auto import from //depot/cupcake/@135843
diff --git a/CHANGES b/CHANGES
new file mode 100644
index 0000000..aa29e30
--- /dev/null
+++ b/CHANGES
@@ -0,0 +1,878 @@
+$Header: /tcpdump/master/tcpdump/CHANGES,v 1.87.2.17 2007/09/13 13:39:44 ken Exp $
+
+Mon. September 10, 2007. ken@xelerance.com. Summary for 0.9.8 tcpdump release
+ Rework ARP printer
+ Rework OSPFv3 printer
+ Add support for Frame-Relay ARP
+ Decode DHCP Option 121 (RFC 3442 Classless Static Route)
+ Decode DHCP Option 249 (MS Classless Static Route) the same as Option 121
+ TLV: Add support for Juniper .pcap extensions
+ Print EGP header in new-world-order style
+ Converted print-isakmp.c to NETDISSECT
+ Moved AF specific stuff into af.h
+ Test subsystem now table driven, and saves outputs and diffs to one place
+ Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
+ libpcap files on an OS other than where the file was generated
+
+Wed. July 23, 2007. mcr@xelerance.com. Summary for 0.9.7 tcpdump release
+
+ NFS: Print unsigned values as such.
+ RX: parse safely.
+ BGP: fixes for IPv6-less builds.
+ 801.1ag: use standard codepoint.
+ use /dev/bpf on systems with such a device.
+ 802.11: print QoS data, avoid dissect of no-data frame, ignore padding.
+ smb: make sure that we haven't gone past the end of the captured data.
+ smb: squelch an uninitialized complaint from coverity.
+ NFS: from NetBSD; don't interpret the reply as a possible NFS reply
+ if it got MSG_DENIED.
+ BGP: don't print TLV values that didn't fit, from www.digit-labs.org.
+ revised INSTALL.txt about libpcap dependancy.
+
+Wed. April 25, 2007. ken@xelerance.com. Summary for 3.9.6 tcpdump release
+ Update man page to reflect changes to libpcap
+ Changes to both TCP and IP Printer Output
+ Fix a potential buffer overflow in the 802.11 printer
+ Print basic info about a few more Cisco LAN protocols.
+ mDNS cleanup
+ ICMP MPLS rework of the extension code
+ bugfix: use the correct codepoint for the OSPF simple text auth token
+ entry, and use safeputs to print the password.
+ Add support in pflog for additional values
+ Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
+ Add support for the Message-id NACK c-type.
+ Add support for 802.3ah loopback ctrl msg
+ Add support for Multiple-STP as per 802.1s
+ Add support for rapid-SPT as per 802.1w
+ Add support for CFM Link-trace msg, Link-trace-Reply msg,
+ Sender-ID tlv, private tlv, port, interface status
+ Add support for unidirectional link detection as per
+ http://www.ietf.org/internet-drafts/draft-foschiano-udld-02.txt
+ Add support for the olsr protocol as per RFC 3626 plus the LQ
+ extensions from olsr.org
+ Add support for variable-length checksum in DCCP, as per section 9 of
+ RFC 4340.
+ Add support for per-VLAN spanning tree and per-VLAN rapid spanning tree
+ Add support for Multiple-STP as per 802.1s
+ Add support for the cisco propriatry 'dynamic trunking protocol'
+ Add support for the cisco proprietary VTP protocol
+ Update dhcp6 options table as per IETF standardization activities
+
+
+Tue. September 19, 2006. ken@xelerance.com. Summary for 3.9.5 tcpdump release
+
+ Fix compiling on AIX (, at end of ENUM)
+ Updated list of DNS RR typecodes
+ Use local Ethernet defs on WIN32
+ Add support for Frame-Relay ARP
+ Fixes for compiling under MSVC++
+ Add support for parsing Juniper .pcap files
+ Add support for FRF.16 Multilink Frame-Relay (DLT_MFR)
+ Rework the OSPFv3 printer
+ Fix printing for 4.4BSD/NetBSD NFS Filehandles
+ Add support for Cisco style NLPID encapsulation
+ Add cisco prop. eigrp related, extended communities
+ Add support for BGP signaled VPLS
+ Cleanup the bootp printer
+ Add support for PPP over Frame-Relay
+ Add some bounds checking to the IP options code, and clean up
+ the options output a bit.
