {
-		/* Print the auth-data as a string of octets */
-		printf("%s.%s",
-		       ipaddr_string((struct in_addr *) op->ospf_authdata),
-		       ipaddr_string((struct in_addr *) &op->ospf_authdata[sizeof (struct in_addr)]));
-	    } else {
-		/* Print the auth-data as a text string */
-		printf("'%.8s'",
-		       op->ospf_authdata);
-	    }
-	    break;
+		break;
 
 	default:
-	    printf(" ??authtype-%d??",
-		   ntohs(op->ospf_authtype));
-	    return;
+		printf("v2 type %d", op->ospf_type);
+		break;
 	}
-    }
-
-
-    /* Do rest according to version.	*/
-    switch (op->ospf_version) {
-    case 2:
-        /* ospf version 2	*/
-	switch (op->ospf_type) {
-	case OSPF_TYPE_UMD:		/* Rob Coltun's special monitoring packets; do nothing	*/
-	    break;
+	return (0);
+trunc:
+	return (1);
+}
 
-	case OSPF_TYPE_HELLO:
-	    if ((caddr_t) (&op->ospf_hello.hello_deadint + 1) > end) {
-		break;
-	    }
-	    if (vflag) {
-		ospf_print_bits(ospf_option_bits, op->ospf_hello.hello_options);
-		printf(" mask %s int %d pri %d dead %u",
-		       ipaddr_string(&op->ospf_hello.hello_mask),
-		       ntohs(op->ospf_hello.hello_helloint),
-		       op->ospf_hello.hello_priority,
-		       (u_int32_t)ntohl(op->ospf_hello.hello_deadint));
-	    }
-
-	    if ((caddr_t) (&op->ospf_hello.hello_dr + 1) > end) {
-		break;
-	    }
-	    if (op->ospf_hello.hello_dr.s_addr) {
-		printf(" dr %s",
-		       ipaddr_string(&op->ospf_hello.hello_dr));
-	    }
+void
+ospf_print(register const u_char *bp, register u_int length,
+    register const u_char *bp2)
+{
+	register const struct ospfhdr *op;
+	register const struct ip *ip;
+	register const u_char *dataend;
+	register const char *cp;
+
+	op = (struct ospfhdr *)bp;
+	ip = (struct ip *)bp2;
+	/* Print the source and destination address  */
+	(void) printf("%s > %s:",
+	    ipaddr_string(&ip->ip_src),
+	    ipaddr_string(&ip->ip_dst));
+
+	/* If the type is valid translate it, or just print the type */
+	/* value.  If it's not valid, say so and return */
+	TCHECK(op->ospf_type);
+	cp = tok2str(type2str, "type%d", op->ospf_type);
+	printf(" OSPFv%d-%s %d:", op->ospf_version, cp, length);
+	if (*cp == 't')
+		return;
+
+	TCHECK(op->ospf_len);
+	if (length != ntohs(op->ospf_len)) {
+		printf(" [len %d]", ntohs(op->ospf_len));
+		return;
+	}
+	dataend = bp + length;
 
-	    if ((caddr_t) (&op->ospf_hello.hello_bdr + 1) > end) {
-		break;
-	    }
-	    if (op->ospf_hello.hello_bdr.s_addr) {
-		printf(" bdr %s",
-		       ipaddr_string(&op->ospf_hello.hello_bdr));
-	    }
-
-	    if (vflag) {
-		if ((caddr_t) (op->ospf_hello.hello_neighbor + 1) > end) {
-		    break;
-		}
-		printf(" nbrs");
-		for (ap = op->ospf_hello.hello_neighbor;
-		     (caddr_t) (ap + 1) <= end;
-		     ap++) {
-		    printf(" %s",
-			   ipaddr_string(ap));
-		}
-	    }
-	    break;			/*  HELLO	*/
+	/* Print the routerid if it is not the same as the source */
+	TCHECK(op->ospf_routerid);
+	if (ip->ip_src.s_addr != op->ospf_routerid.s_addr)
+		printf(" rtrid %s", ipaddr_string(&op->ospf_routerid));
 
-	case OSPF_TYPE_DB:
-	    if ((caddr_t) (&op->ospf_db.db_seq + 1) > end) {
-		break;
-	    }
-	    ospf_print_bits(ospf_option_bits, op->ospf_db.db_options);
-	    sep = ' ';
-	    if (op->ospf_db.db_flags & OSPF_DB_INIT) {
-		printf("%cI",
-		       sep);
-		sep = '/';
-	    }
-	    if (op->ospf_db.db_flags & OSPF_DB_MORE) {
-		printf("%cM",
-		       sep);
-		sep = '/';
-	    }
-	    if (op->ospf_db.db_flags & OSPF_DB_MASTER) {
-		printf("%cMS",
-		       sep);
-		sep = '/';
-	    }
-	    printf(" S %X", (u_int32_t)ntohl(op->ospf_db.db_seq));
-
-	    if (vflag) {
-		/* Print all the LS adv's */
-		lshp = op->ospf_db.db_lshdr;
-
-		while (!ospf_print_lshdr(lshp, end)) {
-		    printf(" }");				/* { (ctags) */
-		    lshp++;
-		}
-	    }
-	    break;
+	TCHECK(op->ospf_areaid);
+	if (op->ospf_areaid.s_addr != 0)
+		printf(" area %s", ipaddr_string(&op->ospf_areaid));
+	else
+		printf(" backbone");
 
-	case OSPF_TYPE_LSR:
-	    if (vflag) {
-		for (lsrp = op->ospf_lsr; (caddr_t) (lsrp+1) <= end; lsrp++) {
-		    int32_t type;
+	if (vflag) {
+		/* Print authentication data (should we really do this?) */
+		TCHECK2(op->ospf_authdata[0], sizeof(op->ospf_authdata));
+		switch (ntohs(op->ospf_authtype)) {
 
-		    if ((caddr_t) (lsrp + 1) > end) {
+		case OSPF_AUTH_NONE:
 			break;
-		    }
 
-		    printf(" {");				/* } (ctags) */
-		    if (!(type = ntohl(lsrp->ls_type)) || type >= LS_TYPE_MAX) {
-			printf(" ??LinkStateType %d }", type);	/* { (ctags) */
-			printf(" }");				/* { (ctags) */
+		case OSPF_AUTH_SIMPLE:
+			printf(" auth \"");
+			(void)fn_printn(op->ospf_authdata,
+			    sizeof(op->ospf_authdata), NULL);
+			printf("\"");
 			break;
-		    }
 
-		    LS_PRINT(lsrp, type);
-		    printf(" }");				/* { (ctags) */
+		default:
+			printf(" ??authtype-%d??", ntohs(op->ospf_authtype));
+			return;
 		}
-	    }
-	    break;
-
-	case OSPF_TYPE_LSU:
-	    if (vflag) {
-		lsap = op->ospf_lsu.lsu_lsa;
-		i = ntohl(op->ospf_lsu.lsu_count);
-
-		while (i-- &&
-		       !ospf_print_lsa(lsap, end)) {
-		    lsap = (struct lsa *) ((caddr_t) lsap + ntohs(lsap->ls_hdr.ls_length));
-		}
-	    }
-	    break;
-
+	}
+	/* Do rest according to version.	 */
+	switch (op->ospf_version) {
 
-	case OSPF_TYPE_LSA:
-	    if (vflag) {
-		lshp = op->ospf_lsa.lsa_lshdr;
+	case 2:
+		/* ospf version 2 */
+		if (ospf_decode_v2(op, dataend))
+			goto trunc;
+		break;
 
-		while (!ospf_print_lshdr(lshp, end)) {
-		    printf(" }");				/* { (ctags) */
-		    lshp++;
-		}
+	default:
+		printf(" ospf [version %d]", op->ospf_version);
 		break;
-	    }
-	}			/* end switch on v2 packet type	*/
-	break;
-
-    default:
-	printf(" ospf [version %d]",
-	       op->ospf_version);
-	break;
-    }					/* end switch on version	*/
-
-  trunc_test:
-    if ((snapend - bp) < length) {
-	printf(" [|]");
-    }
-
-    return;				/* from ospf_print	*/
+	}			/* end switch on version */
+
+	return;
+trunc:
+	fputs(tstr, stdout);
 }
diff --git a/usr.sbin/tcpdump/print-pim.c b/usr.sbin/tcpdump/print-pim.c
index 675a2c41eee..f550f161189 100644
--- a/usr.sbin/tcpdump/print-pim.c
+++ b/usr.sbin/tcpdump/print-pim.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-pim.c,v 1.1 1996/07/13 11:01:28 mickey Exp $	*/
-
 /*
- * Copyright (c) 1995
+ * Copyright (c) 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-pim.c,v 1.4 95/10/07 22:13:12 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-pim.c,v 1.2 1996/12/12 16:22:29 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -47,9 +44,8 @@ static char rcsid[] =
 #include "interface.h"
 #include "addrtoname.h"
 
-
 void
-pim_print(register const u_char *bp, register int len)
+pim_print(register const u_char *bp, register u_int len)
 {
     register const u_char *ep;
     register u_char type;
diff --git a/usr.sbin/tcpdump/print-ppp.c b/usr.sbin/tcpdump/print-ppp.c
index 7c4f369cda5..c5a8eceef1f 100644
--- a/usr.sbin/tcpdump/print-ppp.c
+++ b/usr.sbin/tcpdump/print-ppp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-ppp.c,v 1.4 1996/07/13 11:01:28 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static  char rcsid[] =
-	"@(#)Header: print-ppp.c,v 1.21 96/06/03 02:54:07 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ppp.c,v 1.5 1996/12/12 16:22:28 bitblt Exp $ (LBL)";
 #endif
 
 #ifdef PPP
@@ -59,8 +57,8 @@ void
 ppp_if_print(u_char *user, const struct pcap_pkthdr *h,
 	     register const u_char *p)
 {
-	register int length = h->len;
-	register int caplen = h->caplen;
+	register u_int length = h->len;
+	register u_int caplen = h->caplen;
 	const struct ip *ip;
 
 	ts_print(&h->ts);
diff --git a/usr.sbin/tcpdump/print-rip.c b/usr.sbin/tcpdump/print-rip.c
index 6f2c15c461e..0f14f24eb41 100644
--- a/usr.sbin/tcpdump/print-rip.c
+++ b/usr.sbin/tcpdump/print-rip.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-rip.c,v 1.4 1996/07/13 11:01:29 mickey Exp $	*/
-
 /*
  * Copyright (c) 1989, 1990, 1991, 1993, 1994, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-rip.c,v 1.30 96/06/24 22:12:54 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-rip.c,v 1.5 1996/12/12 16:22:28 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -70,13 +67,13 @@ rip_entry_print(register int vers, register const struct rip_netinfo *ni)
 {
 	register u_char *cp, *ep;
 
-	if (EXTRACT_SHORT(&ni->rip_family) != AF_INET) {
+	if (EXTRACT_16BITS(&ni->rip_family) != AF_INET) {
 
-		printf(" [family %d:", EXTRACT_SHORT(&ni->rip_family));
+		printf(" [family %d:", EXTRACT_16BITS(&ni->rip_family));
 		cp = (u_char *)&ni->rip_tag;
 		ep = (u_char *)&ni->rip_metric + sizeof(ni->rip_metric);
 		for (; cp < ep; cp += 2)
-			printf(" %04x", EXTRACT_SHORT(cp));
+			printf(" %04x", EXTRACT_16BITS(cp));
 		printf("]");
 	} else if (vers < 2) {
 		/* RFC 1058 */
@@ -89,20 +86,20 @@ rip_entry_print(register int vers, register const struct rip_netinfo *ni)
 		if (ni->rip_router)
 			printf("->%s", ipaddr_string(&ni->rip_router));
 		if (ni->rip_tag)
-			printf(" tag %04x", EXTRACT_SHORT(&ni->rip_tag));
+			printf(" tag %04x", EXTRACT_16BITS(&ni->rip_tag));
 		printf("}");
 	}
-	printf("(%d)", EXTRACT_LONG(&ni->rip_metric));
+	printf("(%d)", EXTRACT_32BITS(&ni->rip_metric));
 }
 
 void
-rip_print(const u_char *dat, int length)
+rip_print(const u_char *dat, u_int length)
 {
 	register const struct rip *rp;
 	register const struct rip_netinfo *ni;
 	register int i, j, trunc;
 
-	i = min(length, snapend - dat) - (sizeof(*rp) - sizeof(*ni));
+	i = min(length, snapend - dat) - sizeof(*rp);
 	if (i < 0)
 		return;
 
@@ -128,9 +125,9 @@ rip_print(const u_char *dat, int length)
 		break;
 
 	case RIPCMD_TRACEON:
-		printf(" rip-traceon %d: ", length);
+		printf(" rip-traceon %d: \"", length);
 		(void)fn_print((const u_char *)(rp + 1), snapend);
-		putchar('\n');
+		fputs("\"\n", stdout);
 		break;
 
 	case RIPCMD_TRACEOFF:
diff --git a/usr.sbin/tcpdump/print-sl.c b/usr.sbin/tcpdump/print-sl.c
index dabd44d1cd9..405afff3eab 100644
--- a/usr.sbin/tcpdump/print-sl.c
+++ b/usr.sbin/tcpdump/print-sl.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-sl.c,v 1.5 1996/08/18 21:47:57 deraadt Exp $	*/
-
 /*
  * Copyright (c) 1989, 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,11 +20,11 @@
  */
 
 #ifndef lint
-static  char rcsid[] =
-	"@(#)Header: print-sl.c,v 1.36 96/06/23 02:11:46 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-sl.c,v 1.6 1996/12/12 16:22:27 bitblt Exp $ (LBL)";
 #endif
 
-#ifdef CSLIP
+#ifdef HAVE_NET_SLIP_H
 #include <sys/param.h>
 #include <sys/time.h>
 #include <sys/timeb.h>
@@ -63,11 +61,11 @@ struct rtentry;
 #include "addrtoname.h"
 #include "extract.h"			/* must come after interface.h */
 
-static int lastlen[2][256];
-static int lastconn = 255;
+static u_int lastlen[2][256];
+static u_int lastconn = 255;
 
-static void sliplink_print(const u_char *, const struct ip *, int);
-static void compressed_sl_print(const u_char *, const struct ip *, int, int);
+static void sliplink_print(const u_char *, const struct ip *, u_int);
+static void compressed_sl_print(const u_char *, const struct ip *, u_int, int);
 
