1Tuesday, December 30, 2025 / The Tcpdump Group 2 Summary for 1.10.6 libpcap release 3 General: 4 Fix "tcpdump -i <n>" for something-only libpcap builds. 5 gencode: Fix an undefined behavior in gen_mcode(). 6 gencode: Add a missing free() in gen_scode(). 7 Remove "DLT_" from the descriptions of two dlt_choices[] entries. 8 Report the size of time_t in the version string. 9 Validate remote capture source strings better. 10 CVE-2025-11961: Fix OOBR and OOBW in pcap_ether_aton(). 11 Source code: 12 Remove some unneeded includes. 13 pcapint_find_function() changed to return "void *" to avoid 14 warnings. 15 Clean up code that computes the length of a netmask. 16 Mind netmap support in pcap_lib_version(). 17 Link-layer types: 18 Add LINKTYPE_ETW/DLT_ETW. 19 Add LINKTYPE_NETANALYZER_NG/DLT_NETANALYZER_NG (pull request 20 #1008). 21 Add LINKTYPE_ZBOSS_NCP/DLT_ZBOSS_NCP. 22 Add LINKTYPE_USB_2_0_LOW_SPEED/DLT_USB_2_0_LOW_SPEED, 23 LINKTYPE_USB_2_0_FULL_SPEED/DLT_USB_2_0_FULL_SPEED, 24 LINKTYPE_USB_2_0_HIGH_SPEED/DLT_USB_2_0_HIGH_SPEED 25 Add LINKTYPE_AUERSWALD_LOG/DLT_AUERSWALD_LOG. 26 Add LINKTYPE_ZWAVE_TAP/DLT_ZWAVE_TAP. 27 Add LINKTYPE_SILABS_DEBUG_CHANNEL/DLT_SILABS_DEBUG_CHANNEL. 28 Add LINKTYPE_FIRA_UCI/DLT_FIRA_UCI. 29 Rename LINKTYPE_IPMB_LINUX/DLT_IPMB_LINUX to 30 LINKTYPE_I2C_LINUX/DLT_I2C_LINUX, as it's really just an 31 encapsulation of I2C, and is also being used for HDMI DDC. 32 Keep DLT_IPMB_LINUX around as a #define for backwards 33 compatibility. 34 Add LINKTYPE_MDB/DLT_MDB. 35 Add LINKTYPE_DECT_NR/DLT_DECT_NR. 36 Add LINKTYPE_EDK2_MM/DLT_EDK2_MM. 37 Add LINKTYPE_DEBUG_ONLY/DLT_DEBUG_ONLY. 38 Packet filtering: 39 Make the chunk allocator's alignment more general and 40 platform-independent. 41 IEEE 802.11: Fix three undefined behaviors in grammar.y. 42 Fix IPv4 multicast filtering to only include 224.0.0.0/4. 43 Fix "(arp|rarp) host NAME" to ignore IPv6 quietly. 44 Fix ARCnet address parsing. 45 Linux: 46 Fix check for mac80211 phydev. 47 Don't create monitor-mode interface if we're capturing on one. 48 Expand the table of DSA tag types to include all current types. 49 Fix an error message when deleting a monN interface. 50 Fix returning PCAP_ERROR_RFMON_NOTSUP with libnl. 51 Fix the error message when capure permission is denied. 52 Fix the error message if PF_PACKET sockets aren't supported. 53 Fix a file descriptor leak in an error case (pull request #1537). 54 Handle errors better when checking for a DSA-tagged interface. 55 Use DLT_DEBUG_ONLY for DSA tags that do not [yet] have a better support. 56 FreeBSD: 57 Fix detection and enabling of zero-copy support. 58 Fix errors in the zero-copy code. 59 Solaris: 60 Fix not to ignore logical interfaces in fad-gifc.c and 61 fad-glifc.c. 62 Fix attempts to open all-numeric device names with DLPI to 63 return "no such device". 64 Fix error returns and messages when an interface has no DLPI 65 device. 66 Return all interfaces in pcap_findalldevs() even if they can't be 67 opened. 68 HP-UX: 69 Fix attempts to open all-numeric device names to return 70 "no such device". 71 Fix error message if there's no /dev/dlpi device. 72 Return all interfaces in pcap_findalldevs() even if they can't be 73 opened. 74 Windows: 75 Fix filtering for VLAN-tagged frames. 76 Add support for Npcap's nanosecond-resolution time stamps in 77 captures. 78 CVE-2025-11964: Fix a bug in error message character encoding mapping 79 from UTF-16 to UTF-8. 80 Check at create time whether the NPF driver supports nanosecond 81 precision. 82 D-Bus: 83 Fix message leak. 84 Capture file writing: 85 Don't close the output stream if it's stdout, just flush it. 86 Documentation: 87 Explicitly document that closing a pcap_t for a savefile opened 88 with pcap_fopen_offline() will close the standard I/O stream. 89 Building and testing: 90 Makefile.in: Include instrument-functions.c in the release tarball. 91 CMake: Fix libnl usage with pkg-config. 92 CMake: Fix build with CMake 3.31. 93 CI: Report CMake version in builds. 94 CI: Visual Studio 2022 builds added, including ARM64 builds; 95 Visual Studio 2015 builds dropped. 96 Don't build with sslutils.c if we don't have a TLS library. 97 Build on Windows with a newer version of OpenSSL. 98 CMake: generalize handling of non-x86 Windows architectures. 99 CI: use the -A flag for all Visual Studio generators. 100 Remove the fuzzing props from the release tarball. 101 Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the 102 environment variable BUILD_YEAR2038 = yes (via autogen.sh) 103 DPDK: don't enable it by default. 104 Update Npcap SDK to 1.15. 105 autogen.sh: Allow to configure Autoconf warnings. 106 autogen.sh: Delete all trailing blank lines at end of configure. 107 108Friday, August 30, 2024 / The Tcpdump Group 109 Summary for 1.10.5 libpcap release 110 Source code: 111 Spell WirelessHART details properly. 112 Mark pcap_vasprintf() as printf-like. 113 Finalize moving of bpf_filter.c. (GH #1166) 114 Remove an unneeded argument from gen_mcode6(). 115 Don't do some Berkeley YACC workarounds with YACC releases not 116 requiring them. 117 Use correct data types rather than int in some cases. 118 Squelch compiler warning in grammar.c. 119 Fix findalldevtest compilation if IPv6 isn't enabled. 120 Rename helper routines for pcap modules to have names beginning with 121 pcapint_, to avoid namespace collisions for code linking statically 122 with libpcap. 123 Avoid casting hack for the Windows cleanup-on-exit routine. 124 Use %zu format for one case of printing a size_t. 125 Fix some Coverity errors. 126 Fix availabilities of some functions to match reality. 127 pcap: make the seconds and microseconds/nanoseconds fields unsigned. 128 Remove the unused pcap-rpcap-int.h header file. 129 Thread safety: 130 Make some static variables thread-local; fixes issue #1174. 131 Packet filtering: 132 Improve reporting of some invalid filter expressions. 133 Return an error from pcap_compile() if the scanner fails to initialize. 134 Optimizer fix from Archit Shah to recompute dominators after 135 moving code (#976); fixes #945 (although the resulting filter 136 isn't empty). 137 Optimizer fix from Archit Shah to mark value as unknown when store 138 of that value is deleted (#972); fixes #143, #434, #436, #437, 139 and #1076. 140 Linux: 141 Properly return warnings. 142 Don't use DLT_LINUX_SLL2 for anything other than the "any" device. 143 Avoid 32-bit unsigned integer overflow in USB captures. Fixes 144 issues #1134 and #1205. 145 Fix a file descriptor leak. 146 Properly report warnings about unknown ARPHRD_ types. 147 Fix DLT_CAN_SOCKETCAN handling of CAN FD. 148 Add CAN XL support to DLT_CAN_SOCKETCAN. 149 Clean up the code that sets the "real" ("original") length for 150 isochronous USB transfers. 151 Avoid unnecessary blocking on recvmsg() in the Bluetooth monitor and 152 Bluetoth modules. 153 Solaris: 154 Handle BPF returning ESRCH for unknown devices. 155 List the "any" device if it's supported. 156 Report {non-existent zone}/{interface} errors appropriately. 157 Allow attaching to links owned by a non-global zone. (Based on 158 pull request #1202.) 159 Fix AF_LINK handling on illumos. 160 macOS: 161 Redid the availability macros to be closer to what Apple's doing 162 in recent SDKs, including tagging pcap-namedb.h routines. 163 Fix the install name of the installed shared library to have a 164 full path when building with CMake. 165 Fix universal builds. 166 Haiku: 167 Convert the module to C. Fixes issue #1114. 168 Address a few compiler warnings. Fixes issue #1114. 169 Fix various build problems. Fixes issue #1114. 170 Report non-existent devices correctly. 171 Fix handling of packet statistics. 172 Fix packet timestamping. 173 Fix packet filtering with low snaplen. 174 Improve connection status reporting. 175 Add support for promiscuous mode. 176 Detect DLTs and loopback capture support at run time. 177 Report IEEE 802.11 as PCAP_IF_WIRELESS. 178 Windows: 179 Fix internal handling of "not supported" error codes from NPF. 180 Work around a bug in Npcap 1.00 in case of driver version mismatch. 181 Don't call WSACleanup() when handling a failed WSAStartup(). 182 BSD, macOS, AIX, Solaris 11, Linux: 183 Add a new error PCAP_ERROR_CAPTURE_NOTSUP, for use if a capture 184 mechanism is not present, in the hopes that, for example, 185 attempts to capture on Windows Services for Linux 1, in which 186 the NT kernel attempts to simulate Linux system calls but does 187 not support packet sockets, can get an error that better 188 indicates the underlying problem. 189 AirPcap: 190 Format an error message if we run out of memory. 191 nflog: 192 Fix count of dropped packets. 193 Make sure we don't overflow when rounding up the TLV length. 194 rpcap: 195 Handle routines removed in at least some OpenSSL libraries. 