summaryrefslogtreecommitdiff
path: root/usr.sbin/tcpdump
AgeCommit message (Collapse)Author
2014-12-03Restore packetp and snapend pointers once we're done with an incorrectlyMike Belopuhov
aligned IP/IPv6 packet so that tcpdump can print hexdump of the whole packet including the Ethernet header (if requested) and not only the IP/IPv6 part of it. ok jsg
2014-12-03Fixup a crash found by jsg using the AFL fuzzer. IP and IPv6 printingMike Belopuhov
routines should check that there's at least a complete IP/IPv6 header available in the buffer before trying to do anything else. ok jsg
2014-11-26Prefer setvbuf() to setlinebuf() for portability; ok deraadt@Todd C. Miller
2014-11-20better length handling. Fixes a crash found with the afl fuzzer.Jonathan Gray
slightly tweaked version of an earlier diff ok'd by djm@ and miod@
2014-11-20sanity check the length of the packet in the pcap headerJonathan Gray
fixes a crash found by the afl fuzzer ok djm@ miod@
2014-11-20Make ip6_print() take an unsigned length matchingJonathan Gray
ip_print() and others. Allows code deciding on a minimum length to memmove() to work as intended, preventing various crashes found with the afl fuzzer. Callers of ip6_print() should of course be fixed to provide sane lengths as well. ok deraadt@ djm@
2014-10-08obvious malloc() -> reallocarray() oflow check; ok dougTheo de Raadt
2014-08-14No use for <netinet/in_systm.h> nor <netinet/tcpip.h>.Martin Pieuchot
2014-07-20Fix tcpdump(8) display of logical link control data in IEEE802 frames.Stefan Sperling
The frame subtype field is in the first byte of frame control but tcpdump(8) was looking at the second byte to determine if this is a data frame. Patch by Nathanael Rensen, thanks!
2014-07-04Tcpdump did not show the OSPF router id of hello packets if it wasAlexander Bluhm
equal to the source ip address. This is confusing and inconsistent with IPv6. So always print the rtrid. OK stsp@
2014-06-30remove backwards compat layer for alpha osf1. back then compilers andTheo de Raadt
the parsers sucked, so byte misalignment repair was requested. These days it means the parsers should improve. ok lteo
2014-06-20Instead of showing the difference between a bad checksum and a goodLawrence Teo
checksum, make tcpdump (with the -v flag) show the actual bad checksum within the IP/protocol header itself and what the good checksum should be, e.g. "[bad tcp cksum abcd! -> d1e6]" This change applies to IP, TCP (over IPv4 and IPv6), UDP (over IPv4 and IPv6), ICMP, and ICMPv6. This commit also fixes several inconsistencies in the way bad checksums were displayed for these protocols. Tested on amd64, i386, and macppc. ok henning@
2014-06-20Import in_cksum_shouldbe() from mainline tcpdump; this is needed by myLawrence Teo
upcoming commit which will fix and improve the display of bad checksums for the major protocols. ok henning@
2014-06-03Expand the IP checksum offload subsection to mention the same issue withLawrence Teo
protocol checksum offload, where tcpdump might see bad checksums on valid packets. ok henning@ jmc@
2014-05-23Don't print a "weird flag" type warning "[b2&3=0x2400]" for DNS NOTIFYStuart Henderson
messages which should be sent with AA set. Adapted from a patch at http://marc.info/?l=tcpdump-patches&m=98115734907026&w=2 pointed out by Peter J. Philipp, ok henning@
2014-02-19Add pcap-filter(3) to the SEE ALSO section.Lawrence Teo
ok jmc@
2014-02-05Don't segfault on IPv6 NFS traffic; found the hard why by matthieu@.Florian Obser
Fix inspired by what upstream is doing. Tested by me and matthieu@. Input^WHand holding and OK guenther@
2014-01-26show that zero checksums are invalid for UDP over IPv6; input & ok bluhm@Christian Weisgerber
2014-01-12plen is unsignedTheo de Raadt
2014-01-11Let tcpdump detect bad ICMPv6 checksums with the -v flag.Lawrence Teo
Tested on amd64, i386, loongson, and macppc. OK florian@
2014-01-11Let tcpdump detect bad ICMP checksums with the -v flag.Lawrence Teo
Tested on amd64, i386, loongson, and macppc. OK florian@
2014-01-11Make icmp_print() accept the length variable, which is the length of theLawrence Teo
packet without the IP header. This is needed by the next commit that will allow tcpdump to detect bad ICMP checksums. Related functions like {tcp,udp,icmp6}_print() already accept this length variable, so this change makes icmp_print() consistent with them as well. This commit makes no functional change to tcpdump itself. OK florian@