 /* XXX BSD/OS 2.1 compatibility */
 #if !defined(SLIP_HDRLEN) && defined(SLC_BPFHDR)
@@ -80,8 +78,8 @@ static void compressed_sl_print(const u_char *, const struct ip *, int, int);
 void
 sl_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 {
-	register int caplen = h->caplen;
-	register int length = h->len;
+	register u_int caplen = h->caplen;
+	register u_int length = h->len;
 	register const struct ip *ip;
 
 	ts_print(&h->ts);
@@ -115,10 +113,10 @@ sl_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
 
 static void
 sliplink_print(register const u_char *p, register const struct ip *ip,
-	       register int length)
+	       register u_int length)
 {
 	int dir;
-	int hlen;
+	u_int hlen;
 
 	dir = p[SLX_DIR];
 	putchar(dir == SLIPDIR_IN ? 'I' : 'O');
@@ -141,7 +139,7 @@ sliplink_print(register const u_char *p, register const struct ip *ip,
 
 	case TYPE_UNCOMPRESSED_TCP:
 		/*
-		 * The connection id is stored in the IP protcol field.
+		 * The connection id is stored in the IP protocol field.
 		 * Get it from the link layer since sl_uncompress_tcp()
 		 * has restored the IP header copy to IPPROTO_TCP.
 		 */
@@ -168,7 +166,7 @@ print_sl_change(const char *str, register const u_char *cp)
 	register u_int i;
 
 	if ((i = *cp++) == 0) {
-		i = EXTRACT_SHORT(cp);
+		i = EXTRACT_16BITS(cp);
 		cp += 2;
 	}
 	printf(" %s%d", str, i);
@@ -181,7 +179,7 @@ print_sl_winchange(register const u_char *cp)
 	register short i;
 
 	if ((i = *cp++) == 0) {
-		i = EXTRACT_SHORT(cp);
+		i = EXTRACT_16BITS(cp);
 		cp += 2;
 	}
 	if (i >= 0)
@@ -193,11 +191,10 @@ print_sl_winchange(register const u_char *cp)
 
 static void
 compressed_sl_print(const u_char *chdr, const struct ip *ip,
-		    int length, int dir)
+		    u_int length, int dir)
 {
 	register const u_char *cp = chdr;
-	register u_int flags;
-	int hlen;
+	register u_int flags, hlen;
 
 	flags = *cp++;
 	if (flags & NEW_C) {
@@ -246,6 +243,7 @@ compressed_sl_print(const u_char *chdr, const struct ip *ip,
 #include <sys/types.h>
 #include <sys/time.h>
 
+#include <pcap.h>
 #include <stdio.h>
 
 #include "interface.h"
diff --git a/usr.sbin/tcpdump/print-snmp.c b/usr.sbin/tcpdump/print-snmp.c
index 89e80d2acc8..0a6f35f4cb6 100644
--- a/usr.sbin/tcpdump/print-snmp.c
+++ b/usr.sbin/tcpdump/print-snmp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-snmp.c,v 1.4 1996/07/13 11:01:30 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -41,14 +39,14 @@
  #	responsibility for the use of this software.
  #	@(#)snmp.awk.x	1.1 (LANL) 1/15/90
  */
+
 #ifndef lint
-static char rcsid[] =
-    "@(#) Id: print-snmp.c,v 3.10 91/01/17 01:18:13 loverso Exp Locker: loverso (jlv)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-snmp.c,v 1.5 1996/12/12 16:22:27 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 
 #include <stdio.h>
 #include <ctype.h>
@@ -161,8 +159,8 @@ char *GenericTrap[] = {
 struct {
 	char	*name;
 	char	**Id;
-	int	numIDs;
-} Class[] = {
+	    int	numIDs;
+    } Class[] = {
 	defineCLASS(Universal),
 #define	UNIVERSAL	0
 	defineCLASS(Application),
@@ -260,7 +258,8 @@ struct be {
 		u_int32_t uns;
 		const u_char *str;
 	} data;
-	u_char form, class, id;		/* tag info */
+	u_short id;
+	u_char form, class;		/* tag info */
 	u_char type;
 #define BE_ANY		255
 #define BE_NONE		0
@@ -315,7 +314,7 @@ static int truncated;
  * O/w, this returns the number of bytes parsed from "p".
  */
 static int
-asn1_parse(register const u_char *p, int len, struct be *elem)
+asn1_parse(register const u_char *p, u_int len, struct be *elem)
 {
 	u_char form, class, id;
 	int i, hdr;
@@ -340,8 +339,8 @@ asn1_parse(register const u_char *p, int len, struct be *elem)
 	class = form >> 1;		/* bits 7&6 -> bits 1&0, range 0-3 */
 	form &= 0x1;			/* bit 5 -> bit 0, range 0-1 */
 #else
-	form = (*p & ASN_FORM_BITS) >> ASN_FORM_SHIFT;
-	class = (*p & ASN_CLASS_BITS) >> ASN_CLASS_SHIFT;
+	form = (u_char)(*p & ASN_FORM_BITS) >> ASN_FORM_SHIFT;
+	class = (u_char)(*p & ASN_CLASS_BITS) >> ASN_CLASS_SHIFT;
 #endif
 	elem->form = form;
 	elem->class = class;
@@ -354,12 +353,16 @@ asn1_parse(register const u_char *p, int len, struct be *elem)
 		for (id = 0; *p & ASN_BIT8 && len > 0; len--, hdr++, p++) {
 			if (vflag)
 				printf("|%.2x", *p);
-			id += *p & ~ASN_BIT8;
+			id = (id << 7) | (*p & ~ASN_BIT8);
 		}
 		if (len == 0 && *p & ASN_BIT8) {
 			ifNotTruncated fputs("[Xtagfield?]", stdout);
 			return -1;
 		}
+		elem->id = id = (id << 7) | *p;
+		--len;
+		++hdr;
+		++p;
 	}
 	if (len < 1) {
 		ifNotTruncated fputs("[no asnlen]", stdout);
@@ -398,7 +401,7 @@ asn1_parse(register const u_char *p, int len, struct be *elem)
 		ifNotTruncated printf("[class?%c/%d]", *Form[form], class);
 		return -1;
 	}
-	if (id >= Class[class].numIDs) {
+	if ((int)id >= Class[class].numIDs) {
 		ifNotTruncated printf("[id?%c/%s/%d]", *Form[form],
 			Class[class].name, id);
 		return -1;
@@ -595,9 +598,11 @@ asn1_print(struct be *elem)
 		for (i = asnlen; printable && i-- > 0; p++)
 			printable = isprint(*p) || isspace(*p);
 		p = elem->data.str;
-		if (printable)
+		if (printable) {
+			putchar('"');
 			(void)fn_print(p, p + asnlen);
-		else
+			putchar('"');
+		} else
 			for (i = asnlen; i-- > 0; p++) {
 				printf(first ? "%.2x" : "_%.2x", *p);
 				first = 0;
@@ -648,7 +653,7 @@ asn1_print(struct be *elem)
  * This is not currently used.
  */
 static void
-asn1_decode(u_char *p, int length)
+asn1_decode(u_char *p, u_int length)
 {
 	struct be elem;
 	int i = 0;
@@ -707,7 +712,7 @@ asn1_decode(u_char *p, int length)
  * Decode SNMP varBind
  */
 static void
-varbind_print(u_char pduid, const u_char *np, int length, int error)
+varbind_print(u_char pduid, const u_char *np, u_int length, int error)
 {
 	struct be elem;
 	int count = 0, ind;
@@ -728,7 +733,7 @@ varbind_print(u_char pduid, const u_char *np, int length, int error)
 
 	for (ind = 1; length > 0; ind++) {
 		const u_char *vbend;
-		int vblength;
+		u_int vblength;
 
 		if (!error || ind == error)
 			fputs(" ", stdout);
@@ -786,7 +791,7 @@ varbind_print(u_char pduid, const u_char *np, int length, int error)
  * Decode SNMP PDUs: GetRequest, GetNextRequest, GetResponse, and SetRequest
  */
 static void
-snmppdu_print(u_char pduid, const u_char *np, int length)
+snmppdu_print(u_char pduid, const u_char *np, u_int length)
 {
 	struct be elem;
 	int count = 0, error;
@@ -859,7 +864,7 @@ snmppdu_print(u_char pduid, const u_char *np, int length)
  * Decode SNMP Trap PDU
  */
 static void
-trap_print(const u_char *np, int length)
+trap_print(const u_char *np, u_int length)
 {
 	struct be elem;
 	int count = 0, generic;
@@ -946,7 +951,7 @@ trap_print(const u_char *np, int length)
  * Decode SNMP header and pass on to PDU printing routines
  */
 void
-snmp_print(const u_char *np, int length)
+snmp_print(const u_char *np, u_int length)
 {
 	struct be elem, pdu;
 	int count = 0;
diff --git a/usr.sbin/tcpdump/print-sunrpc.c b/usr.sbin/tcpdump/print-sunrpc.c
index 40dc7f68065..07ac4aa337c 100644
--- a/usr.sbin/tcpdump/print-sunrpc.c
+++ b/usr.sbin/tcpdump/print-sunrpc.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-sunrpc.c,v 1.4 1996/07/13 11:01:31 mickey Exp $	*/
-
 /*
- * Copyright (c) 1992, 1993, 1994, 1995
+ * Copyright (c) 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-sunrpc.c,v 1.22 95/10/19 20:27:46 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-sunrpc.c,v 1.5 1996/12/12 16:22:26 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #if __STDC__
@@ -71,7 +68,7 @@ static struct tok proc2str[] = {
 static char *progstr(u_int32_t);
 
 void
-sunrpcrequest_print(register const u_char *bp, register int length,
+sunrpcrequest_print(register const u_char *bp, register u_int length,
 		    register const u_char *bp2)
 {
 	register const struct rpc_msg *rp;
diff --git a/usr.sbin/tcpdump/print-tcp.c b/usr.sbin/tcpdump/print-tcp.c
index bc3a90f6342..0277aa8981d 100644
--- a/usr.sbin/tcpdump/print-tcp.c
+++ b/usr.sbin/tcpdump/print-tcp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-tcp.c,v 1.4 1996/07/13 11:01:31 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-tcp.c,v 1.40 96/06/24 15:29:37 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-tcp.c,v 1.5 1996/12/12 16:22:26 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
@@ -46,6 +43,7 @@ static char rcsid[] =
 #include "addrtoname.h"
 #include "extract.h"
 
+/* Compatibility */
 #ifndef TCPOPT_WSCALE
 #define	TCPOPT_WSCALE		3	/* window scale factor (rfc1072) */
 #endif
@@ -74,7 +72,6 @@ static char rcsid[] =
 #define TCPOPT_CCECHO		13	/* T/TCP CC options (rfc1644) */
 #endif
 
-
 struct tha {
 	struct in_addr src;
 	struct in_addr dst;
@@ -97,23 +94,22 @@ static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];
 
 
 void
-tcp_print(register const u_char *bp, register int length,
+tcp_print(register const u_char *bp, register u_int length,
 	  register const u_char *bp2)
 {
 	register const struct tcphdr *tp;
 	register const struct ip *ip;
 	register u_char flags;
 	register int hlen;
+	register char ch;
 	u_short sport, dport, win, urp;
 	u_int32_t seq, ack;
 
 	tp = (struct tcphdr *)bp;
 	ip = (struct ip *)bp2;
-	if ((const u_char *)(tp + 1) > snapend) {
-		printf("[|tcp]");
-		return;
-	}
-	if (length < sizeof(struct tcphdr)) {
+	ch = '\0';
+	TCHECK(*tp);
+	if (length < sizeof(*tp)) {
 		(void)printf("truncated-tcp %d", length);
 		return;
 	}
@@ -177,7 +173,7 @@ tcp_print(register const u_char *bp, register int length,
 			/* didn't find it or new conversation */
 			if (th->nxt == NULL) {
 				th->nxt = (struct tcp_seq_hash *)
-					calloc(1, sizeof (*th));
+					calloc(1, sizeof(*th));
 				if (th->nxt == NULL)
 					error("tcp_print: calloc");
 			}
@@ -194,6 +190,10 @@ tcp_print(register const u_char *bp, register int length,
 		}
 	}
 	hlen = tp->th_off * 4;
+	if (hlen > length) {
+		(void)printf(" [bad hdr length]");
+		return;
+	}
 	length -= hlen;
 	if (length > 0 || flags & (TH_SYN | TH_FIN | TH_RST))
 		(void)printf(" %u:%u(%d)", seq, seq + length, length);
@@ -207,34 +207,39 @@ tcp_print(register const u_char *bp, register int length,
 	/*
 	 * Handle any options.
 	 */
-	if ((hlen -= sizeof(struct tcphdr)) > 0) {
-		register const u_char *cp = (const u_char *)tp + sizeof(*tp);
-		int i, opt, len, datalen;
-		char ch = '<';
+	if ((hlen -= sizeof(*tp)) > 0) {
+		register const u_char *cp;
+		register int i, opt, len, datalen;
 
+		cp = (const u_char *)tp + sizeof(*tp);
 		putchar(' ');
-		while (--hlen >= 0) {
+		ch = '<';
+		while (hlen > 0) {
 			putchar(ch);
-			if (cp > snapend)
-				goto trunc;
+			TCHECK(*cp);
 			opt = *cp++;
 			if (ZEROLENOPT(opt))
 				len = 1;
 			else {
-				if (cp > snapend)
-					goto trunc;
-				len = *cp++;
-				--hlen;
+				TCHECK(*cp);
+				len = *cp++;	/* total including type, len */
+				if (len < 2 || len > hlen)
+					goto bad;
+				--hlen;		/* account for length byte */
 			}
+			--hlen;			/* account for type byte */
 			datalen = 0;
+
+/* Bail if "l" bytes of data are not left or were not captured  */
+#define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
+
 			switch (opt) {
 
 			case TCPOPT_MAXSEG:
 				(void)printf("mss");
 				datalen = 2;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_SHORT(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_16BITS(cp));
 
 				break;
 
@@ -249,8 +254,7 @@ tcp_print(register const u_char *bp, register int length,
 			case TCPOPT_WSCALE:
 				(void)printf("wscale");
 				datalen = 1;
-				if (cp + datalen > snapend)
-					goto trunc;
+				LENCHECK(datalen);
 				(void)printf(" %u", *cp);
 				break;
 