196 CVE-2023-7256: Clean up sock_initaddress() and its callers to avoid 197 double frees in some cases. 198 Don't define SOCKET ourselves; instead, define PCAP_SOCKET as int 199 on UN*Xes and as SOCKET on Windows. 200 CVE-2024-8006: Fix pcap_findalldevs_ex() not to crash if passed a 201 file:// URL with a path to a directory that cannot be opened. 202 Savefiles: 203 Handle DLT_/LINKTYPE_ mapping better, to handle some 204 OpenBSD-specific link types better. 205 Treat if_tsoffset as signed in pcapng files, as the spec says. 206 Don't try to fix the "real" length for isochronous USB 207 transfers if the number of USB descriptors is too large. 208 Reject pcap files where one of the reserved fields in the 209 "link-layer type plus other stuff" is non-zero. 210 Building and testing: 211 Add a configure option to help debugging (--enable-instrument-functions). 212 Improved tests and error reporting for uses of pkg-config, and 213 improve help message. 214 Fix Haiku build. 215 With CMake, install headers in CMAKE_INSTALL_INCLUDEDIR rather 216 than just include. 217 Build libpcap.a before building test programs. 218 Print address family numerically, as well as symbolically, 219 in findalldevstest. 220 Fail with suggestions, rather than failing over to no capture 221 support, if no capture mechanism was found. Fixes issue #1016. 222 Don't indent comments in Make, as that may cause them not to be 223 recognized as comments. 224 Don't check for libssl if we aren't going to use it. 225 Better handle enabling and disabling of sanitizers. Fixes issue 226 #1171. 227 CMakeLists.txt: Print "Symlinking: /some/path to ..." conditionally. 228 Evaluate CMAKE_INSTALL_PREFIX at install time. 229 cmake: Update the minimum required version to 2.8.12 (except Windows). 230 cmake: suppress CMP0042 OLD deprecated warning. 231 Makefile.in: Add the releasecheck target. 232 Cirrus CI: Add the "make releasecheck" command in the Linux task. 233 Makefile.in: Add the whitespacecheck target. 234 Cirrus CI: Run the "make whitespacecheck" command in the Linux task. 235 Autoconf: Update config.{guess,sub}, timestamps 2024-01-01. 236 Autoconf: Update the install-sh script to the 2020-11-14.01 version. 237 Compile with '-Wnull-pointer-subtraction', 238 '-Wunused-but-set-parameter', and '-Wunused-but-set-variable' in 239 devel mode if supported. 240 Don't ignore spaces between CMAKE_C_FLAGS and DPDK_C_FLAGS with 241 CMake. 242 Use noreturn and __format__ with XL C 7.0 and later. 243 Check for the same -W flags in autotools and CMake. 244 Autoconf: Add autogen.sh, remove configure and config.h.in and put 245 these generated files in the release tarball. 246 Autoconf: Get the size of a time_t. 247 Fix propagation of cc_werr_cflags() output. 248 Makefile.in(s): Fix the depend target. 249 mkdep: Exit with a non-zero status if a command fails. 250 Fix HCI_CHANNEL_MONITOR detection with musl libc. 251 Extend "make shellcheck" onto mkdep too. 252 Add initial support for building with TinyCC. 253 Address all known compiler warnings specific to illumos, Linux, NetBSD, 254 Solaris and Sun C; in CI expect warnings specific to TinyCC only. 255 Documentation: 256 Update and fix pcap-filter man page. 257 Add a README.haiku.md file. 258 Document pcap-config better. 259 Man page formatting and prose fixes. 260 Rename doc/README.Win32.md to doc/README.windows.md. 261 Update pcap-savefile man page to match the Internet-Draft for 262 pcap. 263 Fix CMake issues for target used by other projects. 264 Explain "any" device better in pcap_open_live(3PCAP). 265 Update INSTALL.md. 266 Note in man pages that errbuf arguments must point to an error 267 buffer. 268 Note that if pcap_findalldevs() fails it sets *alldevsp to NULL; 269 there's no devices list to free. 270 Explain "other addresses" in pcap_findalldevs(3PCAP). 271 Document pcap_lookupnet(3PCAP) a bit better. 272 273Friday, April 7, 2023 / The Tcpdump Group 274 Summary for 1.10.4 libpcap release 275 Source code: 276 Fix spaces before tabs in indentation. 277 rpcap: 278 Fix name of launchd service. 279 Documentation: 280 Document use of rpcapd with systemd, launchd, inetd, and xinetd. 281 Building and testing: 282 Require at least pkg-config 0.17.0, as we use --static. 283 Get rid of the remains of gnuc.h. 284 Require at least autoconf 2.69. 285 Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21. 286 287Thursday, January 12, 2023 / The Tcpdump Group 288 Summary for 1.10.3 libpcap release 289 Source code: 290 Sort the PUBHDR variable in Makefile.in in "ls" order. 291 Fix typo in comment in pflog.h. 292 Remove two no-longer-present files from .gitignore. 293 Update code and comments for handling failure to set promiscuous 294 mode based on new information. 295 Building and testing: 296 install: Fixed not to install the non-public pcap-util.h header. 297 pcap-config: add a --version flag. 298 Makefile.in: Add some missing files in the distclean target. 299 300Saturday, December 31, 2022 / The Tcpdump Group 301 Summary for 1.10.2 libpcap release 302 Source code: 303 Use __builtin_unreachable() in PCAP_UNREACHABLE. 304 Use AS_HELP_STRING macro instead of AC_HELP_STRING in the 305 configure scripts, to avoid deprecation warnings. 306 Change availability tags in pcap.h to make it easier to 307 arrange for it to be used in Darwin releases. 308 Use AS_HELP_STRING for --enable-remote. 309 Fix some formatting string issues found by cppcheck. 310 Various small code and comment cleanups. 311 Use PCAP_ERROR (defined as -1) rather than explicit -1 for 312 functions the documentation says return PCAP_ERROR. 313 Remove unused code from the filter compiler. 314 Use _declspec(deprecated(msg)) rather than __pragma(deprecated) 315 for Windows deprecation warnings, so the message that was 316 specified shows up. 317 diag-control.h: define PCAP_DO_PRAGMA() iff we're going to use it. 318 Use "%d" to print some signed ints. 319 Use the Wayback Machine for a removed document in a comment. 320 Add some const qualifiers. 321 RDMA: Use PRIu64 to print a uint64_t. 322 "Dead" pcap_ts from pcap_open_dead() and ..._with_tstamp_precision(): 323 Don't crash if pcap_breakloop() is called. 324 Savefiles: 325 Fix pcap_dispatch() to return number of packets processed, rather 326 than 0, even at EOF. 327 If we get an error writing the packet header, don't write the 328 packet data. 329 Put PFLOG UID and PID values in the header into host byte order 330 when reading a LINKTYPE_PFLOG file. 331 Put CAN ID field in CAN pseudo-headers for LINUX_SLL2, as we do 332 for LINUX_SLL. 333 Fix incorrectly-computed "real" length for isochronous USB 334 transfers when reading savefiles. 335 Don't crash if pcap_can_set_rfmon() is called. 336 Fix pcap_offline_read() loop. 337 Capture: 338 Never process more than INT_MAX packets in a pcap_dispatch() call, 339 to avoid integer overflow (issue #1087). 340 Improve error messages for "no such device" and "permission 341 denied" errors. 342 SITA: Fix a typo in a variable name. 343 Packet filtering: 344 Get PFLOG header length from the length value in the header. 345 Support all the direction, reason, and action types supported by 346 all systems that support PFLOG. 347 Don't require PFLOG support on the target machine in order to 348 support PFLOG filtering (also fixes issue #1076). 349 Expand abbreviations into "proto X" properly. 350 gencode.c: Update a comment about the VLAN TPID test. 351 Add the minimum and maximum matching DLTs to an error message. 352 Linux: 353 Fix memory leak in capture device open (pull request #1038). 354 Fix detection of CAN/CAN FD packets in direction check (issue 355 #1051). 356 Fix double-free crashes on errors such as running on a kernel with 357 CONFIG_PACKET_MMAP not configured (issue #1054). 358 Use DLT_CAN_SOCKETCAN for CANbus interfaces (issue #1052; includes 359 changes from pull request #1035). 360 Make sure the CANFD_FDF can be relied on to indicate whether a 361 CANbus packet is a CAN frame or a CAN FD frame 362 Improve error message for "out of memory" errors for kernel 363 filters (see issue #1089). 364 Fix pcap_findalldevs() to find usbmon devices. 365 Fix handling of VLAN tagged packets if the link-layer type is 366 changed from DLT_LINUX_SLL to DLT_LINUX_SLL2 (see issue #1105). 367 Always turn on PACKET_AUXDATA (see issue #1105). 368 We require 2.6.27 or later, so PACKET_RESERVE is available. 369 Make sure there's reserved space for a DLT_LINUX_SLL2 header 370 when capturing. 371 Correctly compute the "real" length for isochronous USB transfers. 372 Don't have an eventfd descriptor open in non-blocking mode, so as 373 not to waste descriptors. 374 netfilter: Squelch a narrowing warning (To be look at before 2038). 375 BPF capture (*BSD, macOS, AIX, Solaris 11): 376 Fix case where a device open might fail, rather than falling back 377 to a smaller buffer size, when the initial buffer size is too 378 big. 379 Use an unsigned device number to iterate over BPF devices, to 380 squelch a compiler warning. 