+ Add additional modp groups to ISAKMP printer
+ Add support for Address-Withdraw and Label-Withdraw Msgs
+ Add support for the BFD Discriminator TLV
+ Fixes for 64bit compiling
+ Add support for PIMv2 checksum verification
+ Add support for further dissection of the IPCP Compression Option
+ Add support for Cisco's proposed VQP protocol
+ Add basic support for keyed authentication TCP option
+ Lots of minor cosmetic changes to output printers
+
+
+Mon. September 19, 2005. ken@xelerance.com. Summary for 3.9.4 tcpdump release
+ Decoder support for more Juniper link-layer types
+ Fix a potential buffer overflow (although it can't occur in
+ practice).
+ Fix the handling of unknown management frame types in the 802.11
+ printer.
+ Add FRF.16 support, fix various Frame Relay bugs.
+ Add support for RSVP integrity objects, update fast-reroute
+ object printer to latest spec.
+ Clean up documentation of vlan filter expression, document mpls
+ filter expression.
+ Document new pppoed and pppoes filter expressions.
+ Update diffserver-TE codepoints as per RFC 4124.
+ Spelling fixes in ICMPv6.
+ Don't require any fields other than flags to be present in IS-IS
+ restart signaling TLVs, and only print the system ID in
+ those TLVs as system IDs, not as node IDs.
+ Support for DCCP.
+
+Tue. July 5, 2005. ken@xelerance.com. Summary for 3.9.3 tcpdump release
+
+ Option to chroot() when dropping privs
+ Fixes for compiling on nearly every platform,
+ including improved 64bit support
+ Many new testcases
+ Support for sending packets
+ Many compliation fixes on most platforms
+ Fixes for recent version of GCC to eliminate warnings
+ Improved Unicode support
+
+ Decoders & DLT Changes, Updates and New:
+ AES ESP support
+ Juniper ATM, FRF.15, FRF.16, PPPoE,
+ ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC
+ GGSN,ES,MONITOR,SERVICES
+ L2VPN
+ Axent Raptor/Symantec Firewall
+ TCP-MD5 (RFC 2385)
+ ESP-in-UDP (RFC 3948)
+ ATM OAM
+ LMP, LMP Service Discovery
+ IP over FC
+ IP over IEEE 1394
+ BACnet MS/TP
+ SS7
+ LDP over TCP
+ LACP, MARKER as per 802.3ad
+ PGM (RFC 3208)
+ LSP-PING
+ G.7041/Y.1303 Generic Framing Procedure
+ EIGRP-IP, EIGRP-IPX
+ ICMP6
+ Radio - via radiotap
+ DHCPv6
+ HDLC over PPP
+
+Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
+
+ No changes from 3.8.2. Version bumped only to maintain consistency
+ with libpcap 0.8.3.
+
+Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
+
+ Fixes for print-isakmp.c CVE: CAN-2004-0183, CAN-2004-0184
+ http://www.rapid7.com/advisories/R7-0017.html
+ IP-over-IEEE1394 printing.
+ some MINGW32 changes.
+ updates for autoconf 2.5
+ fixes for print-aodv.c - check for too short packets
+ formatting changes to print-ascii for hex output.
+ check for too short packets: print-bgp.c, print-bootp.c, print-cdp.c,
+ print-chdlc.c, print-domain.c, print-icmp.c, print-icmp6.c,
+ print-ip.c, print-lwres.c, print-ospf.c, print-pim.c,
+ print-ppp.c,print-pppoe.c, print-rsvp.c, print-wb.c
+ print-ether.c - better handling of unknown types.
+ print-isoclns.c - additional decoding of types.
+ print-llc.c - strings for LLC names added.
+ print-pfloc.c - various enhancements
+ print-radius.c - better decoding to strings.
+
+Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 3.8 release
+
+ changed syntax of -E argument so that multiple SAs can be decrypted
+ fixes for Digital Unix headers and Documentation
+ __attribute__ fixes
+ CDP changes from Terry Kennedy <terry@tmk.com>.
+ IPv6 mobility updates from Kazushi Sugyo <sugyo@pb.jp.nec.com>
+ Fixes for ASN.1 decoder for 2.100.3 forms.
+ Added a count of packets received and processed to clarify numbers.
+ Incorporated WinDUMP patches for Win32 builds.
+ PPPoE payload length headers.
+ Fixes for HP C compiler builds.
+ Use new pcap_breakloop() and pcap_findalldevs() if we can.
+ BGP output split into multiple lines.
+ Fixes to 802.11 decoding.
+ Fixes to PIM decoder.
+ SuperH is a CPU that can't handle unaligned access. Many fixes for
+ unaligned access work.
+ Fixes to Frame-Relay decoder for Q.933/922 frames.