@@ -261,14 +265,12 @@ tcp_print(register const u_char *bp, register int length,
 			case TCPOPT_SACK:
 				(void)printf("sack");
 				datalen = len - 2;
-				i = datalen;
-				for (i = datalen; i > 0; i -= 4) {
-					if (cp + i + 4 > snapend)
-						goto trunc;
+				for (i = 0; i < datalen; i += 4) {
+					LENCHECK(i + 4);
 					/* block-size@relative-origin */
 					(void)printf(" %u@%u",
-					    EXTRACT_SHORT(cp + 2),
-					    EXTRACT_SHORT(cp));
+					    EXTRACT_16BITS(cp + i + 2),
+					    EXTRACT_16BITS(cp + i));
 				}
 				if (datalen % 4)
 					(void)printf("[len %d]", len);
@@ -277,61 +279,52 @@ tcp_print(register const u_char *bp, register int length,
 			case TCPOPT_ECHO:
 				(void)printf("echo");
 				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
 				break;
 
 			case TCPOPT_ECHOREPLY:
 				(void)printf("echoreply");
 				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
 				break;
 
 			case TCPOPT_TIMESTAMP:
 				(void)printf("timestamp");
-				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
-				datalen += 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp + 4));
+				datalen = 8;
+				LENCHECK(4);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp + 4));
 				break;
 
 			case TCPOPT_CC:
 				(void)printf("cc");
 				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
 				break;
 
 			case TCPOPT_CCNEW:
 				(void)printf("ccnew");
 				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
 				break;
 
 			case TCPOPT_CCECHO:
 				(void)printf("ccecho");
 				datalen = 4;
-				if (cp + datalen > snapend)
-					goto trunc;
-				(void)printf(" %u", EXTRACT_LONG(cp));
+				LENCHECK(datalen);
+				(void)printf(" %u", EXTRACT_32BITS(cp));
 				break;
 
 			default:
 				(void)printf("opt-%d:", opt);
 				datalen = len - 2;
 				for (i = 0; i < datalen; ++i) {
-					if (cp + i > snapend)
-						goto trunc;
+					LENCHECK(i);
 					(void)printf("%02x", cp[i]);
 				}
 				break;
@@ -348,11 +341,20 @@ tcp_print(register const u_char *bp, register int length,
 			if (datalen != len)
 				(void)printf("[len %d]", len);
 			ch = ',';
+			if (opt == TCPOPT_EOL)
+				break;
 		}
 		putchar('>');
 	}
 	return;
+bad:
+	fputs("[bad opt]", stdout);
+	if (ch != '\0')
+		putchar('>');
+	return;
 trunc:
-	(void)printf("[|tcp]>");
+	fputs("[|tcp]", stdout);
+	if (ch != '\0')
+		putchar('>');
 }
 
diff --git a/usr.sbin/tcpdump/print-tftp.c b/usr.sbin/tcpdump/print-tftp.c
index a0c7bfbd68c..922e0c03f7c 100644
--- a/usr.sbin/tcpdump/print-tftp.c
+++ b/usr.sbin/tcpdump/print-tftp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-tftp.c,v 1.4 1996/07/13 11:01:32 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -24,13 +22,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-tftp.c,v 1.23 96/06/23 02:11:47 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-tftp.c,v 1.5 1996/12/12 16:22:25 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 
 #include <netinet/in.h>
 
@@ -70,24 +67,21 @@ static struct tok err2str[] = {
  * Print trivial file transfer program requests
  */
 void
-tftp_print(register const u_char *bp, int length)
+tftp_print(register const u_char *bp, u_int length)
 {
 	register const struct tftphdr *tp;
 	register const char *cp;
-	register const u_char *ep, *p;
-	register int opcode;
-#define TCHECK(var, l) if ((u_char *)&(var) > ep - l) goto trunc
+	register const u_char *p;
+	register int opcode, i;
 	static char tstr[] = " [|tftp]";
 
 	tp = (const struct tftphdr *)bp;
-	/* 'ep' points to the end of available data. */
-	ep = snapend;
 
 	/* Print length */
 	printf(" %d", length);
 
 	/* Print tftp request type */
-	TCHECK(tp->th_opcode, sizeof(tp->th_opcode));
+	TCHECK(tp->th_opcode);
 	opcode = ntohs(tp->th_opcode);
 	cp = tok2str(op2str, "tftp-#%d", opcode);
 	printf(" %s", cp);
@@ -99,7 +93,6 @@ tftp_print(register const u_char *bp, int length)
 
 	case RRQ:
 	case WRQ:
-		putchar(' ');
 		/*
 		 * XXX Not all arpa/tftp.h's specify th_stuff as any
 		 * array; use address of th_block instead
@@ -109,28 +102,29 @@ tftp_print(register const u_char *bp, int length)
 #else
 		p = (u_char *)&tp->th_block;
 #endif
-		if (fn_print(p, ep)) {
-			fputs(&tstr[1], stdout);
-			return;
-		}
+		fputs(" \"", stdout);
+		i = fn_print(p, snapend);
+		putchar('"');
+		if (i)
+			goto trunc;
 		break;
 
 	case ACK:
 	case DATA:
-		TCHECK(tp->th_block, sizeof(tp->th_block));
+		TCHECK(tp->th_block);
 		printf(" block %d", ntohs(tp->th_block));
 		break;
 
 	case ERROR:
 		/* Print error code string */
-		TCHECK(tp->th_code, sizeof(tp->th_code));
-		printf(" %s ", tok2str(err2str, "tftp-err-#%d",
+		TCHECK(tp->th_code);
+		printf(" %s ", tok2str(err2str, "tftp-err-#%d \"",
 				       ntohs(tp->th_code)));
 		/* Print error message string */
-		if (fn_print((const u_char *)tp->th_data, ep)) {
-			fputs(&tstr[1], stdout);
-			return;
-		}
+		i = fn_print((const u_char *)tp->th_data, snapend);
+		putchar('"');
+		if (i)
+			goto trunc;
 		break;
 
 	default:
@@ -141,5 +135,5 @@ tftp_print(register const u_char *bp, int length)
 	return;
 trunc:
 	fputs(tstr, stdout);
-#undef TCHECK
+	return;
 }
diff --git a/usr.sbin/tcpdump/print-udp.c b/usr.sbin/tcpdump/print-udp.c
index d67aa6b26f1..3461c7aedf2 100644
--- a/usr.sbin/tcpdump/print-udp.c
+++ b/usr.sbin/tcpdump/print-udp.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: print-udp.c,v 1.4 1996/07/13 11:01:32 mickey Exp $	*/
-
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,13 +20,12 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-udp.c,v 1.51 96/06/23 02:26:12 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-udp.c,v 1.5 1996/12/12 16:22:24 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/time.h>
-#include <sys/types.h>
 #include <sys/socket.h>
 
 #include <netinet/in.h>
@@ -39,6 +36,7 @@ static char rcsid[] =
 #include <netinet/udp_var.h>
 
 #undef NOERROR					/* Solaris sucks */
+#undef T_UNSPEC					/* SINIX does too */
 #include <arpa/nameser.h>
 #include <arpa/tftp.h>
 
@@ -55,7 +53,7 @@ static char rcsid[] =
 
 struct rtcphdr {
 	u_short rh_flags;	/* T:2 P:1 CNT:5 PT:8 */
-	u_short rh_len;		/* length of message (in bytes) */
+	u_short rh_len;		/* length of message (in words) */
 	u_int rh_ssrc;		/* synchronization src id */
 };
 
@@ -79,30 +77,31 @@ struct rtcp_sr {
  * Time stamps are middle 32-bits of ntp timestamp.
  */
 struct rtcp_rr {
-	u_int rr_srcid;	/* sender being reported */
-	u_int rr_nr;		/* no. packets received */
-	u_int rr_np;		/* no. packets predicted */
+	u_int rr_srcid;		/* sender being reported */
+	u_int rr_nl;		/* no. packets lost */
+	u_int rr_ls;		/* extended last seq number received */
 	u_int rr_dv;		/* jitter (delay variance) */
 	u_int rr_lsr;		/* orig. ts from last rr from this src  */
 	u_int rr_dlsr;		/* time from recpt of last rr to xmit time */
 };
 
 /*XXX*/
-#define RTCP_PT_SR	0
-#define RTCP_PT_RR	1
-#define RTCP_PT_SDES	2
+#define RTCP_PT_SR	200
+#define RTCP_PT_RR	201
+#define RTCP_PT_SDES	202
 #define 	RTCP_SDES_CNAME	1
 #define 	RTCP_SDES_NAME	2
 #define 	RTCP_SDES_EMAIL	3
 #define 	RTCP_SDES_PHONE	4
 #define 	RTCP_SDES_LOC	5
 #define 	RTCP_SDES_TOOL	6
-#define 	RTCP_SDES_TXT	7
-#define RTCP_PT_BYE	3
-#define RTCP_PT_APP	4
+#define 	RTCP_SDES_NOTE	7
+#define 	RTCP_SDES_PRIV	8
+#define RTCP_PT_BYE	203
+#define RTCP_PT_APP	204
 
 static void
-vat_print(const void *hdr, int len, register const struct udphdr *up)
+vat_print(const void *hdr, u_int len, register const struct udphdr *up)
 {
 	/* vat/vt audio */
 	u_int ts = *(u_short *)hdr;
@@ -128,27 +127,30 @@ vat_print(const void *hdr, int len, register const struct udphdr *up)
 }
 
 static void
-rtp_print(const void *hdr, int len, register const struct udphdr *up)
+rtp_print(const void *hdr, u_int len, register const struct udphdr *up)
 {
 	/* rtp v1 or v2 */
 	u_int *ip = (u_int *)hdr;
-	u_int hasopt, contype, hasmarker;
+	u_int hasopt, hasext, contype, hasmarker;
 	u_int i0 = ntohl(((u_int *)hdr)[0]);
 	u_int i1 = ntohl(((u_int *)hdr)[1]);
-	int dlen = ntohs(up->uh_ulen) - sizeof(*up) - 8;
-	const char* ptype;
+	u_int dlen = ntohs(up->uh_ulen) - sizeof(*up) - 8;
+	const char * ptype;
+
 	ip += 2;
 	len >>= 2;
 	len -= 2;
+	hasopt = 0;
+	hasext = 0;
 	if ((i0 >> 30) == 1) {
 		/* rtp v1 */
 		hasopt = i0 & 0x800000;
 		contype = (i0 >> 16) & 0x3f;
 		hasmarker = i0 & 0x400000;
 		ptype = "rtpv1";
-	} else { /*XXX*/
+	} else {
 		/* rtp v2 */
-		hasopt = i0 & 0x20000000;
+		hasext = i0 & 0x10000000;
 		contype = (i0 >> 16) & 0x7f;
 		hasmarker = i0 & 0x800000;
 		dlen -= 4;
@@ -156,14 +158,16 @@ rtp_print(const void *hdr, int len, register const struct udphdr *up)
 		ip += 1;
 		len -= 1;
 	}
-	printf(" udp/%s %d c%d %s%s %d",
+	printf(" udp/%s %d c%d %s%s %d %u",
 		ptype,
 		dlen,
 		contype,
-		hasopt? "+" : "",
+		(hasopt || hasext)? "+" : "",
 		hasmarker? "*" : "",
-		i0 & 0xffff);
+		i0 & 0xffff,
+		i1);
 	if (vflag) {
+		printf(" %u", i1);
 		if (hasopt) {
 			u_int i2, optlen;
 			do {
@@ -174,50 +178,79 @@ rtp_print(const void *hdr, int len, register const struct udphdr *up)
 					return;
 				}
 				ip += optlen;
+				len -= optlen;
 			} while ((int)i2 >= 0);
 		}
-		if (contype == 0x1f)
+		if (hasext) {
+			u_int i2, extlen;
+			i2 = ip[0];
+			extlen = (i2 & 0xffff) + 1;
+			if (extlen > len) {
+				printf(" !ext");
+				return;
+			}
+			ip += extlen;
+		}
+		if (contype == 0x1f) /*XXX H.261 */
 			printf(" 0x%04x", ip[0] >> 16);
-		printf(" %u", i1);
 	}
 }
 
-static const u_char*
-rtcp_print(const u_char *hdr)
+static const u_char *
+rtcp_print(const u_char *hdr, const u_char *ep)
 {
 	/* rtp v2 control (rtcp) */
-	struct rtcp_rr* rr = 0;
-	struct rtcp_sr* sr;
-	struct rtcphdr* rh = (struct rtcphdr*)hdr;
-	int len = (ntohs(rh->rh_len) + 1) * 4;
-	u_short flags = ntohs(rh->rh_flags);
-	int cnt = (flags >> 8) & 0x1f;
-	double ts, dts, jitter;
-	if (vflag)
-		printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
+	struct rtcp_rr *rr = 0;
+	struct rtcp_sr *sr;
+	struct rtcphdr *rh = (struct rtcphdr *)hdr;
+	u_int len;
+	u_short flags;
+	int cnt;
+	double ts, dts;
+	if ((u_char *)(rh + 1) > ep) {
+		printf(" [|rtcp]");
+		return (ep);
+	}
+	len = (ntohs(rh->rh_len) + 1) * 4;
+	flags = ntohs(rh->rh_flags);
+	cnt = (flags >> 8) & 0x1f;
 	switch (flags & 0xff) {
 	case RTCP_PT_SR:
-		sr = (struct rtcp_sr*)(rh + 1);
+		sr = (struct rtcp_sr *)(rh + 1);
 		printf(" sr");
 		if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
 			printf(" [%d]", len);
-		ts = (double)((u_int32_t)ntohl(sr->sr_ts)) / 65536.;
-		printf(" @%.2f %up %ub", ts, (u_int32_t)ntohl(sr->sr_np),
-		       (u_int32_t)ntohl(sr->sr_nb));
-		rr = (struct rtcp_rr*)(sr + 1);
+		if (vflag)
+		  printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
+		if ((u_char *)(sr + 1) > ep) {
+			printf(" [|rtcp]");
+			return (ep);
+		}
+		ts = (double)((u_int32_t)ntohl(sr->sr_ntp.upper)) +
+		    ((double)((u_int32_t)ntohl(sr->sr_ntp.lower)) /
+		    4294967296.0);
+		printf(" @%.2f %u %up %ub", ts, (u_int32_t)ntohl(sr->sr_ts),
+		    (u_int32_t)ntohl(sr->sr_np), (u_int32_t)ntohl(sr->sr_nb));
+		rr = (struct rtcp_rr *)(sr + 1);
 		break;
 	case RTCP_PT_RR:
 		printf(" rr");
 		if (len != cnt * sizeof(*rr) + sizeof(*rh))
 			printf(" [%d]", len);
-		rr = (struct rtcp_rr*)(rh + 1);
+		rr = (struct rtcp_rr *)(rh + 1);
+		if (vflag)
+		  printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
 		break;
 	case RTCP_PT_SDES:
 		printf(" sdes %d", len);
+		if (vflag)
+		  printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
 		cnt = 0;
 		break;
 	case RTCP_PT_BYE:
 		printf(" bye %d", len);
+		if (vflag)
+		  printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc));
 		cnt = 0;
 		break;
 	default:
@@ -228,19 +261,18 @@ rtcp_print(const u_char *hdr)
 	if (cnt > 1)
 		printf(" c%d", cnt);
 	while (--cnt >= 0) {
-		if ((u_char*)(rr + 1) > snapend) {
+		if ((u_char *)(rr + 1) > ep) {
 			printf(" [|rtcp]");
-			return (snapend);
+			return (ep);
 		}
 		if (vflag)
 			printf(" %u", (u_int32_t)ntohl(rr->rr_srcid));
 		ts = (double)((u_int32_t)ntohl(rr->rr_lsr)) / 65536.;
 		dts = (double)((u_int32_t)ntohl(rr->rr_dlsr)) / 65536.;
-		jitter = (double)((u_int32_t)ntohl(rr->rr_dv)) / 65536.;
-		printf(" %ur %ue %.2fj @%.2f+%.2f",
-		    (u_int32_t)ntohl(rr->rr_nr),
-		    (u_int32_t)ntohl(rr->rr_np),
-		    jitter, ts, dts);
+		printf(" %ul %us %uj @%.2f+%.2f",
+		    (u_int32_t)ntohl(rr->rr_nl) & 0x00ffffff,
+		    (u_int32_t)ntohl(rr->rr_ls),
+		    (u_int32_t)ntohl(rr->rr_dv), ts, dts);
 	}
 	return (hdr + len);
 }
@@ -256,13 +288,16 @@ rtcp_print(const u_char *hdr)
 #define KERBEROS_SEC_PORT 750	/*XXX*/
 
 void
-udp_print(register const u_char *bp, int length, register const u_char *bp2)
+udp_print(register const u_char *bp, u_int length, register const u_char *bp2)
 {
 	register const struct udphdr *up;
 	register const struct ip *ip;
 	register const u_char *cp;
+	register const u_char *ep = bp + length;
 	u_short sport, dport, ulen;
 