381 NetBSD: 382 Fix handling of LINKTYPE_HDLC/DLT_HDLC. 383 rpcap: 384 Fix unaligned accesses in rpcapd (pull request #1037). 385 Fix code to process port number. 386 Clean up findalldevs code in rpcapd. 387 Clean up bufferizing code. 388 Fix a file descriptor/handle leak in pcap_findalldevs_ex() 389 (Coverity CID 1507240). 390 Improve error messages for host and port resolution errors. 391 Fix connect code not to fail if both IPv4 and IPv6 addresses are 392 tried. 393 Improve connect failure error message. 394 Provide an error message for a bad authentication reply size. 395 For link-layer types with host-endian fields in the header, fix 396 those fields if capturing from a server with a different byte 397 order. 398 Suppress temporarily the warnings with "enable remote packet capture". 399 Windows: 400 Add support for NdisMediumIP (pull request #1027). 401 Don't require applications using pcap to be built with VS 2015 or 402 later. 403 Use the correct string for the DLL VersionInfo. 404 Remove unnecessary DllMain() function. 405 Correctly handle ERROR_INVALID_FUNCTION from 406 PacketGetTimestampModes() (indicate that WinPcap or an older 407 version of Npcap is probably installed). 408 Fix use-after-free in some cases when a pcap_t is closed. 409 Make sure an error is returned by pcap_create_interface() if 410 PacketOpenAdapter() fails. 411 Return an error if the driver reports 0 timestamp modes supported. 412 Close the ADAPTER handle for some errors in 413 pcap_create_interface(). 414 Get rid of old unmaintained VS project files. 415 Fix deprecation warning for pcap_handle(). 416 Npcap is now at npcap.com, not npcap.org. 417 Make sure "no such device" and "no permission to open device" 418 errors show up in pcap_activate(), not pcap_create() (fixes, 419 among other things, tcpdump -i <interface-number>). 420 npcap: squelch deprecation warnings for kernel dump mode. 421 Haiku: 422 Implement pcap_lib_version(), as now required. 423 Handle negative or too-large snaplen values. 424 Fix various build issues and warnings. 425 Building and testing: 426 Update configure-time universal build checks for macOS. 427 Update config.guess and config.sub. 428 If we look for an SSL library with pkg-config in configure script, 429 try pkg-config first. 430 If we have pkg-config and Homebrew, try to set pkg-config up to 431 find Homebrew packages. 432 Handle some Autoconf/make errors better. 433 Use "git archive" for the "make releasetar" process. 434 Remove the release candidate rcX targets. 435 Fix compiling on Solaris 9/SPARC and 11/AMD64. 436 Address assorted compiler warnings. 437 Fix cross-building on Linux for Windows with mingw32 for Win64 438 (pull request #1031). 439 Properly set installation directory on Windows when not compiling 440 with MSVC. 441 Fix configure script checks for compiler flags. 442 Give more details if check for usable (F)Lex fails. 443 Fix compiling with GCC 4.6.4. 444 Don't use add_compile_options() with CMake, as we currently don't 445 require 2.8.12, where it first appeared. 446 Don't provide -L/usr/lib for pkg-config --libs in pkg-config. 447 Fix error message for inadequate Bison/Berkeley YACC. 448 configure: correctly do some DPDK checks. 449 Only use pkg-config when checking for DPDK. 450 Allow the path in which DPDK is installed to be specified. 451 Use pkg-config first when checking for libibverbs. 452 CMake: fix check for libibverbs with Sun's C compiler. 453 Have CMake warn if no capture mechanism can be found. 454 Don't do stuff requiring 3.19 or later on earlier CMakes. 455 Squelch some CMake warnings. 456 Fix diag-control.h to handle compiling with clang-cl (issues 457 #1101 and #1115). 458 Cleanup various leftover cruft in the configure script. 459 Fix building without protochain support. (GH #852) 460 Check for a usable YACC (or Bison) and {F}lex in CMake, as we do 461 in autotools. 462 Only check for a C++ compiler on Haiku, as that's the only 463 platform with C++ code, and make sure they generate code for 464 the same instruction set bit-width (both 32-bit or both 64-bit) 465 (issue #1112). 466 On Solaris, check the target bit-width and set PKG_CONFIG_PATH 467 appropriately, to handle the mess that is the D-Bus library 468 package (issue #1112). 469 Fix generation of pcap-config and libpcap.pc files (issue #1062). 470 pcap-config: don't assume the system library directory is /usr/lib. 471 pcap-config: add a --static-pcap-only flag. 472 Cirrus CI: Use the same configuration as for the main branch. 473 Add four libpcap test files. 474 Update Npcap SDK to 1.13. 475 Makefile.in: Use TEST_DIST, like for tcpdump. 476 Remove awk code from mkdep. 477 Cirrus CI: Add the libssl-dev package in the Linux task. 478 Cirrus CI: Add the openssl@3 brew package in the macOS task. 479 Get "make shellcheck" to pass again. 480 CMake: Build valgrindtest only if Autoconf would. 481 CMake: use ${CMAKE_INSTALL_SBINDIR} rather than just sbin. 482 CMake: use NUL: as the null device on Windows. 483 autoconf: fix typo in test of macOS version. 484 Makefile.in: Add two missing files in EXTRA_DIST. 485 autotools, cmake: provide an rpath option if necessary. 486 configure: get rid of the attempt to auto-run PKG_PROG_PKG_CONFIG. 487 configure: use PKG_CHECK_MODULES to run pkg-config. 488 Documentation: 489 Add README.solaris.md. 490 Add SCTP to pcap-filter(7). 491 Note that = and == are the same operator in filters (issue #1044). 492 Update INSTALL.md, README.md, and README.solaris.md. 493 Update and clean up CONTRIBUTING.md. 494 Trim documentation of support for now-dead UN*Xe and older 495 versions of other UN*Xes. 496 Move the "how to allocate a LINKTYPE_/DLT_ value" documentation to 497 the web site. 498 Clean up man pages. 499 Move README.capture-module to the web site. 500 Improve some protocol details in pcap-filter(7). 501 Refine "relop" notes in pcap-filter(7). 502 In pcap-filter(7) "domain" is an id. 503 Discuss backward compatibility in pcap-filter(7). 504 Other improvements to pcap-filter(7). 505 Document pcap_breakloop(3PCAP) interaction with threads better. 506 Document PCAP_ERROR_NOT_ACTIVATED for more routines. 507 508Wednesday, June 9, 2021: 509 Summary for 1.10.1 libpcap release: 510 Packet filtering: 511 Fix "type XXX subtype YYY" giving a parse error 512 Source code: 513 Add PCAP_AVAILABLE_1_11. 514 Building and testing: 515 Rename struct bpf_aux_data to avoid NetBSD compile errors 516 Squelch some compiler warnings 517 Squelch some Bison warnings 518 Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR 519 Fix Bison detection for minor version 0. 520 Fix parallel build with FreeBSD make. 521 Get DLT_MATCHING_MAX right in gencode.c on NetBSD. 522 Define timeradd() and timersub() if necessary. 523 Fix Cygwin/MSYS target directories. 524 Fix symlinking with DESTDIR. 525 Fix generation of libpcap.pc with CMake when not building a shared 526 library. 527 Check for Arm64 as well as x86-64 when looking for packet.lib on 528 Windows. 529 Documentation: 530 Refine Markdown in README.md. 531 Improve the description of portrange in filters. 532 README.linux.md isn't Markdown, rename it just README.linux. 533 pcapng: 534 Support reading version 1.2, which some writers produce, and which 535 is the same as 1.0 (some new block types were added, but 536 that's not sufficient reason to bump the minor version number, 537 as code that understands those new block types can handle them 538 in a 1.0 file) 539 Linux: 540 Drop support for text-mode USB captures, as we require a 2.6.27 541 or later kernel (credit to Chaoyuan Peng for noting the 542 sscanf vulnerabilities in the text-mode code that got me to 543 realize that we didn't need this code any more) 544 Bluetooth: fix non-blocking mode. 545 Don't assume that all compilers used to build for Linux support 546 the __atomic builtins 547 Windows: 548 Add more information in "interface disappeared" error messages, in 549 the hopes of trying to figure out the cause. 550 Treat ERROR_DEVICE_REMOVED as "device was removed". 551 Indicate in the error message which "device was removed" error 552 occurred. 553 Report the Windows error status if PacketSendPacket() fails. 554 Use %lu for ULONGs in error message formats. 555 Don't treat the inability to find airpcap.dll as an error. 556 Ignore spurious error reports by Microsoft Surface mobile 557 telephony modem driver 558 rpcap: 559 Clean up error checking and error messages for server address 560 lookup. 