+ Clarified when Solaris can do captures as non-root.
+ Added tests/ subdir for examples/regression tests.
+ New -U flag. -flush stdout after every packet
+ New -A flag -print ascii only
+ support for decoding IS-IS inside Cisco HDLC Frames
+ more verbosity for tftp decoder
+ mDNS decoder
+ new BFD decoder
+ cross compilation patches
+ RFC 3561 AODV support.
+ UDP/TCP pseudo-checksum properly for source-route options.
+ sanitized all files to modified BSD license
+ Add support for RFC 2625 IP-over-Fibre Channel.
+ fixes for DECnet support.
+ Support RFC 2684 bridging of Ethernet, 802.5 Token Ring, and FDDI.
+ RFC 2684 encapsulation of BPDUs.
+
+Tuesday, February 25, 2003. fenner@research.att.com. 3.7.2 release
+
+ Fixed infinite loop when parsing malformed isakmp packets.
+ (reported by iDefense; already fixed in CVS)
+ Fixed infinite loop when parsing malformed BGP packets.
+ Fixed buffer overflow with certain malformed NFS packets.
+ Pretty-print unprintable network names in 802.11 printer.
+ Handle truncated nbp (appletalk) packets.
+ Updated DHCPv6 printer to match draft-ietf-dhc-dhcpv6-22.txt
+ Print IP protocol name even if we don't have a printer for it.
+ Print IP protocol name or number for fragments.
+ Print the whole MPLS label stack, not just the top label.
+ Print request header and file handle for NFS v3 FSINFO and PATHCONF
+ requests.
+ Fix NFS packet truncation checks.
+ Handle "old" DR-Priority and Bidir-Capable PIM HELLO options.
+ Handle unknown RADIUS attributes properly.
+ Fix an ASN.1 parsing error that would cause e.g. the OID
+ 2.100.3 to be misrepresented as 4.20.3 .
+
+Monday, January 21, 2002. mcr@sandelman.ottawa.on.ca. Summary for 3.7 release
+see http://www.tcpdump.org/cvs-log/2002-01-21.10:16:48.html for commit log.
+ keyword "ipx" added.
+ Better OSI/802.2 support on Linux.
+ IEEE 802.11 support, from clenahan@fortresstech.com, achirica@ttd.net.
+ LLC SAP support for FDDI/token ring/RFC-1483 style ATM
+ BXXP protocol was replaced by the BEEP protocol;
+ improvements to SNAP demux.
+ Changes to "any" interface documentation.
+ Documentation on pcap_stats() counters.
+ Fix a memory leak found by Miklos Szeredi - pcap_ether_aton().
+ Added MPLS encapsulation decoding per RFC3032.
+ DNS dissector handles TKEY, TSIG and IXFR.
+ adaptive SLIP interface patch from Igor Khristophorov <igor@atdot.org>
+ SMB printing has much improved bounds checks
+ OUI 0x0000f8 decoded as encapsulated ethernet for Cisco-custom bridging
+ Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
+ Solaris - devices with digits in them. Stefan Hudson <hudson@mbay.net>
+ IPX socket 0x85be is for Cisco EIGRP over IPX.
+ Improvements to fragmented ESP handling.
+ SCTP support from Armando L. Caro Jr. <acaro@mail.eecis.udel.edu>
+ Linux ARPHDR_ATM support fixed.
+ Added a "netbeui" keyword, which selects NetBEUI packets.
+ IPv6 ND improvements, MobileIP dissector, 2292bis-02 for RA option.
+ Handle ARPHDR_HDLC from Marcus Felipe Pereira <marcus@task.com.br>.
+ Handle IPX socket 0x553 -> NetBIOS-over-IPX socket, "nwlink-dgm"
+ Better Linux libc5 compat.
+ BIND9 lwres dissector added.
+ MIPS and SPARC get strict alignment macros (affects print-bgp.c)
+ Apple LocalTalk LINKTYPE_ reserved.
+ New time stamp formats documented.
+ DHCP6 updated to draft-22.txt spec.
+ ICMP types/codes now accept symbolic names.
+ Add SIGINFO handler from LBL
+ encrypted CIPE tunnels in IRIX, from Franz Schaefer <schaefer@mond.at>.
+ now we are -Wstrict-prototype clean.
+ NetBSD DLT_PPP_ETHER; adapted from Martin Husemann <martin@netbsd.org>.
+ PPPoE dissector cleaned up.
+ Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
+ In dissector, now the caller prints the IP addresses rather than proto.