+	if (ep > snapend)
+		ep = snapend;
 	up = (struct udphdr *)bp;
 	ip = (struct ip *)bp2;
 	cp = (u_char *)(up + 1);
@@ -329,34 +364,39 @@ udp_print(register const u_char *bp, int length, register const u_char *bp2)
 				udpport_string(sport),
 				ipaddr_string(&ip->ip_dst),
 				udpport_string(dport));
-			while (cp < snapend)
-				cp = rtcp_print(cp);
+			while (cp < ep)
+				cp = rtcp_print(cp, ep);
 			break;
 		}
 		return;
 	}
 
-	if (! qflag) {
+	if (!qflag) {
 		register struct rpc_msg *rp;
 		enum msg_type direction;
 
 		rp = (struct rpc_msg *)(up + 1);
-		direction = (enum msg_type)ntohl(rp->rm_direction);
-		if (dport == NFS_PORT && direction == CALL) {
-			nfsreq_print((u_char *)rp, length, (u_char *)ip);
-			return;
-		}
-		else if (sport == NFS_PORT && direction == REPLY) {
-			nfsreply_print((u_char *)rp, length, (u_char *)ip);
-			return;
-		}
+		if (TTEST(rp->rm_direction)) {
+			direction = (enum msg_type)ntohl(rp->rm_direction);
+			if (dport == NFS_PORT && direction == CALL) {
+				nfsreq_print((u_char *)rp, length,
+				    (u_char *)ip);
+				return;
+			}
+			if (sport == NFS_PORT && direction == REPLY) {
+				nfsreply_print((u_char *)rp, length,
+				    (u_char *)ip);
+				return;
+			}
 #ifdef notdef
-		else if (dport == SUNRPC_PORT && direction == CALL) {
-			sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
-			return;
-		}
+			if (dport == SUNRPC_PORT && direction == CALL) {
+				sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
+				return;
+			}
 #endif
-		else if (((struct LAP *)cp)->type == lapDDP &&
+		}
+		if (TTEST(((struct LAP *)cp)->type) &&
+		    ((struct LAP *)cp)->type == lapDDP &&
 		    (atalk_port(sport) || atalk_port(dport))) {
 			if (vflag)
 				fputs("kip ", stdout);
diff --git a/usr.sbin/tcpdump/print-wb.c b/usr.sbin/tcpdump/print-wb.c
index 5bde81009e2..3286623be37 100644
--- a/usr.sbin/tcpdump/print-wb.c
+++ b/usr.sbin/tcpdump/print-wb.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: print-wb.c,v 1.4 1996/07/13 11:01:33 mickey Exp $	*/
-
 /*
- * Copyright (c) 1993, 1994, 1995
+ * Copyright (c) 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: print-wb.c,v 1.18 95/10/18 22:21:27 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-wb.c,v 1.5 1996/12/12 16:22:24 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/types.h>
@@ -51,7 +49,7 @@ static char rcsid[] =
 #define DOP_ALIGN 4
 #define DOP_ROUNDUP(x)	((((int)(x)) + (DOP_ALIGN - 1)) & ~(DOP_ALIGN - 1))
 #define DOP_NEXT(d)\
-	((struct dophdr*)((u_char *)(d) + \
+	((struct dophdr *)((u_char *)(d) + \
 			  DOP_ROUNDUP(ntohs((d)->dh_len) + sizeof(*(d)))))
 
 /*
@@ -127,7 +125,7 @@ struct pkt_rreq {
         u_int32_t pr_id;           /* source id of drawops to be repaired */
         struct PageID pr_page;           /* page of drawops */
         u_int32_t pr_sseq;         /* start seqno */
-        u_int32_t pr_eseq;         /* end seqno*/
+        u_int32_t pr_eseq;         /* end seqno */
 };
 
 /*
@@ -175,7 +173,7 @@ struct pkt_prep {
 };
 
 static int
-wb_id(const struct pkt_id *id, int len)
+wb_id(const struct pkt_id *id, u_int len)
 {
 	int i;
 	const char *cp;
@@ -200,11 +198,14 @@ wb_id(const struct pkt_id *id, int len)
 	len -= sizeof(*io) * nid;
 	io = (struct id_off *)(id + 1);
 	cp = (char *)(io + nid);
-	if ((u_char *)cp + len <= snapend)
-		fn_print((u_char *)cp, (u_char *)cp + len);
+	if ((u_char *)cp + len <= snapend) {
+		putchar('"');
+		(void)fn_print((u_char *)cp, (u_char *)cp + len);
+		putchar('"');
+	}
 
 	c = '<';
-	for (i = 0; i < nid && (u_char*)io < snapend; ++io, ++i) {
+	for (i = 0; i < nid && (u_char *)io < snapend; ++io, ++i) {
 		printf("%c%s:%u",
 		    c, ipaddr_string(&io->id), (u_int32_t)ntohl(io->off));
 		c = ',';
@@ -217,7 +218,7 @@ wb_id(const struct pkt_id *id, int len)
 }
 
 static int
-wb_rreq(const struct pkt_rreq *rreq, int len)
+wb_rreq(const struct pkt_rreq *rreq, u_int len)
 {
 	printf(" wb-rreq:");
 	if (len < sizeof(*rreq) || (u_char *)(rreq + 1) > snapend)
@@ -233,7 +234,7 @@ wb_rreq(const struct pkt_rreq *rreq, int len)
 }
 
 static int
-wb_preq(const struct pkt_preq *preq, int len)
+wb_preq(const struct pkt_preq *preq, u_int len)
 {
 	printf(" wb-preq:");
 	if (len < sizeof(*preq) || (u_char *)(preq + 1) > snapend)
@@ -247,19 +248,19 @@ wb_preq(const struct pkt_preq *preq, int len)
 }
 
 static int
-wb_prep(const struct pkt_prep *prep, int len)
+wb_prep(const struct pkt_prep *prep, u_int len)
 {
 	int n;
-	const struct pgstate* ps;
-	const u_char* ep = snapend;
+	const struct pgstate *ps;
+	const u_char *ep = snapend;
 
 	printf(" wb-prep:");
 	if (len < sizeof(*prep)) {
 		return (-1);
 	}
 	n = ntohl(prep->pp_n);
-	ps = (const struct pgstate*)(prep + 1);
-	while (--n >= 0 && (u_char*)ps < ep) {
+	ps = (const struct pgstate *)(prep + 1);
+	while (--n >= 0 && (u_char *)ps < ep) {
 		const struct id_off *io, *ie;
 		char c = '<';
 
@@ -267,16 +268,16 @@ wb_prep(const struct pkt_prep *prep, int len)
 		    (u_int32_t)ntohl(ps->slot),
 		    ipaddr_string(&ps->page.p_sid),
 		    (u_int32_t)ntohl(ps->page.p_uid));
-		io = (struct id_off*)(ps + 1);
-		for (ie = io + ps->nid; io < ie && (u_char*)io < ep; ++io) {
+		io = (struct id_off *)(ps + 1);
+		for (ie = io + ps->nid; io < ie && (u_char *)io < ep; ++io) {
 			printf("%c%s:%u", c, ipaddr_string(&io->id),
 			    (u_int32_t)ntohl(io->off));
 			c = ',';
 		}
 		printf(">");
-		ps = (struct pgstate*)io;
+		ps = (struct pgstate *)io;
 	}
-	return ((u_char*)ps <= ep? 0 : -1);
+	return ((u_char *)ps <= ep? 0 : -1);
 }
 
 
@@ -322,7 +323,7 @@ wb_dops(const struct dophdr *dh, u_int32_t ss, u_int32_t es)
 			}
 		}
 		dh = DOP_NEXT(dh);
-		if ((u_char*)dh >= snapend) {
+		if ((u_char *)dh > snapend) {
 			printf("[|wb]");
 			break;
 		}
@@ -332,7 +333,7 @@ wb_dops(const struct dophdr *dh, u_int32_t ss, u_int32_t es)
 }
 
 static int
-wb_rrep(const struct pkt_rrep *rrep, int len)
+wb_rrep(const struct pkt_rrep *rrep, u_int len)
 {
 	const struct pkt_dop *dop = &rrep->pr_dop;
 
@@ -349,13 +350,13 @@ wb_rrep(const struct pkt_rrep *rrep, int len)
 	    (u_int32_t)ntohl(dop->pd_eseq));
 
 	if (vflag)
-		return (wb_dops((const struct dophdr*)(dop + 1),
+		return (wb_dops((const struct dophdr *)(dop + 1),
 		    ntohl(dop->pd_sseq), ntohl(dop->pd_eseq)));
 	return (0);
 }
 
 static int
-wb_drawop(const struct pkt_dop *dop, int len)
+wb_drawop(const struct pkt_dop *dop, u_int len)
 {
 	printf(" wb-dop:");
 	len -= sizeof(*dop);
@@ -369,7 +370,7 @@ wb_drawop(const struct pkt_dop *dop, int len)
 	    (u_int32_t)ntohl(dop->pd_eseq));
 
 	if (vflag)
-		return (wb_dops((const struct dophdr*)(dop + 1),
+		return (wb_dops((const struct dophdr *)(dop + 1),
 				ntohl(dop->pd_sseq), ntohl(dop->pd_eseq)));
 	return (0);
 }
@@ -378,11 +379,11 @@ wb_drawop(const struct pkt_dop *dop, int len)
  * Print whiteboard multicast packets.
  */
 void
-wb_print(register const void *hdr, register int len)
+wb_print(register const void *hdr, register u_int len)
 {
-	register const struct pkt_hdr* ph;
+	register const struct pkt_hdr *ph;
 