561 562Tuesday, December 29, 2020 563 Summary for 1.10.0 libpcap release 564 Add support for capturing on DPDK devices 565 Label most APIs by the first release in which they're available 566 Fix some memory leaks, including in pcap_compile() 567 Add pcap_datalink_val_to_description_or_dlt() 568 Handle the pcap private data in a fashion that makes fewer 569 assumptions about memory layouts (might fix GitHub issue #940 570 on ARM) 571 Fix some thread safety issues 572 pcap_findalldevs(): don't sort interfaces by unit number 573 Always return a list of supported time-stamp types, even if only 574 host time stamps are supported 575 Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP 576 Report the DLT description in error messages 577 Add pcap_init() for first-time initialization and global option 578 setting; it's not required, but may be used 579 Remove (unused) SITA support 580 Capture file reading: 581 Correctly handle pcapng captures with more than one IDB with a 582 snapshot length greater than the supported maximum 583 Capture file writing: 584 Create the file in pcap_dump_open_append() if it doesn't exist 585 Packet filtering: 586 Fix "unknown ether proto 'aarp'" 587 Add a new filter "ifindex" for DLT_LINUX_SLL2 files on all 588 platforms and live Linux captures 589 Add a hack to the optimizer to try to catch certain optimizer 590 loops (should prevent GitHub issue #112) 591 Show special Linux BPF offsets symbolically in bpf_image() and 592 bpf_dump() 593 Added support for ICMPv6 types 1-4 as tokens with names 594 Remove undocumented and rather old "ether proto" protocols 595 Catch invalid IPv4 addresses in filters 596 Don't assume ARM supports unaligned accesses 597 Security and other issues found by analysis: 598 Fix various security issues reported by Charles Smith at Tangible 599 Security 600 Fix various security issues reported by Include Security 601 Fix some issues found by cppcheck. 602 Add some overflow checks in the optimizer 603 rpcap: 604 Support rpcap-over-TLS 605 Redo protocol version negotiation to avoid problems with old 606 servers (it still works with servers using the old negotiation, 607 as well as servers not supporting negotiation) 608 Error handling cleanups 609 Add some new authentication libpcap error codes for specific 610 errors 611 Fix some inetd issues in rpcapd 612 Fix rpcapd core dumps with invalid configuration file 613 On UN*X, don't have rpcapd tell the client why authentication 614 failed, so a brute-force attacker can't distinguish between 615 "unknown user name" and "known user name, wrong password" 616 Allow rpcapd to rebind more rapidly (GitHub issue #765) 617 Documentation: 618 Improve man pages, including adding backward compatibility notes 619 Building and testing: 620 Require, and assume, some level of C99 support in the C compiler 621 Require Visual Studio 2015 or later if using Visual Studio 622 Fix configure script issues, including with libnl on Linux 623 Fix CMake issues 624 Squelch complaints from Bison about "%define api.pure" being 625 deprecated 626 Fix compilation of pcap-tc.c 627 Linux: 628 Require PF_PACKET support, and kernel 2.6.27 or later 629 Handle systems without AF_INET or AF_UNIX socket support 630 Get rid of Wireless Extensions for turning monitor mode on 631 Proper memory sync for PACKET_MMAP (may prevent GitHub issue 632 #898) 633 Drop support for libnl 1 and 2. 634 Return error on interface going away, but not if it just went 635 down but is still present 636 Set socket protocol only after packet ring configured, 637 reducing bogus packet drop reports 638 Get ifdrop stats from sysfs. 639 When adjusting BPF programs, do not subtract the 640 SLL[2]_HDR_LEN if the location is negative (special metadata 641 offset), to preserve references to metadata; see 642 https://github.com/the-tcpdump-group/tcpdump/issues/480#issuecomment-486827278 643 Report a warning for unknown ARPHRD types 644 Have pcap_breakloop() forcibly break out of a sleeping 645 capture loop 646 Add support for DSA data link types 647 For raw USB bus capture, use the snapshot length to set the 648 buffer size, and set the len field to reflect the length 649 in the URB (GitHub issue #808) 650 With a timeout of zero, wait indefinitely 651 Clean up support for some non-GNU libc C libraries 652 Add DLT_LINUX_SLL2 for cooked-mode captures 653 Probe CONFIGURATION descriptor of connected USB devices 654 Treat EPERM on ethtool ioctls as meaning "not supported", as 655 permissions checks are done before checking whether the 656 ioctl is supported at all 657 macOS: 658 Cope with getting EPWROFF from SIOCGIFMEDIA 659 Treat EPERM on SIOCGIFMEDIA as meaning "not supported", as 660 permissions checks are done before checking whether the 661 ioctl is supported at all 662 Treat ENXIO when reading packets as meaning "the interface 663 was removed" 664 Report "the interface disappeared", not "the interface went 665 down", if the interface was removed during a capture 666 FreeBSD: 667 Treat ENXIO as meaning "the interface was removed" 668 Report "the interface disappeared", not "the interface went 669 down", if the interface was removed during a capture 670 NetBSD: 671 Treat ENXIO as meaning "the interface was removed" 672 Report "the interface disappeared", not "the interface went 673 down", if the interface was removed during a capture 674 OpenBSD: 675 Treat EIO as meaning "the interface was removed" 676 Report "the interface disappeared", not "the interface went 677 down", if the interface was removed during a capture 678 DragonFly BSD: 679 Treat ENXIO as meaning "the interface was removed" 680 Report "the interface disappeared", not "the interface went 681 down", if the interface was removed during a capture 682 Solaris: 683 Treat ENXIO as meaning "the interface was removed" 684 Report "the interface disappeared", not "the interface went 685 down", if the interface was removed during a capture 686 AIX: 687 Fix loading of BPF kernel extension 688 Treat ENXIO as meaning "the interface was removed" 689 Report "the interface disappeared", not "the interface went 690 down", if the interface was removed during a capture 691 Windows: 692 Make the snapshot length work even if pcap_setfilter() 693 isn't called 694 Fix compilation on Cygwin/MSYS 695 Add pcap_handle(), and deprecate pcap_fileno() 696 Report PCAP_ERROR_NO_SUCH_DEVICE for a nonexistent device 697 Return an appropriate error message for device removed or 698 device unusable due to a suspend/resume 699 Report a warning for unknown NdisMedium types 700 Have pcap_breakloop() forcibly break out of a sleeping 701 capture loop 702 Clean up building DLL 703 Handle CRT mismatch for pcap_dump_fopen() 704 Map NdisMediumWirelessWan to DLT_RAW 705 Add AirPcap support in a module, rather than using 706 WinPcap/Npcap's support for it 707 Report the system error for PacketSetHwFilter() failures 708 Add support for getting and setting packet time stamp types 709 with Npcap 710 Have pcap_init() allow selecting whether the API should use 711 local code page strings or UTF-8 strings (including error 712 messages) 713 Haiku: 714 Add capture support 715 716Sunday, July 22, 2018 717 Summary for 1.9.1 libpcap release 718 Mention pcap_get_required_select_timeout() in the main pcap man page 719 Fix pcap-usb-linux.c build on systems with musl 720 Fix assorted man page and other documentation issues 721 Plug assorted memory leaks 722 Documentation changes to use https: 723 Changes to how time stamp calculations are done 724 Lots of tweaks to make newer compilers happier and warning-free and 725 to fix instances of C undefined behavior 726 Warn if AC_PROG_CC_C99 can't enable C99 support 727 Rename pcap_set_protocol() to pcap_set_protocol_linux(). 728 Align pcap_t private data on an 8-byte boundary. 