+ cjclark@alum.mit.edu: print the IP proto for non-initial fragments.
+ LLC frames with a DSAP and LSAP of 0xe0 are IPX frames.
+ Linux cooked frames with a type value of LINUX_SLL_P_802_3 are IPX.
+ captures on the "any" device won't be done in promiscuous mode
+ Token Ring support on DLPI - Onno van der Linden <onno@simplex.nl>
+ ARCNet support, from NetBSD.
+ HSRP dissector, from Julian Cowley <julian@lava.net>.
+ Handle (GRE-encapsulated) PPTP
+ added -C option to rotate save file every optarg * 1,000,000 bytes.
+ support for "vrrp" name - NetBSD, by Klaus Klein <kleink@netbsd.org>.
+ PPTP support, from Motonori Shindo <mshindo@mshindo.net>.
+ IS-IS over PPP support, from Hannes Gredler <hannes@juniper.net>.
+ CNFP support for IPv6,format. Harry Raaymakers <harryr@connect.com.au>.
+ ESP printing updated to RFC2406.
+ HP-UX can now handle large number of PPAs.
+ MSDP printer added.
+ L2TP dissector improvements from Motonori Shindo.
+
+Tuesday January 9, 2001. mcr@sandelman.ottawa.on.ca. Summary for 3.6 release
+ Cleaned up documentation.
+ Promisc mode fixes for Linux
+ IPsec changes/cleanups.
+ Alignment fixes for picky architectures
+
+ Removed dependency on native headers for packet dissectors.
+ Removed Linux specific headers that were shipped
+
+ libpcap changes provide for exchanging capture files between
+ systems. Save files now have well known PACKET_ values instead of
+ depending upon system dependant mappings of DLT_* types.
+
+ Support for computing/checking IP and UDP/TCP checksums.
+
+ Updated autoconf stock files.
+
+ IPv6 improvements: dhcp (draft-15), mobile-ip6, ppp, ospf6,
+
+ Added dissector support for: ISOCLNS, Token Ring, IGMPv3, bxxp,
+ timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, raw-AppleTalk
+
+ Added filtering support for: VLANs, ESIS, ISIS
+
+ Improvements to: print-telnet, IPTalk, bootp/dhcp, ECN, PPP,
+ L2TP, PPPoE
+
+ HP-UX 11.0 -- find the right dlpi device.
+ Solaris 8 - IPv6 works
+ Linux - Added support for an "any" device to capture on all interfaces
+
+ Security fixes: buffer overrun audit done. Strcpy replaced with
+ strlcpy, sprintf replaced with snprintf.
+ Look for lex problems, and warn about them.
+
+
+v3.5 Fri Jan 28 18:00:00 PST 2000
+
+Bill Fenner <fenner@research.att.com>
+- switch to config.h for autoconf
+- unify RCSID strings
+- Updated PIMv1, PIMv2, DVMRP, IGMP parsers, add Cisco Auto-RP parser
+- Really fix the RIP printer
+- Fix MAC address -> name translation.
+- some -Wall -Wformat fixes
+- update makemib to parse much of SMIv2
+- Print TCP sequence # with -vv even if you normally wouldn't
+- Print as much of IP/TCP/UDP headers as possible even if truncated.
+
+itojun@iijlab.net
+- -X will make a ascii dump. from netbsd.
+- telnet command sequence decoder (ff xx xx). from netbsd.
+- print-bgp.c: improve options printing. ugly code exists for
+ unaligned option parsing (need some fix).
+- const poisoning in SMB decoder.
+- -Wall -Werror clean checks.
+- bring in KAME IPv6/IPsec decoding code.
+
+Assar Westerlund <assar@sics.se>
+- SNMPv2 and SNMPv3 printer
+- If compiled with libsmi, tcpdump can load MIBs on the fly to decode
+ SNMP packets.
+- Incorporate NFS parsing code from NetBSD. Adds support for nfsv3.
+- portability fixes
+- permit building in different directories.
+
+Ken Hornstein <kenh@cmf.nrl.navy.mil>
+- bring in code at
+ /afs/transarc.com/public/afs-contrib/tools/tcpdump for parsing
+ AFS3 packets
+
+Andrew Tridgell <tridge@linuxcare.com>
+- SMB printing code
+
+Love <lha@stacken.kth.se>
+- print-rx.c: add code for printing MakeDir and StoreStatus. Also
+ change date format to the right one.
