summaryrefslogtreecommitdiff
path: root/usr.sbin/tcpdump
AgeCommit message (Collapse)Author
2014-07-20Fix tcpdump(8) display of logical link control data in IEEE802 frames.Stefan Sperling
The frame subtype field is in the first byte of frame control but tcpdump(8) was looking at the second byte to determine if this is a data frame. Patch by Nathanael Rensen, thanks!
2014-07-04Tcpdump did not show the OSPF router id of hello packets if it wasAlexander Bluhm
equal to the source ip address. This is confusing and inconsistent with IPv6. So always print the rtrid. OK stsp@
2014-06-30remove backwards compat layer for alpha osf1. back then compilers andTheo de Raadt
the parsers sucked, so byte misalignment repair was requested. These days it means the parsers should improve. ok lteo
2014-06-20Instead of showing the difference between a bad checksum and a goodLawrence Teo
checksum, make tcpdump (with the -v flag) show the actual bad checksum within the IP/protocol header itself and what the good checksum should be, e.g. "[bad tcp cksum abcd! -> d1e6]" This change applies to IP, TCP (over IPv4 and IPv6), UDP (over IPv4 and IPv6), ICMP, and ICMPv6. This commit also fixes several inconsistencies in the way bad checksums were displayed for these protocols. Tested on amd64, i386, and macppc. ok henning@
2014-06-20Import in_cksum_shouldbe() from mainline tcpdump; this is needed by myLawrence Teo
upcoming commit which will fix and improve the display of bad checksums for the major protocols. ok henning@
2014-06-03Expand the IP checksum offload subsection to mention the same issue withLawrence Teo
protocol checksum offload, where tcpdump might see bad checksums on valid packets. ok henning@ jmc@
2014-05-23Don't print a "weird flag" type warning "[b2&3=0x2400]" for DNS NOTIFYStuart Henderson
messages which should be sent with AA set. Adapted from a patch at http://marc.info/?l=tcpdump-patches&m=98115734907026&w=2 pointed out by Peter J. Philipp, ok henning@
2014-02-19Add pcap-filter(3) to the SEE ALSO section.Lawrence Teo
ok jmc@
2014-02-05Don't segfault on IPv6 NFS traffic; found the hard why by matthieu@.Florian Obser
Fix inspired by what upstream is doing. Tested by me and matthieu@. Input^WHand holding and OK guenther@
2014-01-26show that zero checksums are invalid for UDP over IPv6; input & ok bluhm@Christian Weisgerber
2014-01-12plen is unsignedTheo de Raadt
2014-01-11Let tcpdump detect bad ICMPv6 checksums with the -v flag.Lawrence Teo
Tested on amd64, i386, loongson, and macppc. OK florian@
2014-01-11Let tcpdump detect bad ICMP checksums with the -v flag.Lawrence Teo
Tested on amd64, i386, loongson, and macppc. OK florian@
2014-01-11Make icmp_print() accept the length variable, which is the length of theLawrence Teo
packet without the IP header. This is needed by the next commit that will allow tcpdump to detect bad ICMP checksums. Related functions like {tcp,udp,icmp6}_print() already accept this length variable, so this change makes icmp_print() consistent with them as well. This commit makes no functional change to tcpdump itself. OK florian@
2013-12-22ctype cleanups, now that the kernel has u_char strings (that is theTheo de Raadt
easy road, otherwise this would be a righteous mess) ok florian
2013-12-03no need for timeb.hTheo de Raadt
2013-10-27If a constant string needs a name, use a static const array instead of aPhilip Guenther
pointer or non-const array, as that minimizes the symbols, maximizes the placement into read-only memory, and avoids warnings from gcc -Wformat=2 when they're used as format strings. ok deraadt@
2013-10-24These two programs got fooled by the KAME/NRL split and need type repair.Theo de Raadt
They do not indicate a problem with the reduction of namespace export, but got suckered into the 1999 plan. ok benno
2013-07-16use .Mt for email addresses; from Jan Stary <hans at stare dot cz>; ok jmc@Ingo Schwarze
2013-07-10In the EXAMPLES section, it is not very obvious that "localnet" is not aLawrence Teo