729 Fix various error messages 730 Use 64-bit clean API in dag_findalldevs() 731 Fix cleaning up after some errors 732 Work around some ethtool ioctl bugs in newer Linux kernels (GitHub 733 issue #689) 734 Add backwards compatibility sections to some man pages (GitHub issue 735 #745) 736 Fix autotool configuration on AIX and macOS 737 Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; 738 they're internal-only and subject to change 739 Fix pcapng block size checking 740 On macOS, don't build rpcapd or test programs any fatter than they 741 need to be 742 Fix reading of capture statistics for Linux USB 743 Fix packet size values for Linux USB packets (GitHub issue #808) 744 Check only VID in VLAN test in filters (GitHub issue #461) 745 Fix pcap_list_datalinks on 802.11 devices on macOS 746 Fix overflows with very large snapshot length in pcap file 747 Improve parsing of rpcapd configuration file (GitHub issue #767) 748 Handle systems without strlcpy() or strlcat() better 749 Fix crashes and other errors with invalid filter expressions 750 Fix use of uninitialized file descriptor in remote capture 751 Fix some CMake issues 752 Fix some divide-by-zero issues with the filter compiler 753 Work around a GNU libc bug in pcap_nametonetaddr() 754 Add support for DLT_LINUX_SLL2 755 Fix handling of the packet-count argument for Myricom SNF devices 756 Fix --disable-rdma in configure script (GitHub issue #782) 757 Fix compilation of TurboCap support (GitHub issue #764) 758 Constify first argument to pcap_findalldevs_ex() 759 Fix a number of issues when running rpcapd as an inetd-style daemon 760 Fix CMake issues with D-Bus libraries 761 In rpcapd, clean up termination of a capture session 762 Redo remote capture protocol negotiation 763 In rpcapd, report the same error for "invalid user name" and 764 "invalid password", to make brute-forcing harder 765 For remote captures, add an error code for "the server requires TLS" 766 Fix pcap_dump_fopen() on Windows to avoid clashes between 767 {Win,N}Pcap and application C runtimes 768 Fix exporting of functions from Windows DLLs (GitHub issue #810) 769 Fix building as part of Npcap 770 Allow rpcapd to rebind more rapidly 771 Fix building shared libpcap library on midipix (midipix.org) 772 Fix hack to detect UTF-16LE adapter names on Windows not to go past 773 the end of the string 774 Fix handling of "wireless WAN" (mobile phone network modems) on 775 Windows with WinPcap/Npcap (GitHub issue #824) 776 Have pcap_dump_open_append() create the dump file if it doesn't 777 exists (GitHub issue #247) 778 Fix the maximum snapshot length for DLT_USBPCAP 779 Use -fPIC when building for 64-bit SPARC on Linux (GitHub issue #837) 780 Fix CMake 64-bit library installation directory on some Linux 781 distributions 782 Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was 783 specified 784 Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 785 PCAPNG reader applies some sanity checks before doing malloc(). 786 787Sunday, June 24, 2018, by mcr@sandelman.ca 788 Summary for 1.9.0 libpcap release 789 Added testing system to libpcap, independent of tcpdump 790 Changes to how pcap_t is activated 791 Adding support for Large stream buffers on Endace DAG cards 792 Changes to BSD 3-clause license to 2-clause license 793 Additions to TCP header parsing, per RFC3168 794 Add CMake build process (extensive number of changes) 795 Assign a value for OpenBSD DLT_OPENFLOW. 796 Support setting non-blocking mode before activating. 797 Extensive build support for Windows VS2010 and MINGW (many many changes, over many months) 798 Added RPCAPD support when --enable-remote (default no) 799 Add the rpcap daemon source and build instructions. 800 Put back the greasy "save the capture filter string so we can tweak it" 801 hack, that keeps libpcap from capturing rpcap traffic. 802 Fixes for captures on MacOS, utun0 803 fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses. 804 Add a linktype for IBM SDLC frames containing SNA PDUs. 805 pcap_compile() in 1.8.0 and later is newly thread-safe. 806 bound snaplen for linux tpacket_v2 to ~64k 807 Make VLAN filter handle both metadata and inline tags 808 D-Bus captures can now be up to 128MB in size 809 Added LORATAP DLT value 810 Added DLT_VSOCK for https://qemu-project.org/Features/VirtioVsock 811 probe_devices() fixes not to overrun buffer for name of device 812 Add linux-specific pcap_set_protocol_linux() to allow specifying a specific capture protocol. 813 RDMA sniffing support for pcap 814 Add Nordic Semiconductor Bluetooth LE sniffer link-layer header type. 815 fixes for reading /etc/ethers 816 Make it possible to build on Windows without packet.dll. 817 Add tests for large file support on UN*X. 818 Solaris fixes to work with 2.8.6 819 configuration test now looks for header files, not capture devices present 820 Fix to work with Berkeley YACC. 821 fixes for DragonBSD compilation of pcap-netmap.c 822 Clean up the ether_hostton() stuff. 823 Add an option to disable Linux memory-mapped capture support. 824 Add DAG API support checks. 825 Add Septel, Myricom SNF, and Riverbed TurboCap checks. 826 Add checks for Linux USB, Linux Bluetooth, D-Bus, and RDMA sniffing support. 827 Add a check for hardware time stamping on Linux. 828 Don't bother supporting pre-2005 Visual Studio. 829 Increased minimum autoconf version requirement to 2.64 830 Add DLT value 273 for XRA-31 sniffer 831 Clean up handing of signal interrupts in pcap_read_nocb_remote(). 832 Use the XPG 4.2 versions of the networking APIs in Solaris. 833 Fix, and better explain, the "IPv6 means IPv6, not IPv4" option setting. 834 Explicitly warn that negative packet buffer timeouts should not be used. 835 rpcapd: Add support inetd-likes, including xinetd.conf, and systemd units 836 Rename DLT_IEEE802_15_4 to DLT_IEEE802_15_4_WITHFCS. 837 Add DISPLAYPORT AUX link type 838 Remove the sunos4 kernel modules and all references to them. 839 Add more interface flags to pcap_findalldevs(). 840 Summary for 1.9.0 libpcap release (to 2017-01-25 by guy@alum.mit.edu) 841 Man page improvements 842 Fix Linux cooked mode userspace filtering (GitHub pull request #429) 843 Fix compilation if IPv6 support not enabled 844 Fix some Linux memory-mapped capture buffer size issues 845 Don't fail if kernel filter can't be set on Linux (GitHub issue 846 #549) 847 Improve sorting of interfaces for pcap_findalldevs() 848 Don't list Linux usbmon devices if usbmon module isn't loaded 849 Report PCAP_ERROR_PERM_DENIED if no permission to open Linux usbmon 850 devices 851 Fix DLT_ type for Solaris IPNET devices 852 Always return an error message for errors finding DAG or Myricom 853 devices 854 If possible, don't require that a device be openable when 855 enumerating them for pcap_findalldevs() 856 Don't put incompletely-initialized addresses in the address list for 857 When finding Myricom devices, update description for regular 858 interfaces that are Myricom devices and handle SNF_FLAGS=0x2(port 859 aggregation enabled) 860 Fix compilation error in DAG support 861 Fix issues with CMake configuration 862 Add support for stream buffers larger than 2GB on newer DAG cards 863 Remove support for building against DAG versions without STREAMS 864 support (before dag-3.0.0 2007) 865 866Tuesday, Oct. 25, 2016 mcr@sandelman.ca 867 Summary for 1.8.1 libpcap release 868 Add a target in Makefile.in for Exuberant Ctags use: 'extags'. 869 Rename configure.in to configure.ac: autoconf 2.59 870 Clean up the name-to-DLT mapping table. 871 Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS 872 Clarify what the return values are for both success and failure. 873 Many changes to build on windows 874 Check for the "break the loop" condition in the inner loop for TPACKET_V3. 875 Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue #493. 876 Filter out duplicate looped back CAN frames. 877 Fix the handling of loopback filters for IPv6 packets. 878 Add a link-layer header type for RDS (IEC 62106) groups. 879 Use different intermediate folders for x86 and x64 builds on Windows. 880 On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. 881 Removes the need for the "host-endian" link-layer header type. 882 Compile with '-Wused-but-marked-unused' in devel mode if supported 883 Have separate DLTs for big-endian and host-endian SocketCAN headers. 884 Reflect version.h being renamed to pcap_version.h. 885 Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! 886 Properly check for sock_recv() errors. 887 Re-impose some of Winsock's limitations on sock_recv(). 888 Replace sprintf() with pcap_snprintf(). 889 Fix signature of pcap_stats_ex_remote(). 890 Initial cmake support for remote packet capture. 891 Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. 892 Clean up {DAG, Septel, Myricom SNF}-only builds. 893 Do UTF-16-to-ASCII conversion into the right place. 894 pcap_create_interface() needs the interface name on Linux. 895 Clean up hardware time stamp support: the "any" device does not support any time stamp types. 896 Add support for capturing on FreeBSD usbusN interfaces. 897 Add a LINKTYPE/DLT_ value for FreeBSD USB. 898 Go back to using PCAP_API on Windows. 899 CMake support 900 Add TurboCap support from WinPcap. 901 Recognize 802.1ad nested VLAN tag in vlan filter. 902 903Thursday Sep. 3, 2015 guy@alum.mit.edu 904 Summary for 1.7.5 libpcap release 905 Man page cleanups. 906 Add some allocation failure checks. 907 Fix a number of Linux/ucLinux configure/build issues. 908 Fix some memory leaks. 909 Recognize 802.1ad nested VLAN tag in vlan filter. 910 Fix building Bluetooth Linux Monitor support with BlueZ 5.1+ 911 912Saturday Jun. 27, 2015 mcr@sandelman.ca 913 Summary for 1.7.4 libpcap release 914 Include fix for GitHub issue #424 -- out of tree builds. 915 916Friday Apr. 10, 2015 guy@alum.mit.edu 917 Summary for 1.7.3 libpcap release 918 Work around a Linux bonding driver bug. 919 920Thursday Feb. 12, 2015 guy@alum.mit.edu/mcr@sandelman.ca 921 Summary for 1.7.2 libpcap release 922 Support for filtering Geneve encapsulated packets. 