+
+Michael C. Richardson <mcr@sandelman.ottawa.on.ca>
+- Created tcpdump.org repository
+
+v3.4 Sat Jul 25 12:40:55 PDT 1998
+
+- Hardwire Linux slip support since it's too hard to detect.
+
+- Redo configuration of "network" libraries (-lsocket and -lnsl) to
+ deal with IRIX. Thanks to John Hawkinson (jhawk@mit.edu)
+
+- Added -a which tries to translate network and broadcast addresses to
+ names. Suggested by Rob van Nieuwkerk (robn@verdi.et.tudelft.nl)
+
+- Added a configure option to disable gcc.
+
+- Added a "raw" packet printer.
+
+- Not having an interface address is no longer fatal. Requested by John
+ Hawkinson.
+
+- Rework signal setup to accommodate Linux.
+
+- OSPF truncation check fix. Also display the type of OSPF packets
+ using MD5 authentication. Thanks to Brian Wellington
+ (bwelling@tis.com)
+
+- Fix truncation check bugs in the Kerberos printer. Reported by Ezra
+ Peisach (epeisach@mit.edu)
+
+- Don't catch SIGHUP when invoked with nohup(1). Thanks to Dave Plonka
+ (plonka@mfa.com)
+
+- Specify full install target as a way of detecting if install
+ directory does not exist. Thanks to Dave Plonka.
+
+- Bit-swap FDDI addresses for BSD/OS too. Thanks to Paul Vixie
+ (paul@vix.com)
+
+- Fix off-by-one bug when testing size of ethernet packets. Thanks to
+ Marty Leisner (leisner@sdsp.mc.xerox.com)
+
+- Add a local autoconf macro to check for routines in libraries; the
+ autoconf version is broken (it only puts the library name in the
+ cache variable name). Thanks to John Hawkinson.
+
+- Add a local autoconf macro to check for types; the autoconf version
+ is broken (it uses grep instead of actually compiling a code fragment).
+
+- Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
+ formats.
+
+- Extend OSF ip header workaround to versions 1 and 2.
+
+- Fix some signed problems in the nfs printer. As reported by David
+ Sacerdote (davids@silence.secnet.com)
+
+- Detect group wheel and use it as the default since BSD/OS' install
+ can't hack numeric groups. Reported by David Sacerdote.
+
+- AIX needs special loader options. Thanks to Jonathan I. Kamens
+ (jik@cam.ov.com)
+
+- Fixed the nfs printer to print port numbers in decimal. Thanks to
+ Kent Vander Velden (graphix@iastate.edu)
+
+- Find installed libpcap in /usr/local/lib when not using gcc.
+
+- Disallow network masks with non-network bits set.
+
+- Attempt to detect "egcs" versions of gcc.
+
+- Add missing closing double quotes when displaying bootp strings.
+ Reported by Viet-Trung Luu (vluu@picard.math.uwaterloo.ca)
+
+v3.3 Sat Nov 30 20:56:27 PST 1996
+
+- Added Linux support.
+
+- GRE encapsulated packet printer thanks to John Hawkinson
+ (jhawk@mit.edu)
+
+- Rewrite gmt2local() to avoid problematic os dependencies.
+
+- Suppress nfs truncation message on errors.
+
+- Add missing m4 quoting in AC_LBL_UNALIGNED_ACCESS autoconf macro.
+ Reported by Joachim Ott (ott@ardala.han.de)
+
+- Enable "ip_hl vs. ip_vhl" workaround for OSF4 too.
+
+- Print arp hardware type in host order. Thanks to Onno van der Linden
+ (onno@simplex.nl)
+
+- Avoid solaris compiler warnings. Thanks to Bruce Barnett
+ (barnett@grymoire.crd.ge.com)
+
+- Fix rip printer to not print one more route than is actually in the
+ packet. Thanks to Jean-Luc Richier (Jean-Luc.Richier@imag.fr) and
+ Bill Fenner (fenner@parc.xerox.com)
+
+- Use autoconf endian detection since BYTE_ORDER isn't defined on all systems.
+
+- Fix dvmrp printer truncation checks and add a dvmrp probe printer.
+ Thanks to Danny J. Mitzel (mitzel@ipsilon.com)
+
+- Rewrite ospf printer to improve truncation checks.
+
+- Don't parse tcp options past the EOL. As noted by David Sacerdote
+ (davids@secnet.com). Also, check tcp options to make sure they ar
+ actually in the tcp header (in addition to the normal truncation
+ checks). Fix the SACK code to print the N blocks (instead of the
+ first block N times).