-	ph = (const struct pkt_hdr*)hdr;
+	ph = (const struct pkt_hdr *)hdr;
 	len -= sizeof(*ph);
 	if (len < 0 || (u_char *)(ph + 1) <= snapend) {
 		if (ph->ph_flags)
diff --git a/usr.sbin/tcpdump/send-ack.awk b/usr.sbin/tcpdump/send-ack.awk
index c59c6ce9ec6..f55b7c2f6d1 100644
--- a/usr.sbin/tcpdump/send-ack.awk
+++ b/usr.sbin/tcpdump/send-ack.awk
@@ -1,6 +1,3 @@
-#	$OpenBSD: send-ack.awk,v 1.3 1996/06/10 07:47:54 deraadt Exp $
-#	$NetBSD: send-ack.awk,v 1.2 1995/03/06 19:11:42 mycroft Exp $
-
 BEGIN	{
 	# we need the number of bytes in a packet to do the output
 	# in packet numbers rather than byte numbers.
diff --git a/usr.sbin/tcpdump/stime.awk b/usr.sbin/tcpdump/stime.awk
index 7699e675c20..61891f247b9 100644
--- a/usr.sbin/tcpdump/stime.awk
+++ b/usr.sbin/tcpdump/stime.awk
@@ -1,6 +1,3 @@
-#	$OpenBSD: stime.awk,v 1.3 1996/06/10 07:47:55 deraadt Exp $
-#	$NetBSD: stime.awk,v 1.2 1995/03/06 19:11:43 mycroft Exp $
-
 $6 !~ /^ack/ && $5 !~ /[SFR]/ 	{
 	# given a tcpdump ftp trace, output one line for each send
 	# in the form
diff --git a/usr.sbin/tcpdump/strcasecmp.c b/usr.sbin/tcpdump/strcasecmp.c
new file mode 100644
index 00000000000..f2ac0771318
--- /dev/null
+++ b/usr.sbin/tcpdump/strcasecmp.c
@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 1987 Regents of the University of California.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and that due credit is given
+ * to the University of California at Berkeley. The name of the University
+ * may not be used to endorse or promote products derived from this
+ * software without specific written prior permission. This software
+ * is provided ``as is'' without express or implied warranty.
+ */
+
+#if defined(LIBC_SCCS) && !defined(lint)
+static const char sccsid[] = "@(#)strcasecmp.c	5.5 (Berkeley) 11/24/87";
+#endif /* LIBC_SCCS and not lint */
+
+#include <sys/types.h>
+
+#include "interface.h"
+
+/*
+ * This array is designed for mapping upper and lower case letter
+ * together for a case independent comparison.  The mappings are
+ * based upon ascii character sequences.
+ */
+static u_char charmap[] = {
+	'\000', '\001', '\002', '\003', '\004', '\005', '\006', '\007',
+	'\010', '\011', '\012', '\013', '\014', '\015', '\016', '\017',
+	'\020', '\021', '\022', '\023', '\024', '\025', '\026', '\027',
+	'\030', '\031', '\032', '\033', '\034', '\035', '\036', '\037',
+	'\040', '\041', '\042', '\043', '\044', '\045', '\046', '\047',
+	'\050', '\051', '\052', '\053', '\054', '\055', '\056', '\057',
+	'\060', '\061', '\062', '\063', '\064', '\065', '\066', '\067',
+	'\070', '\071', '\072', '\073', '\074', '\075', '\076', '\077',
+	'\100', '\141', '\142', '\143', '\144', '\145', '\146', '\147',
+	'\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157',
+	'\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167',
+	'\170', '\171', '\172', '\133', '\134', '\135', '\136', '\137',
+	'\140', '\141', '\142', '\143', '\144', '\145', '\146', '\147',
+	'\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157',
+	'\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167',
+	'\170', '\171', '\172', '\173', '\174', '\175', '\176', '\177',
+	'\200', '\201', '\202', '\203', '\204', '\205', '\206', '\207',
+	'\210', '\211', '\212', '\213', '\214', '\215', '\216', '\217',
+	'\220', '\221', '\222', '\223', '\224', '\225', '\226', '\227',
+	'\230', '\231', '\232', '\233', '\234', '\235', '\236', '\237',
+	'\240', '\241', '\242', '\243', '\244', '\245', '\246', '\247',
+	'\250', '\251', '\252', '\253', '\254', '\255', '\256', '\257',
+	'\260', '\261', '\262', '\263', '\264', '\265', '\266', '\267',
+	'\270', '\271', '\272', '\273', '\274', '\275', '\276', '\277',
+	'\300', '\341', '\342', '\343', '\344', '\345', '\346', '\347',
+	'\350', '\351', '\352', '\353', '\354', '\355', '\356', '\357',
+	'\360', '\361', '\362', '\363', '\364', '\365', '\366', '\367',
+	'\370', '\371', '\372', '\333', '\334', '\335', '\336', '\337',
+	'\340', '\341', '\342', '\343', '\344', '\345', '\346', '\347',
+	'\350', '\351', '\352', '\353', '\354', '\355', '\356', '\357',
+	'\360', '\361', '\362', '\363', '\364', '\365', '\366', '\367',
+	'\370', '\371', '\372', '\373', '\374', '\375', '\376', '\377',
+};
+
+int
+strcasecmp(s1, s2)
+	const char *s1, *s2;
+{
+	register u_char	*cm = charmap,
+			*us1 = (u_char *)s1,
+			*us2 = (u_char *)s2;
+
+	while (cm[*us1] == cm[*us2++])
+		if (*us1++ == '\0')
+			return(0);
+	return(cm[*us1] - cm[*--us2]);
+}
+
+int
+strncasecmp(s1, s2, n)
+	const char *s1, *s2;
+	register int n;
+{
+	register u_char	*cm = charmap,
+			*us1 = (u_char *)s1,
+			*us2 = (u_char *)s2;
+
+	while (--n >= 0 && cm[*us1] == cm[*us2++])
+		if (*us1++ == '\0')
+			return(0);
+	return(n < 0 ? 0 : cm[*us1] - cm[*--us2]);
+}
diff --git a/usr.sbin/tcpdump/tcpdump.1 b/usr.sbin/tcpdump/tcpdump.1
new file mode 100644
index 00000000000..ebd9181699a
--- /dev/null
+++ b/usr.sbin/tcpdump/tcpdump.1
@@ -0,0 +1,1217 @@
+.\" @(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/tcpdump.1,v 1.1 1996/12/12 16:22:22 bitblt Exp $ (LBL)
+.\"
+.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996
+.\"	The Regents of the University of California.  All rights reserved.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that: (1) source code distributions
+.\" retain the above copyright notice and this paragraph in its entirety, (2)
+.\" distributions including binary code include the above copyright notice and
+.\" this paragraph in its entirety in the documentation or other materials
+.\" provided with the distribution, and (3) all advertising materials mentioning
+.\" features or use of this software display the following acknowledgement:
+.\" ``This product includes software developed by the University of California,
+.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+.\" the University nor the names of its contributors may be used to endorse
+.\" or promote products derived from this software without specific prior
+.\" written permission.
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+.\"
+.TH TCPDUMP 1  "29 November 1996"
+.SH NAME
+tcpdump \- dump traffic on a network
+.SH SYNOPSIS
+.na
+.B tcpdump
+[
+.B \-deflnNOpqStvx
+] [
+.B \-c
+.I count
+] [
+.B \-F
+.I file
+]
+.br
+.ti +8
+[
+.B \-i
+.I interface
+] [
+.B \-r
+.I file
+]
+[
+.B \-s
+.I snaplen
+]
+.br
+.ti +8
+[
+.B \-T
+.I type
+]
+[
+.B \-w
+.I file
+]
+[
+.I expression
+]
+.br
+.ad
+.SH DESCRIPTION
+.LP
+\fITcpdump\fP prints out the headers of packets on a network interface
+that match the boolean \fIexpression\fP.
+.LP
+.B Under SunOS with nit or bpf:
+To run
+.I tcpdump
+you must have read access to
+.I /dev/net
+or
+.IR /dev/bpf* .
+.B Under Solaris with dlpi:
+You must have read access to the network pseudo device, e.g.
+.IR /dev/le .
+.B Under HP-UX with dlpi:
+You must be root or it must be installed setuid to root.
+.B Under IRIX with snoop:
+You must be root or it must be installed setuid to root.
+.B Under Linux:
+You must be root or it must be installed setuid to root.
+.B Under Ultrix and Digital UNIX:
+Once the super-user has enabled promiscuous-mode operation using
+.IR pfconfig (8),
+any user may run
+.BR tcpdump .
+.B Under BSD:
+You must have read access to
+.IR /dev/bpf* .
+.SH OPTIONS
+.TP
+.B \-c
+Exit after receiving \fIcount\fP packets.
+.TP
+.B \-d
+Dump the compiled packet-matching code in a human readable form to
+standard output and stop.
+.TP
+.B \-dd
+Dump packet-matching code as a
+.B C
+program fragment.
+.TP
+.B \-ddd
+Dump packet-matching code as decimal numbers (preceded with a count).
+.TP
+.B \-e
+Print the link-level header on each dump line.
+.TP
+.B \-f
+Print `foreign' internet addresses numerically rather than symbolically
+(this option is intended to get around serious brain damage in
+Sun's yp server \(em usually it hangs forever translating non-local
+internet numbers).
+.TP
+.B \-F
+Use \fIfile\fP as input for the filter expression.
+An additional expression given on the command line is ignored.
+.TP
+.B \-i
+Listen on \fIinterface\fP.
+If unspecified, \fItcpdump\fP searches the system interface list for the
+lowest numbered, configured up interface (excluding loopback).
+Ties are broken by choosing the earliest match.
+.TP
+.B \-l
+Make stdout line buffered.  Useful if you want to see the data
+while capturing it.  E.g.,
+.br
+``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
+``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
+.TP
+.B \-n
+Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.
+.TP
+.B \-N
+Don't print domain name qualification of host names.  E.g.,
+if you give this flag then \fItcpdump\fP will print ``nic''
+instead of ``nic.ddn.mil''.
+.TP
+.B \-O
+Do not run the packet-matching code optimizer.  This is useful only
+if you suspect a bug in the optimizer.
+.TP
+.B \-p
+\fIDon't\fP put the interface
+into promiscuous mode.  Note that the interface might be in promiscuous
+mode for some other reason; hence, `-p' cannot be used as an abbreviation for
+`ether host {local-hw-addr} or ether broadcast'.
+.TP
+.B \-q
+Quick (quiet?) output.  Print less protocol information so output
+lines are shorter.
+.TP
+.B \-r
+Read packets from \fIfile\fR (which was created with the -w option).
+Standard input is used if \fIfile\fR is ``-''.
+.TP
+.B \-s
+Snarf \fIsnaplen\fP bytes of data from each packet rather than the
+default of 68 (with SunOS's NIT, the minimum is actually 96).
+68 bytes is adequate for IP, ICMP, TCP
+and UDP but may truncate protocol information from name server and NFS
+packets (see below).  Packets truncated because of a limited snapshot
+are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP
+is the name of the protocol level at which the truncation has occurred.
+Note that taking larger snapshots both increases
+the amount of time it takes to process packets and, effectively,
+decreases the amount of packet buffering.  This may cause packets to be
+lost.  You should limit \fIsnaplen\fP to the smallest number that will
+capture the protocol information you're interested in.
+.TP
+.B \-T
+Force packets selected by "\fIexpression\fP" to be interpreted the
+specified \fItype\fR. Currently known types are
+\fBrpc\fR (Remote Procedure Call),
+\fBrtp\fR (Real-Time Applications protocol),
+\fBrtcp\fR (Real-Time Applications control protocol),
+\fBvat\fR (Visual Audio Tool),
+and
+\fBwb\fR (distributed White Board).
+.TP
+.B \-S
+Print absolute, rather than relative, TCP sequence numbers.
+.TP
+.B \-t
+\fIDon't\fP print a timestamp on each dump line.
+.TP
+.B \-tt
+Print an unformatted timestamp on each dump line.
+.TP
+.B \-v
+(Slightly more) verbose output.  For example, the time to live
+and type of service information in an IP packet is printed.
+.TP
+.B \-vv
+Even more verbose output.  For example, additional fields are
+printed from NFS reply packets.
+.TP
+.B \-w
+Write the raw packets to \fIfile\fR rather than parsing and printing
+them out.  They can later be printed with the \-r option.
+Standard output is used if \fIfile\fR is ``-''.
+.TP
+.B \-x
+Print each packet (minus its link level header) in hex.
+The smaller of the entire packet or
+.I snaplen
+bytes will be printed.
+.IP "\fI expression\fP"
+.RS
+selects which packets will be dumped.  If no \fIexpression\fP
+is given, all packets on the net will be dumped.  Otherwise,
+only packets for which \fIexpression\fP is `true' will be dumped.
+.LP
+The \fIexpression\fP consists of one or more
+.I primitives.
+Primitives usually consist of an
+.I id
+(name or number) preceded by one or more qualifiers.  There are three
+different kinds of qualifier:
+.IP \fItype\fP
+qualifiers say what kind of thing the id name or number refers to.
+Possible types are
+.BR host ,
+.B net
+and
+.BR port .
+E.g., `host foo', `net 128.3', `port 20'.  If there is no type
+qualifier,
+.B host
+is assumed.
+.IP \fIdir\fP
+qualifiers specify a particular transfer direction to and/or from
+.I id.
+Possible directions are
+.BR src ,
+.BR dst ,
+.B "src or dst"
+and
+.B "src and"
+.BR dst .
+E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.  If
+there is no dir qualifier,
+.B "src or dst"
+is assumed.
+For `null' link layers (i.e. point to point protocols such as slip) the
+.B inbound
+and
+.B outbound
+qualifiers can be used to specify a desired direction.
+.IP \fIproto\fP
+qualifiers restrict the match to a particular protocol.  Possible
+protos are:
+.BR ether ,
+.BR fddi ,
+.BR ip ,
+.BR arp ,
+.BR rarp ,
+.BR decnet ,
+.BR lat ,
+.BR sca ,
+.BR moprc ,
+.BR mopdl ,
+.B tcp
+and
+.BR udp .
+E.g., `ether src foo', `arp net 128.3', `tcp port 21'.  If there is
+no proto qualifier, all protocols consistent with the type are
+assumed.  E.g., `src foo' means `(ip or arp or rarp) src foo'
+(except the latter is not legal syntax), `net bar' means `(ip or
+arp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
+.LP
+[`fddi' is actually an alias for `ether'; the parser treats them
+identically as meaning ``the data link level used on the specified
+network interface.''  FDDI headers contain Ethernet-like source
+and destination addresses, and often contain Ethernet-like packet
+types, so you can filter on these FDDI fields just as with the
+analogous Ethernet fields.  FDDI headers also contain other fields,
+but you cannot name them explicitly in a filter expression.]
+.LP
+In addition to the above, there are some special `primitive' keywords
+that don't follow the pattern:
+.BR gateway ,
+.BR broadcast ,
+.BR less ,
+.B greater
+and arithmetic expressions.  All of these are described below.
+.LP
+More complex filter expressions are built up by using the words
+.BR and ,
+.B or
+and
+.B not
+to combine primitives.  E.g., `host foo and not port ftp and not port ftp-data'.
+To save typing, identical qualifier lists can be omitted.  E.g.,
+`tcp dst port ftp or ftp-data or domain' is exactly the same as
+`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
+.LP
+Allowable primitives are:
+.IP "\fBdst host \fIhost\fR"
+True if the IP destination field of the packet is \fIhost\fP,
+which may be either an address or a name.
+.IP "\fBsrc host \fIhost\fR"
+True if the IP source field of the packet is \fIhost\fP.
+.IP "\fBhost \fIhost\fP
+True if either the IP source or destination of the packet is \fIhost\fP.
+Any of the above host expressions can be prepended with the keywords,
+\fBip\fP, \fBarp\fP, or \fBrarp\fP as in:
+.in +.5i
+.nf
+\fBip host \fIhost\fR
+.fi
+.in -.5i
+which is equivalent to:
+.in +.5i
+.nf
+\fBether proto \fI\\ip\fB and host \fIhost\fR
+.fi
+.in -.5i
+If \fIhost\fR is a name with multiple IP addresses, each address will
+be checked for a match.
+.IP "\fBether dst \fIehost\fP
+True if the ethernet destination address is \fIehost\fP.  \fIEhost\fP
+may be either a name from /etc/ethers or a number (see
+.IR ethers (3N)
+for numeric format).
+.IP "\fBether src \fIehost\fP
+True if the ethernet source address is \fIehost\fP.
+.IP "\fBether host \fIehost\fP
+True if either the ethernet source or destination address is \fIehost\fP.
+.IP "\fBgateway\fP \fIhost\fP
+True if the packet used \fIhost\fP as a gateway.  I.e., the ethernet
+source or destination address was \fIhost\fP but neither the IP source
+nor the IP destination was \fIhost\fP.  \fIHost\fP must be a name and
+must be found in both /etc/hosts and /etc/ethers.  (An equivalent
+expression is
+.in +.5i
+.nf
+\fBether host \fIehost \fBand not host \fIhost\fR
+.fi
+.in -.5i
+which can be used with either names or numbers for \fIhost / ehost\fP.)
+.IP "\fBdst net \fInet\fR"
+True if the IP destination address of the packet has a network
+number of \fInet\fP. \fINet\fP may be either a name from /etc/networks
+or a network number (see \fInetworks(4)\fP for details).
+.IP "\fBsrc net \fInet\fR"
+True if the IP source address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR"
+True if either the IP source or destination address of the packet has a network