literal argument name due to lack of formatting, so replace it with an example network to make it clearer (discussed with and suggested by jmc@). While here, fix some style nits in a sentence to make it consistent with the other examples. ok jmc
2013-06-19Do not install pcap-int.h to /usr/include as it is an internal libraryLawrence Teo
header (pointed out by matthew@). Let only pflogd and tcpdump include pcap-int.h directly since they need it for privilege separation. "looks good" sthen feedback/ok deraadt matthew millert
2013-04-16fix glitches in unused source file; ok millertTheo de Raadt
2013-01-17Dump some more flags and subtypes in tcpdump. Especially flags used inClaudio Jeker
power saving mode. OK giovanni@
2012-11-14In the unlikely event that a NULL device is passed to priv_pcap_live(),Lawrence Teo
ensure that the function will stop and return NULL instead of continuing (which could lead to a segfault). ok benno deraadt otto
2012-09-26last stage of rfc changes, using consistent Rs/Re blocks, and moving theJason McIntyre
references into a STANDARDS section;
2012-09-19replay counter was bumped a while ago, update byte order conversion;Mike Belopuhov
while here, improve the way information is printed out a bit. with input and ok camield, mpf
2012-08-29- rfc 4835 obsoletes rfc 2406Jason McIntyre
- flesh out SEE ALSO ok sthen
2012-08-24We maintain our own tcpdump, so remove the sentence in the BUGS sectionLawrence Teo
that asks users to send bug reports to mainline tcpdump. While here, fix two mandoc -Tlint warnings by removing unnecessary .Pp instances. ok deraadt jmc naddy
2012-07-13Recognize additional DH groups; ok sthen naddyMike Belopuhov
2012-07-11cleanup offset argument in default_print_* functions, pointed out by Mike SmallStuart Henderson
ok theo
2012-07-10support -A to print the ascii text of captured packets. ok deraadt@Stuart Henderson
2012-07-08New attempt to make the -P flag work with -ss, so that states can beLawrence Teo
printed with port names if desired. tcpdump's pf_print_state.c has diverged significantly from pfctl's, so the change to tcpdump's pf_print_state.c is not exactly the same as pfctl's. ok henning sthen
2012-05-03esp/ah sequence number is unsigned and should be printed as such;Mike Belopuhov
ok haesbaert, sthen, yasuoka, mpf
2012-04-04Return an error much earlier if recvmsg failsTheo de Raadt
2012-02-19Fix a classical bug (= vs ==). OK stsp@ miod@Claudio Jeker
2012-01-28Use safeputs() for radius, some decodes are likely to have unprintableStuart Henderson
characters. ok mikeb@
2012-01-28Print names rather than numbers for the old draft nat-t attributes,Stuart Henderson
cisco use these at least as recently as ASAs running 8.4(1)
2011-12-28Print PPP-Max-Payload headers (for RFC 4638 PPPoe), part of a larger diffStuart Henderson
from Matt Dainty. ok haesbaert@
2011-10-13Teach some userland tools about NAT64. I think this is mostly from mikeb@Claudio Jeker
OK mcbride@
2011-09-22Let tcpdump use the same format for printing IPv6 fragments as forAlexander Bluhm
IPv4. Now it is id:len@off+more for both. ok jsing
2011-09-22Revert r1.29. Now that the "C" locale is ASCII-only, this workaroundStefan Sperling
is no longer needed. ok naddy
2011-09-18extract 8 octets (as per RFC 2661) rather than a long; with jsing@Christian Weisgerber
2011-09-18Fix whitespace.Joel Sing
2011-09-18Avoid potential 64-bit unaligned access on strict alignment architectures.Joel Sing
Spotted by and ok naddy@
2011-09-17Make tcpdump -v print the id and seq of icmp6 echo packets.Alexander Bluhm
ok claudio naddy
2011-09-17update pointer variable after copying misaligned packet; ok claudio@Christian Weisgerber
2011-09-17access a 32-bit field as u_int32_t, not as u_long; ok bluhm@Christian Weisgerber
2011-07-25Be more careful when looking at l2tp traffic. Do more length checks andClaudio Jeker
make sure that no unaligned access to uint16_t values happen. Tested and feedback by yasuoka@
2011-06-27fix an off by one which resulted in 'no next header' packets not beingDavid Hill
displayed. help from bluhm@ OK claudio@
2011-04-03Call setlocale() to avoid display glitches in UTF-8 locales.Stefan Sperling
ok phessler nicm mikeb