+
+- Don't say really small UDP packets are truncated just because they
+ aren't big enough to be a RPC. As noted by David Sacerdote.
+
+v3.2.1 Sun Jul 14 03:02:26 PDT 1996
+
+- Added rfc1716 icmp codes as suggested by Martin Fredriksson
+ (martin@msp.se)
+
+- Print mtu for icmp unreach need frag packets. Thanks to John
+ Hawkinson (jhawk@mit.edu)
+
+- Decode icmp router discovery messages. Thanks to Jeffrey Honig
+ (jch@bsdi.com)
+
+- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
+ (kushida@trl.ibm.co.jp)
+
+- Check igmp checksum if possible. Thanks to John Hawkinson.
+
+- Made changes for SINIX. Thanks to Andrej Borsenkow
+ (borsenkow.msk@sni.de)
+
+- Use autoconf's idea of the top level directory in install targets.
+ Thanks to John Hawkinson.
+
+- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
+ Mogul (mogul@pa.dec.com)
+
+- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
+ Thanks to John Hawkinson.
+
+- Added some more packet truncation checks.
+
+- On systems that have it, use sigset() instead of signal() since
+ signal() has different semantics on these systems.
+
+- Fixed some more alignment problems on the alpha.
+
+- Add code to massage unprintable characters in the domain and ipx
+ printers. Thanks to John Hawkinson.
+
+- Added explicit netmask support. Thanks to Steve Nuchia
+ (steve@research.oknet.com)
+
+- Add "sca" keyword (for DEC cluster services) as suggested by Terry
+ Kennedy (terry@spcvxa.spc.edu)
+
+- Add "atalk" keyword as suggested by John Hawkinson.
+
+- Added an igrp printer. Thanks to Francis Dupont
+ (francis.dupont@inria.fr)
+
+- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
+ Kennedy (terry@spcvxa.spc.edu)
+
+- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
+ (pascal.hennequin@hugo.int-evry.fr)
+
+- Added some ETHERTYPEs missing on some systems.
+
+- Added truncated packet macros and various checks.
+
+- Fixed endian problems with the DECnet printer.
+
+- Use $CC when checking gcc version. Thanks to Carl Lindberg
+ (carl_lindberg@blacksmith.com)
+
+- Fixes for AIX (although this system is not yet supported). Thanks to
+ John Hawkinson.
+
+- Fix bugs in the autoconf misaligned accesses code fragment.
+
+- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
+ Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
+
+v3.2 Sun Jun 23 02:28:10 PDT 1996
+
+- Print new icmp unreachable codes as suggested by Martin Fredriksson
+ (martin@msp.se). Also print code value when unknown for icmp redirect
+ and time exceeded.
+
+- Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
+
+- Define "new" domain record types if not found in arpa/nameserv.h.
+ Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
+ fixed an endian bug when printing mx record and added some new record
+ types.
+
+- Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
+
+- Added T/TCP options printing. As suggested by Richard Stevens
+ (rstevens@noao.edu)
+
+- Use autoconf to detect architectures that can't handle misaligned
+ accesses.
+
+v3.1 Thu Jun 13 20:59:32 PDT 1996
+
+- Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
+ and bind (as suggested by Charles Hannum).
+
+- Port to GNU autoconf.
+
+- Add support for printing DVMRP and PIM traffic thanks to
+ Havard Eidnes (Havard.Eidnes@runit.sintef.no).
+
+- Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
+ define being referenced. Reported by Terry Kennedy.
+
+- Minor fixes to the man page thanks to Mark Andrews.
+
+- Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
+ (bmah@cs.berkeley.edu).
+
+- Added support for new dns types, thanks to Rainer Orth.
+
+- Fixed tftp_print() to print the block number for ACKs.
+
+- Document -dd and -ddd. Resulted from a bug report from Charlie Slater
+ (cslater@imatek.com).
+
+- Check return status from malloc/calloc/etc.
+
+- Check return status from pcap_loop() so we can print an error and
+ exit with a bad status if there were problems.
+
+- Bail if ip option length is <= 0. Resulted from a bug report from
+ Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
+
+- Print out a little more information for sun rpc packets.
+
+- Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
+
+- Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
+ wrong on little endian machines).
+
+- Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
+ (crawdad@fnal.gov).
+
+- Fix ntp_print() to not print garbage when the stratum is
+ "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
+
+- Rewrote tcp options printer code to check for truncation. Added
+ selective acknowledgment case.