+number of \fInet\fP.
+.IP "\fBnet \fInet\fR \fBmask \fImask\fR"
+True if the IP address matches \fInet\fR with the specific netmask.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+.IP "\fBnet \fInet\fR/\fIlen\fR"
+True if the IP address matches \fInet\fR a netmask \fIlen\fR bits wide.
+May be qualified with \fBsrc\fR or \fBdst\fR.
+.IP "\fBdst port \fIport\fR"
+True if the packet is ip/tcp or ip/udp and has a
+destination port value of \fIport\fP.
+The \fIport\fP can be a number or a name used in /etc/services (see
+.IR tcp (4P)
+and
+.IR udp (4P)).
+If a name is used, both the port
+number and protocol are checked.  If a number or ambiguous name is used,
+only the port number is checked (e.g., \fBdst port 513\fR will print both
+tcp/login traffic and udp/who traffic, and \fBport domain\fR will print
+both tcp/domain and udp/domain traffic).
+.IP "\fBsrc port \fIport\fR"
+True if the packet has a source port value of \fIport\fP.
+.IP "\fBport \fIport\fR"
+True if either the source or destination port of the packet is \fIport\fP.
+Any of the above port expressions can be prepended with the keywords,
+\fBtcp\fP or \fBudp\fP, as in:
+.in +.5i
+.nf
+\fBtcp src port \fIport\fR
+.fi
+.in -.5i
+which matches only tcp packets whose source port is \fIport\fP.
+.IP "\fBless \fIlength\fR"
+True if the packet has a length less than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen <= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBgreater \fIlength\fR"
+True if the packet has a length greater than or equal to \fIlength\fP.
+This is equivalent to:
+.in +.5i
+.nf
+\fBlen >= \fIlength\fP.
+.fi
+.in -.5i
+.IP "\fBip proto \fIprotocol\fR"
+True if the packet is an ip packet (see
+.IR ip (4P))
+of protocol type \fIprotocol\fP.
+\fIProtocol\fP can be a number or one of the names
+\fIicmp\fP, \fIigrp\fP, \fIudp\fP, \fInd\fP, or \fItcp\fP.
+Note that the identifiers \fItcp\fP, \fIudp\fP, and \fIicmp\fP are also
+keywords and must be escaped via backslash (\\), which is \\\\ in the C-shell.
+.IP "\fBether broadcast\fR"
+True if the packet is an ethernet broadcast packet.  The \fIether\fP
+keyword is optional.
+.IP "\fBip broadcast\fR"
+True if the packet is an IP broadcast packet.  It checks for both
+the all-zeroes and all-ones broadcast conventions, and looks up
+the local subnet mask.
+.IP "\fBether multicast\fR"
+True if the packet is an ethernet multicast packet.  The \fIether\fP
+keyword is optional.
+This is shorthand for `\fBether[0] & 1 != 0\fP'.
+.IP "\fBip multicast\fR"
+True if the packet is an IP multicast packet.
+.IP  "\fBether proto \fIprotocol\fR"
+True if the packet is of ether type \fIprotocol\fR.
+\fIProtocol\fP can be a number or a name like
+\fIip\fP, \fIarp\fP, or \fIrarp\fP.
+Note these identifiers are also keywords
+and must be escaped via backslash (\\).
+[In the case of FDDI (e.g., `\fBfddi protocol arp\fR'), the
+protocol identification comes from the 802.2 Logical Link Control
+(LLC) header, which is usually layered on top of the FDDI header.
+\fITcpdump\fP assumes, when filtering on the protocol identifier,
+that all FDDI packets include an LLC header, and that the LLC header
+is in so-called SNAP format.]
+.IP "\fBdecnet src \fIhost\fR"
+True if the DECNET source address is
+.IR host ,
+which may be an address of the form ``10.123'', or a DECNET host
+name.  [DECNET host name support is only available on Ultrix systems
+that are configured to run DECNET.]
+.IP "\fBdecnet dst \fIhost\fR"
+True if the DECNET destination address is
+.IR host .
+.IP "\fBdecnet host \fIhost\fR"
+True if either the DECNET source or destination address is
+.IR host .
+.IP "\fBip\fR, \fBarp\fR, \fBrarp\fR, \fBdecnet\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBether proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+Note that
+\fItcpdump\fP does not currently know how to parse these protocols.
+.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
+Abbreviations for:
+.in +.5i
+.nf
+\fBip proto \fIp\fR
+.fi
+.in -.5i
+where \fIp\fR is one of the above protocols.
+.IP  "\fIexpr relop expr\fR"
+True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =, !=,
+and \fIexpr\fR is an arithmetic expression composed of integer constants
+(expressed in standard C syntax), the normal binary operators
+[+, -, *, /, &, |], a length operator, and special packet data accessors.
+To access
+data inside the packet, use the following syntax:
+.in +.5i
+.nf
+\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
+.fi
+.in -.5i
+\fIProto\fR is one of \fBether, fddi,
+ip, arp, rarp, tcp, udp, \fRor \fBicmp\fR, and
+indicates the protocol layer for the index operation.
+The byte offset, relative to the indicated protocol layer, is
+given by \fIexpr\fR.
+\fISize\fR is optional and indicates the number of bytes in the
+field of interest; it can be either one, two, or four, and defaults to one.
+The length operator, indicated by the keyword \fBlen\fP, gives the
+length of the packet.
+
+For example, `\fBether[0] & 1 != 0\fP' catches all multicast traffic.
+The expression `\fBip[0] & 0xf != 5\fP'
+catches all IP packets with options. The expression
+`\fBip[6:2] & 0x1fff = 0\fP'
+catches only unfragmented datagrams and frag zero of fragmented datagrams.
+This check is implicitly applied to the \fBtcp\fP and \fBudp\fP
+index operations.
+For instance, \fBtcp[0]\fP always means the first
+byte of the TCP \fIheader\fP, and never means the first byte of an
+intervening fragment.
+.LP
+Primitives may be combined using:
+.IP
+A parenthesized group of primitives and operators
+(parentheses are special to the Shell and must be escaped).
+.IP
+Negation (`\fB!\fP' or `\fBnot\fP').
+.IP
+Concatenation (`\fB&&\fP' or `\fBand\fP').
+.IP
+Alternation (`\fB||\fP' or `\fBor\fP').
+.LP
+Negation has highest precedence.
+Alternation and concatenation have equal precedence and associate
+left to right.  Note that explicit \fBand\fR tokens, not juxtaposition,
+are now required for concatenation.
+.LP
+If an identifier is given without a keyword, the most recent keyword
+is assumed.
+For example,
+.in +.5i
+.nf
+\fBnot host vs and ace\fR
+.fi
+.in -.5i
+is short for
+.in +.5i
+.nf
+\fBnot host vs and host ace\fR
+.fi
+.in -.5i
+which should not be confused with
+.in +.5i
+.nf
+\fBnot ( host vs or ace )\fR
+.fi
+.in -.5i
+.LP
+Expression arguments can be passed to tcpdump as either a single argument
+or as multiple arguments, whichever is more convenient.
+Generally, if the expression contains Shell metacharacters, it is
+easier to pass it as a single, quoted argument.
+Multiple arguments are concatenated with spaces before being parsed.
+.SH EXAMPLES
+.LP
+To print all packets arriving at or departing from \fIsundown\fP:
+.RS
+.nf
+\fBtcpdump host sundown\fP
+.fi
+.RE
+.LP
+To print traffic between \fIhelios\fR and either \fIhot\fR or \fIace\fR:
+.RS
+.nf
+\fBtcpdump host helios and \\( hot or ace \\)\fP
+.fi
+.RE
+.LP
+To print all IP packets between \fIace\fR and any host except \fIhelios\fR:
+.RS
+.nf
+\fBtcpdump ip host ace and not helios\fP
+.fi
+.RE
+.LP
+To print all traffic between local hosts and hosts at Berkeley:
+.RS
+.nf
+.B
+tcpdump net ucb-ether
+.fi
+.RE
+.LP
+To print all ftp traffic through internet gateway \fIsnup\fP:
+(note that the expression is quoted to prevent the shell from
+(mis-)interpreting the parentheses):
+.RS
+.nf
+.B
+tcpdump 'gateway snup and (port ftp or ftp-data)'
+.fi
+.RE
+.LP
+To print traffic neither sourced from nor destined for local hosts
+(if you gateway to one other net, this stuff should never make it
+onto your local net).
+.RS
+.nf
+.B
+tcpdump ip and not net \fIlocalnet\fP
+.fi
+.RE
+.LP
+To print the start and end packets (the SYN and FIN packets) of each
+TCP conversation that involves a non-local host.
+.RS
+.nf
+.B
+tcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
+.fi
+.RE
+.LP
+To print IP packets longer than 576 bytes sent through gateway \fIsnup\fP:
+.RS
+.nf
+.B
+tcpdump 'gateway snup and ip[2:2] > 576'
+.fi
+.RE
+.LP
+To print IP broadcast or multicast packets that were
+.I not
+sent via ethernet broadcast or multicast:
+.RS
+.nf
+.B
+tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
+.fi
+.RE
+.LP
+To print all ICMP packets that are not echo requests/replies (i.e., not
+ping packets):
+.RS
+.nf
+.B
+tcpdump 'icmp[0] != 8 and icmp[0] != 0"
+.fi
+.RE
+.SH OUTPUT FORMAT
+.LP
+The output of \fItcpdump\fP is protocol dependent.  The following
+gives a brief description and examples of most of the formats.
+.de HD
+.sp 1.5
+.B
+..
+.HD
+Link Level Headers
+.LP
+If the '-e' option is given, the link level header is printed out.
+On ethernets, the source and destination addresses, protocol,
+and packet length are printed.
+.LP
+On FDDI networks, the  '-e' option causes \fItcpdump\fP to print
+the `frame control' field,  the source and destination addresses,
+and the packet length.  (The `frame control' field governs the
+interpretation of the rest of the packet.  Normal packets (such
+as those containing IP datagrams) are `async' packets, with a priority
+value between 0 and 7; for example, `\fBasync4\fR'.  Such packets
+are assumed to contain an 802.2 Logical Link Control (LLC) packet;
+the LLC header is printed if it is \fInot\fR an ISO datagram or a
+so-called SNAP packet.
+.LP
+\fI(N.B.: The following description assumes familiarity with
+the SLIP compression algorithm described in RFC-1144.)\fP
+.LP
+On SLIP links, a direction indicator (``I'' for inbound, ``O'' for outbound),
+packet type, and compression information are printed out.
+The packet type is printed first.
+The three types are \fIip\fP, \fIutcp\fP, and \fIctcp\fP.
+No further link information is printed for \fIip\fR packets.
+For TCP packets, the connection identifier is printed following the type.
+If the packet is compressed, its encoded header is printed out.
+The special cases are printed out as
+\fB*S+\fIn\fR and \fB*SA+\fIn\fR, where \fIn\fR is the amount by which
+the sequence number (or sequence number and ack) has changed.
+If it is not a special case,
+zero or more changes are printed.
+A change is indicated by U (urgent pointer), W (window), A (ack),
+S (sequence number), and I (packet ID), followed by a delta (+n or -n),
+or a new value (=n).
+Finally, the amount of data in the packet and compressed header length
+are printed.
+.LP
+For example, the following line shows an outbound compressed TCP packet,
+with an implicit connection identifier; the ack has changed by 6,
+the sequence number by 49, and the packet ID by 6; there are 3 bytes of
+data and 6 bytes of compressed header:
+.RS
+.nf
+\fBO ctcp * A+6 S+49 I+6 3 (6)\fP
+.fi
+.RE
+.HD
+ARP/RARP Packets
+.LP
+Arp/rarp output shows the type of request and its arguments.  The
+format is intended to be self explanatory.
+Here is a short sample taken from the start of an `rlogin' from
+host \fIrtsg\fP to host \fIcsam\fP:
+.RS
+.nf
+.sp .5
+\f(CWarp who-has csam tell rtsg
+arp reply csam is-at CSAM\fP
+.sp .5
+.fi
+.RE
+The first line says that rtsg sent an arp packet asking
+for the ethernet address of internet host csam.  Csam
+replies with its ethernet address (in this example, ethernet addresses
+are in caps and internet addresses in lower case).
+.LP
+This would look less redundant if we had done \fBtcpdump \-n\fP:
+.RS
+.nf
+.sp .5
+\f(CWarp who-has 128.3.254.6 tell 128.3.254.68
+arp reply 128.3.254.6 is-at 02:07:01:00:01:c4\fP
+.fi
+.RE
+.LP
+If we had done \fBtcpdump \-e\fP, the fact that the first packet is
+broadcast and the second is point-to-point would be visible:
+.RS
+.nf
+.sp .5
+\f(CWRTSG Broadcast 0806  64: arp who-has csam tell rtsg
+CSAM RTSG 0806  64: arp reply csam is-at CSAM\fP
+.sp .5
+.fi
+.RE
+For the first packet this says the ethernet source address is RTSG, the
+destination is the ethernet broadcast address, the type field
+contained hex 0806 (type ETHER_ARP) and the total length was 64 bytes.
+.HD
+TCP Packets
+.LP
+\fI(N.B.:The following description assumes familiarity with
+the TCP protocol described in RFC-793.  If you are not familiar
+with the protocol, neither this description nor tcpdump will
+be of much use to you.)\fP
+.LP
+The general format of a tcp protocol line is:
+.RS
+.nf
+.sp .5
+\fIsrc > dst: flags data-seqno ack window urgent options\fP
+.sp .5
+.fi
+.RE
+\fISrc\fP and \fIdst\fP are the source and destination IP
+addresses and ports.  \fIFlags\fP are some combination of S (SYN),
+F (FIN), P (PUSH) or R (RST) or a single `.' (no flags).
+\fIData-seqno\fP describes the portion of sequence space covered
+by the data in this packet (see example below).
+\fIAck\fP is sequence number of the next data expected the other
+direction on this connection.
+\fIWindow\fP is the number of bytes of receive buffer space available
+the other direction on this connection.
+\fIUrg\fP indicates there is `urgent' data in the packet.
+\fIOptions\fP are tcp options enclosed in angle brackets (e.g., <mss 1024>).
+.LP
+\fISrc, dst\fP and \fIflags\fP are always present.  The other fields
+depend on the contents of the packet's tcp protocol header and
+are output only if appropriate.
+.LP
+Here is the opening portion of an rlogin from host \fIrtsg\fP to
+host \fIcsam\fP.
+.RS
+.nf
+.sp .5
+\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
+csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
+rtsg.1023 > csam.login: . ack 1 win 4096
+rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
+csam.login > rtsg.1023: . ack 2 win 4096
+rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
+csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
+csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
+csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fP\s+2
+.sp .5
+.fi
+.RE
+The first line says that tcp port 1023 on rtsg sent a packet
+to port \fIlogin\fP
+on csam.  The \fBS\fP indicates that the \fISYN\fP flag was set.
+The packet sequence number was 768512 and it contained no data.
+(The notation is `first:last(nbytes)' which means `sequence
+numbers \fIfirst\fP
+up to but not including \fIlast\fP which is \fInbytes\fP bytes of user data'.)
+There was no piggy-backed ack, the available receive window was 4096
+bytes and there was a max-segment-size option requesting an mss of
+1024 bytes.
+.LP
+Csam replies with a similar packet except it includes a piggy-backed
+ack for rtsg's SYN.  Rtsg then acks csam's SYN.  The `.' means no
+flags were set.
+The packet contained no data so there is no data sequence number.
+Note that the ack sequence
+number is a small integer (1).  The first time \fBtcpdump\fP sees a
+tcp `conversation', it prints the sequence number from the packet.
+On subsequent packets of the conversation, the difference between
+the current packet's sequence number and this initial sequence number
+is printed.  This means that sequence numbers after the
+first can be interpreted
+as relative byte positions in the conversation's data stream (with the
+first data byte each direction being `1').  `-S' will override this
+feature, causing the original sequence numbers to be output.
+.LP
+On the 6th line, rtsg sends csam 19 bytes of data (bytes 2 through 20
+in the rtsg \(-> csam side of the conversation).
+The PUSH flag is set in the packet.
+On the 7th line, csam says it's received data sent by rtsg up to
+but not including byte 21.  Most of this data is apparently sitting in the
+socket buffer since csam's receive window has gotten 19 bytes smaller.
+Csam also sends one byte of data to rtsg in this packet.
+On the 8th and 9th lines,
+csam sends two bytes of urgent, pushed data to rtsg.
+.LP
+If the snapshot was small enough that \fBtcpdump\fP didn't capture
+the full TCP header, it interprets as much of the header as it can
+and then reports ``[|\fItcp\fP]'' to indicate the remainder could not
+be interpreted.  If the header contains a bogus option (one with a length