2013-12-22ctype cleanups, now that the kernel has u_char strings (that is theTheo de Raadt
easy road, otherwise this would be a righteous mess) ok florian
2013-12-03no need for timeb.hTheo de Raadt
2013-10-27If a constant string needs a name, use a static const array instead of aPhilip Guenther
pointer or non-const array, as that minimizes the symbols, maximizes the placement into read-only memory, and avoids warnings from gcc -Wformat=2 when they're used as format strings. ok deraadt@
2013-10-24These two programs got fooled by the KAME/NRL split and need type repair.Theo de Raadt
They do not indicate a problem with the reduction of namespace export, but got suckered into the 1999 plan. ok benno
2013-07-16use .Mt for email addresses; from Jan Stary <hans at stare dot cz>; ok jmc@Ingo Schwarze
2013-07-10In the EXAMPLES section, it is not very obvious that "localnet" is not aLawrence Teo
literal argument name due to lack of formatting, so replace it with an example network to make it clearer (discussed with and suggested by jmc@). While here, fix some style nits in a sentence to make it consistent with the other examples. ok jmc
2013-06-19Do not install pcap-int.h to /usr/include as it is an internal libraryLawrence Teo
header (pointed out by matthew@). Let only pflogd and tcpdump include pcap-int.h directly since they need it for privilege separation. "looks good" sthen feedback/ok deraadt matthew millert
2013-04-16fix glitches in unused source file; ok millertTheo de Raadt
2013-01-17Dump some more flags and subtypes in tcpdump. Especially flags used inClaudio Jeker
power saving mode. OK giovanni@
2012-11-14In the unlikely event that a NULL device is passed to priv_pcap_live(),Lawrence Teo
ensure that the function will stop and return NULL instead of continuing (which could lead to a segfault). ok benno deraadt otto
2012-09-26last stage of rfc changes, using consistent Rs/Re blocks, and moving theJason McIntyre
references into a STANDARDS section;
2012-09-19replay counter was bumped a while ago, update byte order conversion;Mike Belopuhov
while here, improve the way information is printed out a bit. with input and ok camield, mpf
2012-08-29- rfc 4835 obsoletes rfc 2406Jason McIntyre
- flesh out SEE ALSO ok sthen
2012-08-24We maintain our own tcpdump, so remove the sentence in the BUGS sectionLawrence Teo
that asks users to send bug reports to mainline tcpdump. While here, fix two mandoc -Tlint warnings by removing unnecessary .Pp instances. ok deraadt jmc naddy
2012-07-13Recognize additional DH groups; ok sthen naddyMike Belopuhov
2012-07-11cleanup offset argument in default_print_* functions, pointed out by Mike SmallStuart Henderson
ok theo
2012-07-10support -A to print the ascii text of captured packets. ok deraadt@Stuart Henderson
2012-07-08New attempt to make the -P flag work with -ss, so that states can beLawrence Teo
printed with port names if desired. tcpdump's pf_print_state.c has diverged significantly from pfctl's, so the change to tcpdump's pf_print_state.c is not exactly the same as pfctl's. ok henning sthen
2012-05-03esp/ah sequence number is unsigned and should be printed as such;Mike Belopuhov
ok haesbaert, sthen, yasuoka, mpf
2012-04-04Return an error much earlier if recvmsg failsTheo de Raadt
2012-02-19Fix a classical bug (= vs ==). OK stsp@ miod@Claudio Jeker
2012-01-28Use safeputs() for radius, some decodes are likely to have unprintableStuart Henderson
characters. ok mikeb@
2012-01-28Print names rather than numbers for the old draft nat-t attributes,Stuart Henderson
cisco use these at least as recently as ASAs running 8.4(1)
2011-12-28Print PPP-Max-Payload headers (for RFC 4638 PPPoe), part of a larger diffStuart Henderson
from Matt Dainty. ok haesbaert@
2011-10-13Teach some userland tools about NAT64. I think this is mostly from mikeb@Claudio Jeker
OK mcbride@
2011-09-22Let tcpdump use the same format for printing IPv6 fragments as forAlexander Bluhm
IPv4. Now it is id:len@off+more for both. ok jsing
2011-09-22Revert r1.29. Now that the "C" locale is ASCII-only, this workaroundStefan Sperling
is no longer needed. ok naddy
2011-09-18extract 8 octets (as per RFC 2661) rather than a long; with jsing@Christian Weisgerber