+
+- Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
+ (jch@bsdi.com)
+
+- Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
+ octet for the sa_family member. Thanks to Yoshitaka Tokugawa
+ (toku@dit.co.jp)
+
+- Don't checksum ip header if we don't have all of it. Thanks to John
+ Hawkinson (jhawk@mit.edu).
+
+- Print out hostnames if possible in egp printer. Thanks to Jeffrey
+ Honig (jhc@bsdi.com)
+
+
+v3.1a1 Wed May 3 19:21:11 PDT 1995
+
+- Include time.h when SVR4 is defined to avoid problems under Solaris
+ 2.3.
+
+- Fix etheraddr_string() in the ETHER_SERVICE to return the saved
+ strings, not the local buffer. Thanks to Stefan Petri
+ (petri@ibr.cs.tu-bs.de).
+
+- Detect when pcap raises the snaplen (e.g. with snit). Print a warning
+ that the selected value was not used. Thanks to Pascal Hennequin
+ (Pascal.Hennequin@hugo.int-evry.fr).
+
+- Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
+
+- BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
+
+v3.0.3 Sun Oct 1 18:35:00 GMT 1995
+
+- Although there never was a 3.0.3 release, the linux boys cleverly
+ "released" one in late 1995.
+
+v3.0.2 Thu Apr 20 21:28:16 PDT 1995
+
+- Change configuration to not use gcc v2 flags with gcc v1.
+
+- Redo gmt2local() so that it works under BSDI (which seems to return
+ an empty timezone struct from gettimeofday()). Based on report from
+ Terry Kennedy (terry@spcvxa.spc.edu).
+
+- Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
+ on report from Mark Andrews (mandrews@alias.com).
+
+- Don't pass cc flags to gcc. Resulted from a bug report from Rainer
+ Orth (ro@techfak.uni-bielefeld.de).
+
+- Fixed printout of connection id for uncompressed tcp slip packets.
+ Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
+
+- Hack around deficiency in Ultrix's make.
+
+- Add ETHERTYPE_TRAIL define which is missing from irix5.
+
+v3.0.1 Wed Aug 31 22:42:26 PDT 1994
+
+- Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
+
+v3.0 Mon Jun 20 19:23:27 PDT 1994
+
+- Added support for printing tcp option timestamps thanks to
+ Mark Andrews (mandrews@alias.com).
+
+- Reorganize protocol dumpers to take const pointers to packets so they
+ never change the contents (i.e., they used to do endian conversions
+ in place). Previously, whenever more than one pass was taken over
+ the packet, the packet contents would be dumped incorrectly (i.e.,
+ the output form -x would be wrong on little endian machines because
+ the protocol dumpers would modify the data). Thanks to Charles Hannum
+ (mycroft@gnu.ai.mit.edu) for reporting this problem.
+
+- Added support for decnet protocol dumping thanks to Jeff Mogul
+ (mogul@pa.dec.com).
+
+- Fix bug that caused length of packet to be incorrectly printed
+ (off by ether header size) for unknown ethernet types thanks
+ to Greg Miller (gmiller@kayak.mitre.org).
+
+- Added support for IPX protocol dumping thanks to Brad Parker
+ (brad@fcr.com).
+
+- Added check to verify IP header checksum under -v thanks to
+ Brad Parker (brad@fcr.com).
+
+- Move packet capture code to new libpcap library (which is
+ packaged separately).
+
+- Prototype everything and assume an ansi compiler.
+
+- print-arp.c: Print hardware ethernet addresses if they're not
+ what we expect.
+
+- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
+ Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
+
+- print-fddi.c: Improvements. Thanks to Jeffrey Mogul
+ (mogul@pa.dec.com).
+
+- print-icmp.c: Byte swap netmask before printing. Thanks to
+ Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
+
+- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
+ By default, only the inner packet is dumped, appended with the token
+ "(encap)". Under -v, both the inner and output packets are dumped
+ (on the same line). Note that the filter applies to the original packet,
+ not the encapsulated packet. So if you run tcpdump on a net with an
+ IP Multicast tunnel, you cannot filter out the datagrams using the
+ conventional syntax. (You can filter away all the ip-in-ip traffic
+ with "not ip proto 4".)
+
+- print-nfs.c: Keep pending rpc's in circular table. Add generic
+ nfs header and remove os dependences. Thanks to Jeffrey Mogul.
+
+- print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
+
+- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
+ (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
+ Add && and || operators
+
+v2.2.1 Tue Jun 6 17:57:22 PDT 1992
+
+- Fix bug with -c flag.
+
+v2.2 Fri May 22 17:19:41 PDT 1992
+
+- savefile.c: Remove hack that shouldn't have been exported. Add
+ truncate checks.