+that's either too small or beyond the end of the header), tcpdump reports
+it as ``[\fIbad opt\fP]'' and does not interpret any further options (since
+it's impossible to tell where they start).  If the header length indicates
+options are present but the IP datagram length is not long enough for the
+options to actually be there, tcpdump reports it as ``[\fIbad hdr length\fP]''.
+.HD
+.B
+UDP Packets
+.LP
+UDP format is illustrated by this rwho packet:
+.RS
+.nf
+.sp .5
+\f(CWactinide.who > broadcast.who: udp 84\fP
+.sp .5
+.fi
+.RE
+This says that port \fIwho\fP on host \fIactinide\fP sent a udp
+datagram to port \fIwho\fP on host \fIbroadcast\fP, the Internet
+broadcast address.  The packet contained 84 bytes of user data.
+.LP
+Some UDP services are recognized (from the source or destination
+port number) and the higher level protocol information printed.
+In particular, Domain Name service requests (RFC-1034/1035) and Sun
+RPC calls (RFC-1050) to NFS.
+.HD
+UDP Name Server Requests
+.LP
+\fI(N.B.:The following description assumes familiarity with
+the Domain Service protocol described in RFC-1035.  If you are not familiar
+with the protocol, the following description will appear to be written
+in greek.)\fP
+.LP
+Name server requests are formatted as
+.RS
+.nf
+.sp .5
+\fIsrc > dst: id op? flags qtype qclass name (len)\fP
+.sp .5
+\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fP
+.sp .5
+.fi
+.RE
+Host \fIh2opolo\fP asked the domain server on \fIhelios\fP for an
+address record (qtype=A) associated with the name \fIucbvax.berkeley.edu.\fP
+The query id was `3'.  The `+' indicates the \fIrecursion desired\fP flag
+was set.  The query length was 37 bytes, not including the UDP and
+IP protocol headers.  The query operation was the normal one, \fIQuery\fP,
+so the op field was omitted.  If the op had been anything else, it would
+have been printed between the `3' and the `+'.
+Similarly, the qclass was the normal one,
+\fIC_IN\fP, and omitted.  Any other qclass would have been printed
+immediately after the `A'.
+.LP
+A few anomalies are checked and may result in extra fields enclosed in
+square brackets:  If a query contains an answer, name server or
+authority section,
+.IR ancount ,
+.IR nscount ,
+or
+.I arcount
+are printed as `[\fIn\fPa]', `[\fIn\fPn]' or  `[\fIn\fPau]' where \fIn\fP
+is the appropriate count.
+If any of the response bits are set (AA, RA or rcode) or any of the
+`must be zero' bits are set in bytes two and three, `[b2&3=\fIx\fP]'
+is printed, where \fIx\fP is the hex value of header bytes two and three.
+.HD
+UDP Name Server Responses
+.LP
+Name server responses are formatted as
+.RS
+.nf
+.sp .5
+\fIsrc > dst:  id op rcode flags a/n/au type class data (len)\fP
+.sp .5
+\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
+helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fP
+.sp .5
+.fi
+.RE
+In the first example, \fIhelios\fP responds to query id 3 from \fIh2opolo\fP
+with 3 answer records, 3 name server records and 7 authority records.
+The first answer record is type A (address) and its data is internet
+address 128.32.137.3.  The total size of the response was 273 bytes,
+excluding UDP and IP headers.  The op (Query) and response code
+(NoError) were omitted, as was the class (C_IN) of the A record.
+.LP
+In the second example, \fIhelios\fP responds to query 2 with a
+response code of non-existent domain (NXDomain) with no answers,
+one name server and no authority records.  The `*' indicates that
+the \fIauthoritative answer\fP bit was set.  Since there were no
+answers, no type, class or data were printed.
+.LP
+Other flag characters that might appear are `\-' (recursion available,
+RA, \fInot\fP set) and `|' (truncated message, TC, set).  If the
+`question' section doesn't contain exactly one entry, `[\fIn\fPq]'
+is printed.
+.LP
+Note that name server requests and responses tend to be large and the
+default \fIsnaplen\fP of 68 bytes may not capture enough of the packet
+to print.  Use the \fB\-s\fP flag to increase the snaplen if you
+need to seriously investigate name server traffic.  `\fB\-s 128\fP'
+has worked well for me.
+
+.HD
+NFS Requests and Replies
+.LP
+Sun NFS (Network File System) requests and replies are printed as:
+.RS
+.nf
+.sp .5
+\fIsrc.xid > dst.nfs: len op args\fP
+\fIsrc.nfs > dst.xid: reply stat len op results\fP
+.sp .5
+\f(CW
+sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165
+wrl.nfs > sushi.6709: reply ok 40 readlink "../var"
+sushi.201b > wrl.nfs:
+	144 lookup fh 9,74/4096.6878 "xcolors"
+wrl.nfs > sushi.201b:
+	reply ok 128 lookup fh 9,74/4134.3150
+\fP
+.sp .5
+.fi
+.RE
+In the first line, host \fIsushi\fP sends a transaction with id \fI6709\fP
+to \fIwrl\fP (note that the number following the src host is a
+transaction id, \fInot\fP the source port).  The request was 112 bytes,
+excluding the UDP and IP headers.  The operation was a \fIreadlink\fP
+(read symbolic link) on file handle (\fIfh\fP) 21,24/10.731657119.
+(If one is lucky, as in this case, the file handle can be interpreted
+as a major,minor device number pair, followed by the inode number and
+generation number.)
+\fIWrl\fP replies `ok' with the contents of the link.
+.LP
+In the third line, \fIsushi\fP asks \fIwrl\fP to lookup the name
+`\fIxcolors\fP' in directory file 9,74/4096.6878.  Note that the data printed
+depends on the operation type.  The format is intended to be self
+explanatory if read in conjunction with
+an NFS protocol spec.
+.LP
+If the \-v (verbose) flag is given, additional information is printed.
+For example:
+.RS
+.nf
+.sp .5
+\f(CW
+sushi.1372a > wrl.nfs:
+	148 read fh 21,11/12.195 8192 bytes @ 24576
+wrl.nfs > sushi.1372a:
+	reply ok 1472 read REG 100664 ids 417/0 sz 29388
+\fP
+.sp .5
+.fi
+.RE
+(\-v also prints the IP header TTL, ID, and fragmentation fields,
+which have been omitted from this example.)  In the first line,
+\fIsushi\fP asks \fIwrl\fP to read 8192 bytes from file 21,11/12.195,
+at byte offset 24576.  \fIWrl\fP replies `ok'; the packet shown on the
+second line is the first fragment of the reply, and hence is only 1472
+bytes long (the other bytes will follow in subsequent fragments, but
+these fragments do not have NFS or even UDP headers and so might not be
+printed, depending on the filter expression used).  Because the \-v flag
+is given, some of the file attributes (which are returned in addition
+to the file data) are printed: the file type (``REG'', for regular file),
+the file mode (in octal), the uid and gid, and the file size.
+.LP
+If the \-v flag is given more than once, even more details are printed.
+.LP
+Note that NFS requests are very large and much of the detail won't be printed
+unless \fIsnaplen\fP is increased.  Try using `\fB\-s 192\fP' to watch
+NFS traffic.
+.LP
+NFS reply packets do not explicitly identify the RPC operation.  Instead,
+\fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
+replies using the transaction ID.  If a reply does not closely follow the
+corresponding request, it might not be parsable.
+.HD
+KIP Appletalk (DDP in UDP)
+.LP
+Appletalk DDP packets encapsulated in UDP datagrams are de-encapsulated
+and dumped as DDP packets (i.e., all the UDP header information is
+discarded).  The file
+.I /etc/atalk.names
+is used to translate appletalk net and node numbers to names.
+Lines in this file have the form
+.RS
+.nf
+.sp .5
+\fInumber	name\fP
+
+\f(CW1.254		ether
+16.1		icsd-net
+1.254.110	ace\fP
+.sp .5
+.fi
+.RE
+The first two lines give the names of appletalk networks.  The third
+line gives the name of a particular host (a host is distinguished
+from a net by the 3rd octet in the number \-
+a net number \fImust\fP have two octets and a host number \fImust\fP
+have three octets.)  The number and name should be separated by
+whitespace (blanks or tabs).
+The
+.I /etc/atalk.names
+file may contain blank lines or comment lines (lines starting with
+a `#').
+.LP
+Appletalk addresses are printed in the form
+.RS
+.nf
+.sp .5
+\fInet.host.port\fP
+
+\f(CW144.1.209.2 > icsd-net.112.220
+office.2 > icsd-net.112.220
+jssmag.149.235 > icsd-net.2\fP
+.sp .5
+.fi
+.RE
+(If the
+.I /etc/atalk.names
+doesn't exist or doesn't contain an entry for some appletalk
+host/net number, addresses are printed in numeric form.)
+In the first example, NBP (DDP port 2) on net 144.1 node 209
+is sending to whatever is listening on port 220 of net icsd node 112.
+The second line is the same except the full name of the source node
+is known (`office').  The third line is a send from port 235 on
+net jssmag node 149 to broadcast on the icsd-net NBP port (note that
+the broadcast address (255) is indicated by a net name with no host
+number \- for this reason it's a good idea to keep node names and
+net names distinct in /etc/atalk.names).
+.LP
+NBP (name binding protocol) and ATP (Appletalk transaction protocol)
+packets have their contents interpreted.  Other protocols just dump
+the protocol name (or number if no name is registered for the
+protocol) and packet size.
+
+\fBNBP packets\fP are formatted like the following examples:
+.RS
+.nf
+.sp .5
+\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
+jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
+techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fP\s+2
+.sp .5
+.fi
+.RE
+The first line is a name lookup request for laserwriters sent by net icsd host
+112 and broadcast on net jssmag.  The nbp id for the lookup is 190.
+The second line shows a reply for this request (note that it has the
+same id) from host jssmag.209 saying that it has a laserwriter
+resource named "RM1140" registered on port 250.  The third line is
+another reply to the same request saying host techpit has laserwriter
+"techpit" registered on port 186.
+
+\fBATP packet\fP formatting is demonstrated by the following example:
+.RS
+.nf
+.sp .5
+\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
+helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000
+jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
+helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
+helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
+jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
+jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fP\s+2
+.sp .5
+.fi
+.RE
+Jssmag.209 initiates transaction id 12266 with host helios by requesting
+up to 8 packets (the `<0-7>').  The hex number at the end of the line
+is the value of the `userdata' field in the request.
+.LP
+Helios responds with 8 512-byte packets.  The `:digit' following the
+transaction id gives the packet sequence number in the transaction
+and the number in parens is the amount of data in the packet,
+excluding the atp header.  The `*' on packet 7 indicates that the
+EOM bit was set.
+.LP
+Jssmag.209 then requests that packets 3 & 5 be retransmitted.  Helios
+resends them then jssmag.209 releases the transaction.  Finally,
+jssmag.209 initiates the next request.  The `*' on the request
+indicates that XO (`exactly once') was \fInot\fP set.
+
+.HD
+IP Fragmentation
+.LP
+Fragmented Internet datagrams are printed as
+.RS
+.nf
+.sp .5
+\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
+\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
+.sp .5
+.fi
+.RE
+(The first form indicates there are more fragments.  The second
+indicates this is the last fragment.)
+.LP
+\fIId\fP is the fragment id.  \fISize\fP is the fragment
+size (in bytes) excluding the IP header.  \fIOffset\fP is this
+fragment's offset (in bytes) in the original datagram.
+.LP
+The fragment information is output for each fragment.  The first
+fragment contains the higher level protocol header and the frag
+info is printed after the protocol info.  Fragments
+after the first contain no higher level protocol header and the
+frag info is printed after the source and destination addresses.
+For example, here is part of an ftp from arizona.edu to lbl-rtsg.arpa
+over a CSNET connection that doesn't appear to handle 576 byte datagrams:
+.RS
+.nf
+.sp .5
+\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
+arizona > rtsg: (frag 595a:204@328)
+rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
+.sp .5
+.fi
+.RE
+There are a couple of things to note here:  First, addresses in the
+2nd line don't include port numbers.  This is because the TCP
+protocol information is all in the first fragment and we have no idea
+what the port or sequence numbers are when we print the later fragments.
+Second, the tcp sequence information in the first line is printed as if there
+were 308 bytes of user data when, in fact, there are 512 bytes (308 in
+the first frag and 204 in the second).  If you are looking for holes
+in the sequence space or trying to match up acks
+with packets, this can fool you.
+.LP
+A packet with the IP \fIdon't fragment\fP flag is marked with a
+trailing \fB(DF)\fP.
+.HD
+Timestamps
+.LP
+By default, all output lines are preceded by a timestamp.  The timestamp
+is the current clock time in the form
+.RS
+.nf
+\fIhh:mm:ss.frac\fP
+.fi
+.RE
+and is as accurate as the kernel's clock.
+The timestamp reflects the time the kernel first saw the packet.  No attempt
+is made to account for the time lag between when the
+ethernet interface removed the packet from the wire and when the kernel
+serviced the `new packet' interrupt.
+.SH "SEE ALSO"
+traffic(1C), nit(4P), bpf(4), pcap(3)
+.SH AUTHORS
+Van Jacobson,
+Craig Leres and
+Steven McCanne, all of the
+Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
+.LP
+The current version is available via anonymous ftp:
+.LP
+.RS
+.I ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
+.RE
+.SH BUGS
+Please send bug reports to tcpdump@ee.lbl.gov.
+.LP
+NIT doesn't let you watch your own outbound traffic, BPF will.
+We recommend that you use the latter.
+.LP
+Some attempt should be made to reassemble IP fragments or, at least
+to compute the right length for the higher level protocol.
+.LP
+Name server inverse queries are not dumped correctly: The (empty)
+question section is printed rather than real query in the answer
+section.  Some believe that inverse queries are themselves a bug and
+prefer to fix the program generating them rather than tcpdump.
+.LP
+Apple Ethertalk DDP packets could be dumped as easily as KIP DDP
+packets but aren't.
+Even if we were inclined to do anything to promote the use of
+Ethertalk (we aren't), LBL doesn't allow Ethertalk on any of its
+networks so we'd would have no way of testing this code.
+.LP
+A packet trace that crosses a daylight savings time change will give
+skewed time stamps (the time change is ignored).
+.LP
+Filters expressions that manipulate FDDI headers assume that all FDDI
+packets are encapsulated Ethernet packets.  This is true for IP, ARP,
+and DECNET Phase IV, but is not true for protocols such as ISO CLNS.
+Therefore, the filter may inadvertently accept certain packets that
+do not properly match the filter expression.
diff --git a/usr.sbin/tcpdump/tcpdump.c b/usr.sbin/tcpdump/tcpdump.c
index 54f4858c947..f0737adde0c 100644
--- a/usr.sbin/tcpdump/tcpdump.c
+++ b/usr.sbin/tcpdump/tcpdump.c
@@ -1,7 +1,5 @@
-/*	$OpenBSD: tcpdump.c,v 1.5 1996/11/12 08:52:38 mickey Exp $	*/
-
 /*
- * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995
+ * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -20,12 +18,13 @@
  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
+
 #ifndef lint
-char copyright[] =
-    "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995\n\
+static const char copyright[] =
+    "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996\n\
 The Regents of the University of California.  All rights reserved.\n";
-static  char rcsid[] =
-    "@(#)Header: tcpdump.c,v 1.109 96/06/22 14:46:37 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/tcpdump.c,v 1.6 1996/12/12 16:22:21 bitblt Exp $ (LBL)";
 #endif
 