923 Generalize encapsulation handling, fixing some bugs. 924 Don't add null addresses to address lists. 925 Add pcap_dump_open_append() to open for appending. 926 Fix the swapping of isochronous descriptors in Linux USB. 927 Attempt to handle TPACKET_V1 with 32-bit userland and 64-bit kernel. 928 929Wednesday Nov. 12, 2014 guy@alum.mit.edu/mcr@sandelman.ca 930 Summary for 1.7.0 libpcap release 931 Fix handling of zones for BPF on Solaris 932 new DLT for ZWAVE 933 clarifications for read timeouts. 934 Use BPF extensions in compiled filters, fixing VLAN filters 935 some fixes to compilation without stdint.h 936 EBUSY can now be returned by SNFv3 code. 937 Fix the range checks in BPF loads 938 Various DAG fixes. 939 Various Linux fixes. 940 941Monday Aug. 12, 2014 guy@alum.mit.edu 942 Summary for 1.6.2 libpcap release 943 Don't crash on filters testing a nonexistent link-layer type 944 field. 945 Fix sending in non-blocking mode on Linux with memory-mapped 946 capture. 947 Fix timestamps when reading pcap-ng files on big-endian 948 machines. 949 950Saturday Jul. 19, 2014 mcr@sandelman.ca 951 Summary for 1.6.1 libpcap release 952 some fixes for the any device 953 changes for how --enable-XXX (--enable-sniffing, --enable-can) works 954 955Wednesday Jul. 2, 2014 mcr@sandelman.ca 956 Summary for 1.6.0 libpcap release 957 Don't support D-Bus sniffing on OS X 958 fixes for byte order issues with NFLOG captures 959 Handle using cooked mode for DLT_NETLINK in activate_new(). 960 on platforms where you can not capture on down interfaces, do not list them 961 but: do list interfaces which are down, if you can capture on them! 962 963Wednesday December 18, 2013 guy@alum.mit.edu 964Summary for 1.5.3 libpcap release 965 Don't let packets that don't match the current filter get to the 966 application when TPACKET_V3 is used. (GitHub issue #331) 967 Fix handling of pcap_loop()/pcap_dispatch() with a packet count 968 of 0 on some platforms (including Linux with TPACKET_V3). 969 (GitHub issue #333) 970 Work around TPACKET_V3 deficiency that causes packets to be lost 971 when a timeout of 0 is specified. (GitHub issue #335) 972 Man page formatting fixes. 973 974Wednesday December 4, 2013 guy@alum.mit.edu 975Summary for 1.5.2 libpcap release 976 Fix libpcap to work when compiled with TPACKET_V3 support and 977 running on a kernel without TPACKET_V3 support. (GitHub 978 issue #329) 979 980Wednesday November 20, 2013 guy@alum.mit.edu 981Summary for 1.5.1 libpcap release 982 Report an error, rather than crashing, if an IPv6 address is 983 used for link-layer filtering. (Wireshark bug 9376) 984 985Wednesday October 30, 2013 guy@alum.mit.edu 986Summary for 1.5.0 libpcap release 987 TPACKET_V3 support added for Linux 988 Point users to the the-tcpdump-group repository on GitHub rather 989 than the mcr repository 990 Checks added for malloc()/realloc()/etc. failures 991 Fixed build on Solaris 11 992 Support filtering E1 SS7 traffic on MTP2 layer Annex A 993 Use "ln -s" to link man pages by default 994 Add support for getting nanosecond-resolution time stamps when 995 capturing and reading capture files 996 Many changes to autoconf to deal better with non-GCC compilers 997 added many new DLT types 998 999Saturday April 6, 2013 guy@alum.mit.edu 1000Summary for 1.4.0 libpcap release 1001 Add netfilter/nfqueue interface. 1002 If we don't have support for IPv6 address resolution, support, 1003 in filter expressions, what IPv6 stuff we can. 1004 Fix pcap-config to include -lpthread if canusb support is 1005 present 1006 Try to fix "pcap_parse not defined" problems when --without-flex 1007 and --without-bison are used when you have Flex and Bison 1008 Fix some issues with the pcap_loop man page. 1009 Fix pcap_getnonblock() and pcap_setnonblock() to fill in the 1010 supplied error message buffer 1011 Fix typo that, it appeared, would cause pcap-libdlpi.c not to 1012 compile (perhaps systems with libdlpi also have BPF and use 1013 that instead) 1014 Catch attempts to call pcap_compile() on a non-activated pcap_t 1015 Fix crash on Linux with CAN-USB support without usbfs 1016 Fix addition of VLAN tags for Linux cooked captures 1017 Check for both EOPNOTSUPP and EINVAL after SIOCETHTOOL ioctl, so 1018 that the driver can report either one if it doesn't support 1019 SIOCETHTOOL 1020 Add DLT_INFINIBAND and DLT_SCTP 1021 Describe "proto XXX" and "protochain XXX" in the pcap-filter man 1022 page 1023 Handle either directories, or symlinks to directories, that 1024 correspond to interfaces in /sys/class/net 1025 Fix handling of VLAN tag insertion to check, on Linux 3.x 1026 kernels, for VLAN tag valid flag 1027 Clean up some man pages 1028 Support libnl3 as well as libnl1 and libnl2 on Linux 1029 Fix handling of Bluetooth devices on 3.x Linux kernels 1030 1031Friday March 30, 2012. mcr@sandelman.ca 1032Summary for 1.3.0 libpcap release 1033 Handle DLT_PFSYNC in {FreeBSD, other *BSD+Mac OS X, other}. 1034 Linux: Don't fail if netfilter isn't enabled in the kernel. 1035 Add new link-layer type for NFC Forum LLCP. 1036 Put the CANUSB stuff into EXTRA_DIST, so it shows up in the release tarball. 1037 Add LINKTYPE_NG40/DLT_NG40. 1038 Add DLT_MPEG_2_TS/LINKTYPE_MPEG_2_TS for MPEG-2 transport streams. 1039 [PATCH] Fix AIX-3.5 crash with read failure during stress 1040 AIX fixes. 1041 Introduce --disable-shared configure option. 1042 Added initial support for canusb devices. 1043 Include the pcap(3PCAP) additions as 1.2.1 changes. 1044 many updates to documentation: pcap.3pcap.in 1045 Improve 'inbound'/'outbound' capture filters under Linux. 1046 Note the cleanup of handling of new DLT_/LINKTYPE_ values. 1047 On Lion, don't build for PPC. 1048 For mac80211 devices we need to clean up monitor mode on exit. 1049 1050Friday December 9, 2011. guy@alum.mit.edu. 1051Summary for 1.2.1 libpcap release 1052 Update README file. 1053 Fix typos in README.linux file. 1054 Clean up some compiler warnings. 1055 Fix Linux compile problems and tests for ethtool.h. 1056 Treat Debian/kFreeBSD and GNU/Hurd as systems with GNU 1057 toolchains. 1058 Support 802.1 QinQ as a form of VLAN in filters. 1059 Treat "carp" as equivalent to "vrrp" in filters. 1060 Fix code generated for "ip6 protochain". 1061 Add some new link-layer header types. 1062 Support capturing NetFilter log messages on Linux. 1063 Clean up some error messages. 1064 Turn off monitor mode on exit for mac80211 interfaces on Linux. 1065 Fix problems turning monitor mode on for non-mac80211 interfaces 1066 on Linux. 1067 Properly fail if /sys/class/net or /proc/net/dev exist but can't 1068 be opened. 1069 Fail if pcap_activate() is called on an already-activated 1070 pcap_t, and add a test program for that. 1071 Fix filtering in pcap-ng files. 1072 Don't build for PowerPC on Mac OS X Lion. 1073 Simplify handling of new DLT_/LINKTYPE_ values. 1074 Expand pcap(3PCAP) man page. 1075 1076Sunday July 24, 2011. mcr@sandelman.ca. 1077Summary for 1.2 libpcap release 1078 All of the changes listed below for 1.1.1 and 1.1.2. 1079 Changes to error handling for pcap_findalldevs(). 1080 Fix the calculation of the frame size in memory-mapped captures. 1081 Add a link-layer header type for STANAG 5066 D_PDUs. 1082 Add a link-layer type for a variant of 3GPP TS 27.010. 1083 Noted real nature of LINKTYPE_ARCNET. 1084 Add a link-layer type for DVB-CI. 1085 Fix configure-script discovery of VLAN acceleration support. 1086 see https://netoptimizer.blogspot.com/2010/09/tcpdump-vs-vlan-tags.html 1087 Linux, HP-UX, AIX, NetBSD and OpenBSD compilation/conflict fixes. 1088 Protect against including AIX 5.x's <net/bpf.h> having been included. 1089 Add DLT_DBUS, for raw D-Bus messages. 1090 Treat either EPERM or EACCES as "no soup for you". 1091 Changes to permissions on DLPI systems. 1092 Add DLT_IEEE802_15_4_NOFCS for 802.15.4 interfaces. 1093 1094Fri. August 6, 2010. guy@alum.mit.edu. 1095Summary for 1.1.2 libpcap release 1096 Return DLT_ values, not raw LINKTYPE_ values from 1097 pcap_datalink() when reading pcap-ng files 1098 Add support for "wlan ra" and "wlan ta", to check the RA and TA 1099 of WLAN frames that have them 1100 Don't crash if "wlan addr{1,2,3,4}" are used without 802.11 1101 headers 1102 Do filtering on USB and Bluetooth capturing 1103 On FreeBSD/SPARC64, use -fPIC - it's apparently necessary 1104 Check for valid port numbers (fit in a 16-bit unsigned field) in 1105 "port" filters 1106 Reject attempts to put savefiles into non-blocking mode 1107 Check for "no such device" for the "get the media types" ioctl 1108 in *BSD 1109 Improve error messages from bpf_open(), and let it do the error 1110 handling 1111 Return more specific errors from pcap_can_set_rfmon(); fix 1112 documentation 1113 Update description fetching code for FreeBSD, fix code for 1114 OpenBSD 1115 Ignore /sys/net/dev files if we get ENODEV for them, not just 1116 ENXIO; fixes handling of bonding devices on Linux 1117 Fix check for a constant 0 argument to BPF_DIV 1118 Use the right version of ar when cross-building 1119 Free any filter set on a savefile when the savefile is closed 1120 Include the CFLAGS setting when configure was run in the 1121 compiler flags 1122 Add support for 802.15.4 interfaces on Linux 1123 1124Thu. April 1, 2010. guy@alum.mit.edu. 1125Summary for 1.1.1 libpcap release 1126 Update CHANGES to reflect more of the changes in 1.1.0. 