+
+- Added the 'icmp' keyword. For example, 'icmp[0] != 8 and icmp[0] != 0'
+ matches non-echo/reply ICMP packets.
+
+- Many improvements to filter code optimizer.
+
+- Added 'multicast' keyword and extended the 'broadcast' keyword can now be
+ so that protocol qualifications are allowed. For example, "ip broadcast"
+ and "ether multicast" are valid filters.
+
+- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
+ Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
+ patches to netinet/if_loop.c.
+
+- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
+ Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
+
+- Added EGP and OSPF printers, thanks to Jeffrey Honig.
+
+v2.1 Tue Jan 28 11:00:14 PST 1992
+
+- Internal release (never publically exported).
+
+v2.0.1 Sun Jan 26 21:10:10 PDT
+
+- Various byte ordering fixes.
+
+- Add truncation checks.
+
+- inet.c: Support BSD style SIOCGIFCONF.
+
+- nametoaddr.c: Handle multi addresses for single host.
+
+- optimize.c: Rewritten.
+
+- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
+ for broadcast nets.
+
+- print-atal.c: Fix an alignment bug (thanks to
+ stanonik@nprdc.navy.mil) Add missing printf() argument.
+
+- print-bootp.c: First attempt at decoding the vendor buffer.
+
+- print-domain.c: Fix truncation checks.
+
+- print-icmp.c: Calculate length of packets from the ip header.
+
+- print-ip.c: Print frag id in decimal (so it's easier to match up
+ with non-frags). Add support for ospf, egp and igmp.
+
+- print-nfs.c: Lots of changes.
+
+- print-ntp.c: Make some verbose output depend on -v.
+
+- print-snmp.c: New version from John LoVerso.
+
+- print-tcp.c: Print rfc1072 tcp options.
+
+- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
+ (microseconds) worth of precision. Fix uid bugs.
+
+- A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
+ With this option, you can create an architecture independent binary
+ trace file in real time, without the overhead of the packet printer.
+ At a later time, the packets can be filtered (again) and printed.
+
+- BSD is supported. You must have BPF in your kernel.
+ Since the filtering is now done in the kernel, fewer packets are
+ dropped. In fact, with BPF and the packet dumper option, a measly
+ Sun 3/50 can keep up with a busy network.
+
+- Compressed SLIP packets can now be dumped, provided you use our
+ SLIP software and BPF. These packets are dumped as any other IP
+ packet; the compressed headers are dumped with the '-e' option.
+
+- Machines with little-endian byte ordering are supported (thanks to
+ Jeff Mogul).
+
+- Ultrix 4.0 is supported (also thanks to Jeff Mogul).
+
+- IBM RT and Stanford Enetfilter support has been added by
+ Rayan Zachariassen <rayan@canet.ca>. Tcpdump has been tested under
+ both the vanilla Enetfilter interface, and the extended interface
+ (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
+
+- TFTP packets are now printed (requests only).
+
+- BOOTP packets are now printed.
+
+- SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
+
+- Sparc architectures, including the Sparcstation-1, are now
+ supported thanks to Steve McCanne and Craig Leres.
+
+- SunOS 4 is now supported thanks to Micky Liu of Columbia
+ University (micky@cunixc.cc.columbia.edu).
+
+- IP options are now printed.
+
+- RIP packets are now printed.
+
+- There's a -v flag that prints out more information than the
+ default (e.g., it will enable printing of IP ttl, tos and id)
+ and -q flag that prints out less (e.g., it will disable
+ interpretation of AppleTalk-in-UDP).
+
+- The grammar has undergone substantial changes (if you have an
+ earlier version of tcpdump, you should re-read the manual
+ entry).
+
+ The most useful change is the addition of an expression
+ syntax that lets you filter on arbitrary fields or values in the
+ packet. E.g., "ip[0] > 0x45" would print only packets with IP
+ options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
+ packets.
+
+ The most painful change is that concatenation no longer means
+ "and" -- e.g., you have to say "host foo and port bar" instead
+ of "host foo port bar". The up side to this down is that
+ repeated qualifiers can be omitted, making most filter
+ expressions shorter. E.g., you can now say "ip host foo and
+ (bar or baz)" to look at ip traffic between hosts foo and bar or
+ between hosts foo and baz. [The old way of saying this was "ip
+ host foo and (ip host bar or ip host baz)".]
+
+v2.0 Sun Jan 13 12:20:40 PST 1991
+
+- Initial public release.