 /*
@@ -38,10 +37,6 @@ static  char rcsid[] =
 
 #include <sys/types.h>
 #include <sys/time.h>
-#ifdef __osf__
-#include <sys/sysinfo.h>
-#include <sys/proc.h>
-#endif
 
 #include <netinet/in.h>
 
@@ -54,6 +49,7 @@ static  char rcsid[] =
 
 #include "interface.h"
 #include "addrtoname.h"
+#include "machdep.h"
 
 int fflag;			/* don't translate "foreign" IP address */
 int nflag;			/* leave addresses as numbers */
@@ -72,7 +68,7 @@ int dflag;			/* print filter code */
 
 char *program_name;
 
-int32_t thiszone=0;		/* seconds offset from gmt to local time */
+int32_t thiszone;		/* seconds offset from gmt to local time */
 
 /* Externs */
 extern void bpf_dump(struct bpf_program *, int);
@@ -80,9 +76,6 @@ extern void bpf_dump(struct bpf_program *, int);
 /* Forwards */
 RETSIGTYPE cleanup(int);
 extern __dead void usage(void) __attribute__((volatile));
-#ifdef __osf__
-static void abort_on_misalignment(void);
-#endif
 
 /* Length of saved portion of packet. */
 int snaplen = DEFAULT_SNAPLEN;
@@ -99,6 +92,7 @@ struct printer {
 
 static struct printer printers[] = {
 	{ ether_if_print,	DLT_EN10MB },
+	{ ether_if_print,	DLT_IEEE802 },
 	{ sl_if_print,		DLT_SLIP },
 	{ ppp_if_print,		DLT_PPP },
 	{ fddi_if_print,	DLT_FDDI },
@@ -122,18 +116,6 @@ lookup_printer(int type)
 
 static pcap_t *pd;
 
-/* OSF magic */
-#ifdef __osf__
-static void
-abort_on_misalignment()
-{
-	static int buf[2] = { SSIN_UACPROC, UAC_SIGBUS };
-
-	if (setsysinfo(SSI_NVPAIRS, (caddr_t)buf, 1, 0, 0) < 0)
-		error("setsysinfo: %s", pcap_strerror(errno));
-}
-#endif
-
 extern int optind;
 extern int opterr;
 extern char *optarg;
@@ -147,11 +129,7 @@ main(int argc, char **argv)
 	pcap_handler printer;
 	struct bpf_program fcode;
 	u_char *pcap_userdata;
-	char errbuf[PCAP_ERRBUF_SIZE];
-
-#ifdef __osf__
-	abort_on_misalignment();
-#endif
+	char ebuf[PCAP_ERRBUF_SIZE];
 
 	cnt = -1;
 	device = NULL;
@@ -163,11 +141,16 @@ main(int argc, char **argv)
 	else
 		program_name = argv[0];
 
+	if (abort_on_misalignment(ebuf) < 0)
+		error("%s", ebuf);
+
 	opterr = 0;
 	while ((op = getopt(argc, argv, "c:defF:i:lnNOpqr:s:StT:vw:xY")) != EOF)
 		switch (op) {
 		case 'c':
 			cnt = atoi(optarg);
+			if (cnt <= 0)
+				error("invalid packet count %s", optarg);
 			break;
 
 		case 'd':
@@ -224,6 +207,8 @@ main(int argc, char **argv)
 
 		case 's':
 			snaplen = atoi(optarg);
+			if (snaplen <= 0)
+				error("invalid snaplen %s", optarg);
 			break;
 
 		case 'S':
@@ -285,29 +270,29 @@ main(int argc, char **argv)
 		 */
 		setuid(getuid());
 
-		pd = pcap_open_offline(RFileName, errbuf);
+		pd = pcap_open_offline(RFileName, ebuf);
 		if (pd == NULL)
-			error(errbuf);
+			error("%s", ebuf);
 		localnet = 0;
 		netmask = 0;
 		if (fflag != 0)
 			error("-f and -r options are incompatible");
 	} else {
 		if (device == NULL) {
-			device = pcap_lookupdev(errbuf);
+			device = pcap_lookupdev(ebuf);
 			if (device == NULL)
-				error(errbuf);
+				error("%s", ebuf);
 		}
-		pd = pcap_open_live(device, snaplen, !pflag, 1000, errbuf);
+		pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
 		if (pd == NULL)
-			error(errbuf);
+			error("%s", ebuf);
 		i = pcap_snapshot(pd);
 		if (snaplen < i) {
 			warning("snaplen raised from %d to %d", snaplen, i);
 			snaplen = i;
 		}
-		if (pcap_lookupnet(device, &localnet, &netmask, errbuf) < 0)
-			error(errbuf);
+		if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0)
+			error("%s", ebuf);
 		/*
 		 * Let user own process after socket has been opened.
 		 */
@@ -318,12 +303,8 @@ main(int argc, char **argv)
 	else
 		cmdbuf = copy_argv(&argv[optind]);
 
-	/* XXX padding only needed for kernel fcode */
-	if (RFileName != NULL)
-		pcap_fddipad = 0;
-
 	if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
-		error(pcap_geterr(pd));
+		error("%s", pcap_geterr(pd));
 	if (dflag) {
 		bpf_dump(&fcode, dflag);
 		exit(0);
@@ -335,11 +316,11 @@ main(int argc, char **argv)
 	(void)signal(SIGHUP, cleanup);
 
 	if (pcap_setfilter(pd, &fcode) < 0)
-		error(pcap_geterr(pd));
+		error("%s", pcap_geterr(pd));
 	if (WFileName) {
 		pcap_dumper_t *p = pcap_dump_open(pd, WFileName);
 		if (p == NULL)
-			error(pcap_geterr(pd));
+			error("%s", pcap_geterr(pd));
 		printer = pcap_dump;
 		pcap_userdata = (u_char *)p;
 	} else {
@@ -385,7 +366,7 @@ cleanup(int signo)
 
 /* Like default_print() but data need not be aligned */
 void
-default_print_unaligned(register const u_char *cp, register int length)
+default_print_unaligned(register const u_char *cp, register u_int length)
 {
 	register u_int i, s;
 	register int nshorts;
@@ -406,7 +387,7 @@ default_print_unaligned(register const u_char *cp, register int length)
 }
 
 void
-default_print(register const u_char *bp, register int length)
+default_print(register const u_char *bp, register u_int length)
 {
 	register const u_short *sp;
 	register u_int i;
@@ -432,7 +413,7 @@ default_print(register const u_char *bp, register int length)
 }
 
 __dead void
-usage()
+usage(void)
 {
 	extern char version[];
 
diff --git a/usr.sbin/tcpdump/util.c b/usr.sbin/tcpdump/util.c
index 6fea5b7652c..05d7faed2f1 100644
--- a/usr.sbin/tcpdump/util.c
+++ b/usr.sbin/tcpdump/util.c
@@ -1,5 +1,3 @@
-/*	$OpenBSD: util.c,v 1.4 1996/07/13 11:01:35 mickey Exp $	*/
-
 /*
  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
  *	The Regents of the University of California.  All rights reserved.
@@ -22,8 +20,8 @@
  */
 
 #ifndef lint
-static char rcsid[] =
-    "@(#) Header: util.c,v 1.48 96/06/23 02:26:42 leres Exp (LBL)";
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/util.c,v 1.5 1996/12/12 16:22:20 bitblt Exp $ (LBL)";
 #endif
 
 #include <sys/types.h>
@@ -32,9 +30,11 @@ static char rcsid[] =
 #include <sys/stat.h>
 
 #include <ctype.h>
+#include <errno.h>
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
+#include <pcap.h>
 #include <stdio.h>
 #if __STDC__
 #include <stdarg.h>
@@ -62,7 +62,6 @@ fn_print(register const u_char *s, register const u_char *ep)
 	register u_char c;
 
 	ret = 1;			/* assume truncated */
-	putchar('"');
 	while (ep == NULL || s < ep) {
 		c = *s++;
 		if (c == '\0') {
@@ -80,7 +79,6 @@ fn_print(register const u_char *s, register const u_char *ep)
 		}
 		putchar(c);
 	}
-	putchar('"');
 	return(ret);
 }
 
@@ -97,7 +95,6 @@ fn_printn(register const u_char *s, register u_int n,
 	register u_char c;
 
 	ret = 1;			/* assume truncated */
-	putchar('"');
 	while (ep == NULL || s < ep) {
 		if (n-- <= 0) {
 			ret = 0;
@@ -115,7 +112,6 @@ fn_printn(register const u_char *s, register u_int n,
 		}
 		putchar(c);
 	}
-	putchar('"');
 	return(ret);
 }
 
@@ -201,7 +197,7 @@ warning(fmt, va_alist)
 {
 	va_list ap;
 
-	(void)fprintf(stderr, "%s: warning: ", program_name);
+	(void)fprintf(stderr, "%s: WARNING: ", program_name);
 #if __STDC__
 	va_start(ap, fmt);
 #else
@@ -223,7 +219,7 @@ char *
 copy_argv(register char **argv)
 {
 	register char **p;
-	register int len = 0;
+	register u_int len = 0;
 	char *buf;
 	char *src, *dst;
 
@@ -275,68 +271,59 @@ savestr(register const char *str)
 	return (p);
 }
 
-
 char *
 read_infile(char *fname)
 {
+	register int fd, cc;
+	register char *cp;
 	struct stat buf;
-	int fd;
-	char *p;
 
 	fd = open(fname, O_RDONLY);
 	if (fd < 0)
-		error("can't open '%s'", fname);
+		error("can't open %s: %s", fname, pcap_strerror(errno));
 
 	if (fstat(fd, &buf) < 0)
-		error("can't stat '%s'", fname);
+		error("can't stat %s: %s", fname, pcap_strerror(errno));
 
-	p = malloc((u_int)buf.st_size + 1);
-	if (p == NULL)
-		error("read_infile: malloc");
-	if (read(fd, p, (int)buf.st_size) != buf.st_size)
-		error("problem reading '%s'", fname);
+	cp = malloc((u_int)buf.st_size + 1);
+	cc = read(fd, cp, (int)buf.st_size);
+	if (cc < 0)
+		error("read %s: %s", fname, pcap_strerror(errno));
+	if (cc != buf.st_size)
+		error("short read %s (%d != %d)", fname, cc, (int)buf.st_size);
+	cp[(int)buf.st_size] = '\0';
 
-	p[(int)buf.st_size] = '\0';
-
-	return p;
+	return (cp);
 }
 
+/*
+ * Returns the difference between gmt and local time in seconds.
+ * Use gmtime() and localtime() to keep things simple.
+ */
 int32_t
-gmt2local()
+gmt2local(void)
 {
-	register int t;
-#if !defined(HAVE_ALTZONE) && !defined(HAVE_TIMEZONE)
-	struct timeval tv;
-	struct timezone tz;
-	register struct tm *tm;
-#endif
-
-	t = 0;
-#if !defined(HAVE_ALTZONE) && !defined(HAVE_TIMEZONE)
-	if (gettimeofday(&tv, &tz) < 0)
-		error("gettimeofday");
-	tm = localtime((time_t *)&tv.tv_sec);
-#ifdef HAVE_TM_GMTOFF
-	t = tm->tm_gmtoff;
-#else
-	t = tz.tz_minuteswest * -60;
-	/* XXX Some systems need this, some auto offset tz_minuteswest... */
-	if (tm->tm_isdst)
-		t += 60 * 60;
-#endif
-#endif
-
-#ifdef HAVE_TIMEZONE
-	tzset();
-	t = -timezone;
-	if (daylight)
-		t += 60 * 60;
-#endif
-
-#ifdef HAVE_ALTZONE
-	tzset();
-	t = -altzone;
-#endif
-
-	return (t);
+	register int dt, dir;
+	register struct tm *gmt, *loc;
+	time_t t;
+	struct tm sgmt;
+
+	t = time(NULL);
+	gmt = &sgmt;
+	*gmt = *gmtime(&t);
+	loc = localtime(&t);
+	dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 +
+	    (loc->tm_min - gmt->tm_min) * 60;
+
+	/*
+	 * If the year or julian day is different, we span 00:00 GMT
+	 * and must add or subtract a day. Check the year first to
+	 * avoid problems when the julian day wraps.
+	 */
+	dir = loc->tm_year - gmt->tm_year;
+	if (dir == 0)
+		dir = loc->tm_yday - gmt->tm_yday;
+	dt += dir * 24 * 60 * 60;
+
+	return (dt);
 }
diff --git a/usr.sbin/tcpdump/vfprintf.c b/usr.sbin/tcpdump/vfprintf.c
new file mode 100644
index 00000000000..d525e311fe9
--- /dev/null
+++ b/usr.sbin/tcpdump/vfprintf.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 1995
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#ifndef lint
+static const char rcsid[] =
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/Attic/vfprintf.c,v 1.1 1996/12/12 16:23:04 bitblt Exp $ (LBL)";
+#endif
+
+#include <sys/types.h>
+
+#include <stdio.h>
+#if __STDC__
+#include <stdarg.h>
+#else
+#include <varargs.h>
+#endif
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "interface.h"
+
+/*
+ * Stock 4.3 doesn't have vfprintf.
+ * This routine is due to Chris Torek.
+ */
+vfprintf(f, fmt, args)
+	FILE *f;
+	char *fmt;
+	va_list args;
+{
+	int ret;
+
+	if ((f->_flag & _IOWRT) == 0) {
+		if (f->_flag & _IORW)
+			f->_flag |= _IOWRT;
+		else
+			return EOF;
+	}
+	ret = _doprnt(fmt, args, f);
+	return ferror(f) ? EOF : ret;
+}