1127 Fix build on RHEL5. 1128 Fix shared library build on AIX. 1129 1130Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu. 1131Summary for 1.1.0 libpcap release 1132 Add SocketCAN capture support 1133 Add Myricom SNF API support 1134 Update Endace DAG and ERF support 1135 Add support for shared libraries on Solaris, HP-UX, and AIX 1136 Build, install, and un-install shared libraries by default; 1137 don't build/install shared libraries on platforms we don't support 1138 Fix building from a directory other than the source directory 1139 Fix compiler warnings and builds on some platforms 1140 Update config.guess and config.sub 1141 Support monitor mode on mac80211 devices on Linux 1142 Fix USB memory-mapped capturing on Linux; it requires a new DLT_ 1143 value 1144 On Linux, scan /sys/class/net for devices if we have it; scan 1145 it, or /proc/net/dev if we don't have /sys/class/net, even if 1146 we have getifaddrs(), as it'll find interfaces with no 1147 addresses 1148 Add limited support for reading pcap-ng files 1149 Fix BPF driver-loading error handling on AIX 1150 Support getting the full-length interface description on FreeBSD 1151 In the lexical analyzer, free up any addrinfo structure we got back 1152 from getaddrinfo(). 1153 Add support for BPF and libdlpi in OpenSolaris (and SXCE) 1154 Hyphenate "link-layer" everywhere 1155 Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations 1156 In pcap_read_linux_mmap(), if there are no frames available, call 1157 poll() even if we're in non-blocking mode, so we pick up 1158 errors, and check for the errors in question. 1159 Note that poll() works on BPF devices is Snow Leopard 1160 If an ENXIO or ENETDOWN is received, it may mean the device has 1161 gone away. Deal with it. 1162 For BPF, raise the default capture buffer size to from 32k to 512k 1163 Support ps_ifdrop on Linux 1164 Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile 1165 under cygwin. 1166 Changes to Linux mmapped captures. 1167 Fix bug where create_ring would fail for particular snaplen and 1168 buffer size combinations 1169 Update pcap-config so that it handles libpcap requiring 1170 additional libraries 1171 Add workaround for threadsafeness on Windows 1172 Add missing mapping for DLT_ENC <-> LINKTYPE_ENC 1173 DLT: Add DLT_CAN_SOCKETCAN 1174 DLT: Add Solaris ipnet 1175 Don't check for DLT_IPNET if it's not defined 1176 Add link-layer types for Fibre Channel FC-2 1177 Add link-layer types for Wireless HART 1178 Add link-layer types for AOS 1179 Add link-layer types for DECT 1180 Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups) 1181 Install headers unconditionally, and include vlan.h/bluetooth.h if 1182 enabled 1183 Autoconf fixes+cleanup 1184 Support enabling/disabling bluetooth (--{en,dis}able-bluetooth) 1185 Support disabling SITA support (--without-sita) 1186 Return -1 on failure to create packet ring (if supported but 1187 creation failed) 1188 Fix handling of 'any' device, so that it can be opened, and no longer 1189 attempt to open it in Monitor mode 1190 Add support for snapshot length for USB Memory-Mapped Interface 1191 Fix configure and build on recent Linux kernels 1192 Fix memory-mapped Linux capture to support pcap_next() and 1193 pcap_next_ex() 1194 Fixes for Linux USB capture 1195 DLT: Add DLT_LINUX_EVDEV 1196 DLT: Add DLT_GSMTAP_UM 1197 DLT: Add DLT_GSMTAP_ABIS 1198 1199Mon. October 27, 2008. ken@netfunctional.ca. Summary for 1.0.0 libpcap release 1200 Compile with IPv6 support by default 1201 Compile with large file support on by default 1202 Add pcap-config script, which deals with -I/-L flags for compiling 1203 DLT: Add IPMB 1204 DLT: Add LAPD 1205 DLT: Add AX25 (AX.25 w/KISS header) 1206 DLT: Add JUNIPER_ST 1207 802.15.4 support 1208 Variable length 802.11 header support 1209 X2E data type support 1210 SITA ACN Interface support - see README.sita 1211 Support for memory-mapped capture on Linux 1212 Support for zerocopy BPF on platforms that support it 1213 Support for setting buffer size when opening devices 1214 Support for setting monitor mode when opening 802.11 devices 1215 Better support for dealing with VLAN tagging/stripping on Linux 1216 Fix dynamic library support on OSX 1217 Return PCAP_ERROR_IFACE_NOT_UP if the interface isn't 'UP', so applications 1218 can print better diagnostic information 1219 Return PCAP_ERROR_PERM_DENIED if we don't have permission to open a device, so 1220 applications can tell the user they need to go play with permissions 1221 On Linux, ignore ENETDOWN so we can continue to capture packets if the 1222 interface goes down and comes back up again. 1223 On Linux, support new tpacket frame headers (2.6.27+) 1224 On Mac OS X, add scripts for changing permissions on /dev/bpf* and launchd plist 1225 On Solaris, support 'passive mode' on systems that support it 1226 Fixes to autoconf and general build environment 1227 Man page reorganization + cleanup 1228 Autogenerate VERSION numbers better 1229 1230Mon. September 10, 2007. ken@xelerance.com. Summary for 0.9.8 libpcap release 1231 Change build process to put public libpcap headers into pcap subdir 1232 DLT: Add value for IPMI IPMB packets 1233 DLT: Add value for u10 Networks boards 1234 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted 1235 libpcap files on an OS other than where the file was generated 1236 1237Wed. April 25, 2007. ken@xelerance.com. Summary for 0.9.6 libpcap release 1238 1239 Put the public libpcap headers into a pcap subdirectory in both the 1240 source directory and the target include directory, and have include 1241 files at the top-level directory to include those headers, for 1242 backwards compatibility. 1243 Add Bluetooth support 1244 Add USB capturing support on Linux 1245 Add support for the binary USB sniffing interface in Linux 1246 Add support for new FreeBSD BIOCSDIRECTION ioctl 1247 Add additional filter operations for 802.11 frame types 1248 Add support for filtering on MTP2 frame types 1249 Propagate some changes from the main branch, so the x.9 branch has 1250 all the DLT_ and LINKTYPE_ values that the main branch does 1251 Reserved a DLT_ and SAVEFILE_ value for PPI (Per Packet Info) 1252 encapsulated packets 1253 Add LINKTYPE_ for IEEE 802.15.4, with address fields padded as done 1254 by Linux drivers 1255 Add LINKTYPE_ value corresponding to DLT_IEEE802_16_MAC_CPS. 1256 Add DLT for IEEE 802.16 (WiMAX) MAC Common Part Sublayer 1257 Add DLT for Bluetooth HCI UART transport layer 1258 When building a shared library, build with "-fPIC" on Linux to support x86_64 1259 Link with "$(CC) -shared" rather than "ld -shared" when building a 1260 ".so" shared library 1261 Add support for autoconf 2.60 1262 Fixes to discard unread packets when changing filters 1263 Changes to handle name changes in the DAG library resulting from 1264 switching to libtool. 1265 Add support for new DAG ERF types. 1266 Add an explicit "-ldag" when building the shared library, so the DAG 1267 library dependency is explicit. 1268 Mac OSX fixes for dealing with "wlt" devices 1269 Fixes in add_or_find_if() & pcap_findalldevs() to optimize generating 1270 device lists 1271 Fixed a bug in pcap_open_live(). The return value of PacketSetHwFilter 1272 was not checked. 1273 1274Tue. September 19, 2006. ken@xelerance.com. Summary for 0.9.5 libpcap release 1275 1276 Support for LAPD frames with vISDN 1277 Support for ERF on channelized T1/E1 cards via DAG API 1278 Fix capitalization that caused issues crossc compiling on Linux 1279 Better failure detection on PacketGetAdapterNames() 1280 Fixes for MPLS packet generation (link layer) 1281 OP_PACKET now matches the beginning of the packet, instead of 1282 beginning+link-layer 1283 Add DLT/LINKTYPE for carrying FRF.16 Multi-link Frame Relay 1284 Fix allocation of buffer for list of link-layer types 1285 Added a new DLT and LINKTYPE value for ARINC 653 Interpartition Communication Messages 1286 Fixed a typo in a DLT value: it should start with DLT_ and not LINKTYPE_ 1287 Redefined DLT_CAN20B and LINKTYPE_CAN20B as #190 (as this is the right value for CAN). 1288 Added definition for DLT_A429 and LINKTYPE_A429 as #184. 1289 Added a new DLT and LINKTYPE value for CAN v2.0B frames. 1290 Add support for DLT_JUNIPER_VP. 1291 Don't double-count received packets on Linux systems that 1292 support the PACKET_STATISTICS getsockopt() argument on 1293 PF_PACKET sockets. 