1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
|
$NetBSD: CHANGES,v 1.2 1995/03/06 19:09:42 mycroft Exp $
@(#) Header: CHANGES,v 1.6 94/06/20 19:34:38 leres Exp (LBL)
v3.0 Mon Jun 20 19:23:27 PDT 1994
- Reorganize protocol dumpers to take const pointers to packets so they
never change the contents (i.e., they used to do endian conversions
in place). Previously, whenever more than one pass was taken over
the packet, the packet contents would be dumped incorrectly (i.e.,
the output form -x would be wrong on little endian machines because
the protocol dumpers would modify the data). Thanks to Charles Hannum
(mycroft@gnu.ai.mit.edu) for reporting this problem.
- Added support for decnet protocol dumping thanks to Jeff Mogul
(mogul@pa.dec.com).
- Fix bug that caused length of packet to be incorrectly printed
(off by ether header size) for unknown ethernet types thanks
to Greg Miller (gmiller@kayak.mitre.org).
- Added support for IPX protocol dumping thanks to Brad Parker
(brad@fcr.com).
- Added check to verify IP header checksum under -v thanks to
Brad Parker (brad@fcr.com).
- Move packet capture code to new libpcap library (which is
packaged separately).
- Prototype everything and assume an ansi compiler.
- print-arp.c: Print hardware ethernet addresses if they're not
what we expect.
- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
- print-fddi.c: Improvements. Thanks to Jeffrey Mogul
(mogul@pa.dec.com).
- print-icmp.c: Byte swap netmask before printing. Thanks to
Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
By default, only the inner packet is dumped, appended with the token
"(encap)". Under -v, both the inner and output packets are dumped
(on the same line). Note that the filter applies to the original packet,
not the encapsulated packet. So if you run tcpdump on a net with an
IP Multicast tunnel, you cannot filter out the datagrams using the
conventional syntax. (You can filter away all the ip-in-ip traffic
with "not ip proto 4".)
- print-nfs.c: Keep pending rpc's in circular table. Add generic
nfs header and remove os dependences. Thanks to Jeffrey Mogul.
- print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
(sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
Add && and || operators
v2.2.1 Tue Jun 6 17:57:22 PDT 1992
- Fix bug with -c flag.
v2.2 Fri May 22 17:19:41 PDT 1992
- savefile.c: Remove hack that shouldn't have been exported. Add
truncate checks.
- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0'
matches non-echo/reply ICMP packets.
- Many improvements to filter code optimizer.
- Added 'multicast' keyword and extended the 'broadcast' keyword can now be
so that protocol qualitfications are allowed. For example, "ip broadcast"
and "ether multicast" are valid filters.
- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
patches to netinet/if_loop.c.
- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
- Added EGP and OSPF printers, thanks to Jeffrey Honig.
v2.1 Tue Jan 28 11:00:14 PST 1992
- Internal release (never publically exported).
v2.0.1 Sun Jan 26 21:10:10 PDT
- Various byte ordering fixes.
- Add truncation checks.
- inet.c: Support BSD style SIOCGIFCONF.
- nametoaddr.c: Handle multi addresses for single host.
- optimize.c: Rewritten.
- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
for broadcast nets.
- print-atal.c: Fix an alignment bug (thanks to
stanonik@nprdc.navy.mil) Add missing printf() argument.
- print-bootp.c: First attempt at decoding the vendor buffer.
- print-domain.c: Fix truncation checks.
- print-icmp.c: Calculate length of packets from the ip header.
- print-ip.c: Print frag id in decimal (so it's easier to match up
with non-frags). Add support for ospf, egp and igmp.
- print-nfs.c: Lots of changes.
- print-ntp.c: Make some verbose output depend on -v.
- print-snmp.c: New version from John LoVerso.
- print-tcp.c: Print rfc1072 tcp options.
- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
(microseconds) worth of precision. Fix uid bugs.
- A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
With this option, you can create an architecture independent binary
trace file in real time, without the overhead of the packet printer.
At a later time, the packets can be filtered (again) and printed.
- BSD is supported. You must have BPF in your kernel.
Since the filtering is now done in the kernel, fewer packets are
dropped. In fact, with BPF and the packet dumper option, a measly
Sun 3/50 can keep up with a busy network.
- Compressed SLIP packets can now be dumped, provided you use our
SLIP software and BPF. These packets are dumped as any other IP
packet; the compressed headers are dumped with the '-e' option.
- Machines with little-endian byte ordering are supported (thanks to
Jeff Mogul).
- Ultrix 4.0 is supported (also thanks to Jeff Mogul).
- IBM RT and Stanford Enetfilter support has been added by
Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under
both the vanilla Enetfilter interface, and the extended interface
(#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
- TFTP packets are now printed (requests only).
- BOOTP packets are now printed.
- SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
- Sparc architectures, including the Sparcstation-1, are now
supported thanks to Steve McCanne and Craig Leres.
- SunOS 4 is now supported thanks to Micky Liu of Columbia
University (micky@cunixc.cc.columbia.edu).
- IP options are now printed.
- RIP packets are now printed.
- There's a -v flag that prints out more information than the
default (e.g., it will enable printing of IP ttl, tos and id)
and -q flag that prints out less (e.g., it will disable
interpretation of AppleTalk-in-UDP).
- The grammar has undergone substantial changes (if you have an
earlier version of tcpdump, you should re-read the manual
entry).
The most useful change is the addition of an expression
syntax that lets you filter on arbitrary fields or values in the
packet. E.g., "ip[0] > 0x45" would print only packets with IP
options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
packets.
The most painful change is that concatenation no longer means
"and" -- e.g., you have to say "host foo and port bar" instead
of "host foo port bar". The up side to this down is that
repeated qualifiers can be omitted, making most filter
expressions shorter. E.g., you can now say "ip host foo and
(bar or baz)" to look at ip traffic between hosts foo and bar or
between hosts foo and baz. [The old way of saying this was "ip
host foo and (ip host bar or ip host baz)".]
v2.0 Sun Jan 13 12:20:40 PST 1991
- Initial public release.
|