1294 Add support for DLT_IEEE802_11 and DLT_IEEE802_11_RADIO link 1295 layers in Windows 1296 Add support to build libpcap.lib and wpcap.dll under Cygnus and 1297 MingW32. 1298 1299Mon. September 5, 2005. ken@xelerance.com. Summary for 0.9.4 libpcap release 1300 1301 Support for radiotap on Linux (Mike Kershaw) 1302 Fixes for HP-UX 1303 Support for additional Juniper link-layer types 1304 Fixes for filters on MPLS-encapsulated packets 1305 "vlan" filter fixed 1306 "pppoed" and "pppoes" filters added; the latter modifies later 1307 parts of the filter expression to look at the PPP headers and 1308 headers in the PPP payload 1309 1310Tue. July 5, 2005. ken@xelerance.com. Summary for 0.9.3 libpcap release 1311 1312 Fixes for compiling on nearly every platform, 1313 including improved 64bit support 1314 MSDOS Support 1315 Add support for sending packets 1316 OpenBSD pf format support 1317 IrDA capture (Linux only) 1318 1319Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release 1320 1321 Fixed minor problem in gencode.c that would appear on 64-bit 1322 platforms. 1323 Version number is now sane. 1324 1325Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release 1326 1327 updates for autoconf 2.5 1328 fixes for ppp interfaces for freebsd 4.1 1329 pcap gencode can generate code for 802.11, IEEE1394, and pflog. 1330 1331Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 0.8 release 1332 1333 added pcap_findalldevs() 1334 Win32 patches from NetGroup, Politecnico di Torino (Italy) 1335 OpenBSD pf, DLT_PFLOG added 1336 Many changes to ATM support. 1337 lookup pcap_lookupnet() 1338 Added DLT_ARCNET_LINUX, DLT_ENC, DLT_IEEE802_11_RADIO, DLT_SUNATM, 1339 DLT_IP_OVER_FC, DLT_FRELAY, others. 1340 Sigh. More AIX wonderfulness. 1341 Document updates. 1342 Changes to API: pcap_next_ex(), pcap_breakloop(), pcap_dump_flush(), 1343 pcap_list_datalinks(), pcap_set_datalink(), 1344 pcap_lib_version(), pcap_datalink_val_to_name(), 1345 pcap_datalink_name_to_val(), new error returns. 1346 1347Tuesday, February 25, 2003. fenner@research.att.com. 0.7.2 release 1348 1349 Support link types that use 802.2 always, never, and sometimes. 1350 Don't decrease the size of the BPF buffer from the default. 1351 Support frame relay. 1352 Handle 32-bit timestamps in DLPI, and pass the right buffer size. 1353 Handle Linux systems with modern kernel but without 1354 SOL_PACKET in the userland headers. 1355 Linux support for ARPHRD_RAWHDLC. 1356 Handle 32-bit timestamps in snoop. 1357 Support eg (Octane/O2xxx/O3xxx Gigabit) devices. 1358 Add new reserved DLT types. 1359 1360Monday October 23, 2001. mcr@sandelman.ottawa.on.ca. Summary for 0.7 release 1361 1362 Added pcap_findalldevs() call to get list of interfaces in a MI way. 1363 1364 pcap_stats() has been documented as to what its counters mean on 1365 each platform. 1366 1367Tuesday January 9, 2001. guy@alum.mit.edu. Summary for 0.6 release 1368 1369 New Linux libpcap implementation, which, in 2.2 and later 1370 kernels, uses PF_PACKET sockets and supports kernel packet 1371 filtering (if compiled into the kernel), and supports the "any" 1372 device for capturing on all interfaces. Cleans up promiscuous 1373 mode better on pre-2.2 kernels, and has various other fixes 1374 (handles 2.4 ARPHRD_IEEE802_TR, handles ISDN devices better, 1375 doesn't show duplicate packets on loopback interface, etc.). 1376 1377 Fixed HP-UX libpcap implementation to correctly get the PPA for 1378 an interface, to allow interfaces to be opened by interface name. 1379 1380 libpcap savefiles have system-independent link-layer type values 1381 in the header, rather than sometimes platform-dependent DLT_ 1382 values, to make it easier to exchange capture files between 1383 different OSes. 1384 1385 Non-standard capture files produced by some Linux tcpdumps, e.g. 1386 the one from Red Hat Linux 6.2 and later, can now be read. 1387 1388 Updated autoconf stock files. 1389 1390 Filter expressions can filter on VLAN IDs and various OSI 1391 protocols, and work on Token Ring (with non-source-routed 1392 packets). 1393 1394 "pcap_open_dead()" added to allow compiling filter expressions 1395 to pcap code without opening a capture device or capture file. 1396 1397 Header files fixed to allow use in C++ programs. 1398 1399 Removed dependency on native headers for packet layout. 1400 Removed Linux specific headers that were shipped. 1401 1402 Security fixes: Strcpy replaced with strlcpy, sprintf replaced 1403 with snprintf. 1404 1405 Fixed bug that could cause subsequent "pcap_compile()"s to fail 1406 erroneously after one compile failed. 1407 1408 Assorted other bug fixes. 1409 1410 README.aix and README.linux files added to describe 1411 platform-specific issues. 1412 1413 "getifaddrs()" rather than SIOCGIFCONF used, if available. 1414 1415v0.5 Sat Jun 10 11:09:15 PDT 2000 1416 1417itojun@iijlab.net 1418- Brought in KAME IPv6/IPsec bpf compiler. 1419- Fixes for NetBSD. 1420- Support added for OpenBSD DLT_LOOP and BSD/OS DLT_C_HDLC (Cisco HDLC), 1421 and changes to work around different BSDs having different DLT_ types 1422 with the same numeric value. 1423 1424Assar Westerlund <assar@sics.se> 1425- Building outside the source code tree fixed. 1426- Changed to write out time stamps with 32-bit seconds and microseconds 1427 fields, regardless of whether those fields are 32 bits or 64 bits in 1428 the OS's native "struct timeval". 1429- Changed "pcap_lookupdev()" to dynamically grow the buffer into which 1430 the list of interfaces is read as necessary in order to hold the 1431 entire list. 1432 1433Greg Troxel <gdt@ir.bbn.com> 1434- Added a new "pcap_compile_nopcap()", which lets you compile a filter 1435 expression into a BPF program without having an open live capture or 1436 capture file. 1437 1438v0.4 Sat Jul 25 12:40:09 PDT 1998 1439 1440- Fix endian problem with DLT_NULL devices. From FreeBSD via Bill 1441 Fenner (fenner@parc.xerox.com) 1442 1443- Fix alignment problem with FDDI under DLPI. This was causing core 1444 dumps under Solaris. 1445 1446- Added configure options to disable flex and bison. Resulted from a 1447 bug report by barnett@grymoire.crd.ge.com (Bruce Barnett). Also added 1448 options to disable gcc and to force a particular packet capture type. 1449 1450- Added support for Fore ATM interfaces (qaa and fa) under IRIX. Thanks 1451 to John Hawkinson (jhawk@mit.edu) 1452 1453- Change Linux PPP and SLIP to use DLT_RAW since the kernel does not 1454 supply any "link layer" data. 1455 1456- Change Linux to use SIOCGIFHWADDR ioctl to determine link layer type. 1457 Thanks to Thomas Sailer (sailer@ife.ee.ethz.ch) 1458 1459- Change IRIX PPP to use DLT_RAW since the kernel does not supply any 1460 "link layer" data. 1461 1462- Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header 1463 formats. 1464 1465- Added some new SGI snoop interface types. Thanks to Steve Alexander 1466 (sca@refugee.engr.sgi.com) 1467 1468- Fixes for HP-UX 10.20 (which is similar to HP-UX 9). Thanks to 1469 Richard Allen (ra@hp.is) and Steinar Haug (sthaug@nethelp.no) 1470 1471- Fddi supports broadcast as reported by Jeff Macdonald 1472 (jeff@iacnet.com). Also correct ieee802 and arcnet. 1473 1474- Determine Linux pcap buffer size at run time or else it might not be 1475 big enough for some interface types (e.g. FDDI). Thanks to Jes 1476 Sorensen (Jes.Sorensen@cern.ch) 1477 1478- Fix some linux alignment problems. 1479 1480- Document promisc argument to pcap_open_live(). Reported by Ian Marsh 1481 (ianm@sics.se) 1482 1483- Support Metricom radio packets under Linux. Thanks to Kevin Lai 1484 (laik@gunpowder.stanford.edu) 1485 1486- Bind to interface name under Linux to avoid packets from multiple 1487 interfaces on multi-homed hosts. Thanks to Kevin Lai 1488 (laik@gunpowder.stanford.edu) 1489 1490- Change L_SET to SEEK_SET for HP-UX. Thanks to Roland Roberts 1491 (rroberts@muller.com) 1492 1493- Fixed an uninitialized memory reference found by Kent Vander Velden 1494 (graphix@iastate.edu) 1495 1496- Fixed lex pattern for IDs to allow leading digits. As reported by 1497 Theo de Raadt (deraadt@cvs.openbsd.org) 1498 1499- Fixed Linux include file problems when using GNU libc. 1500 1501- Ifdef ARPHRD_FDDI since not all versions of the Linux kernel have it. 1502 Reported reported by Eric Jacksch (jacksch@tenebris.ca) 1503 1504- Fixed bug in pcap_dispatch() that kept it from returning on packet 1505 timeouts. 1506 1507- Changed ISLOOPBACK() macro when IFF_LOOPBACK isn't available to check 1508 for "lo" followed by an eos or digit (newer versions of Linux 1509 apparently call the loopback "lo" instead of "lo0"). 1510 1511- Fixed Linux networking include files to use ints instead of longs to 1512 avoid problems with 64 bit longs on the alpha. Thanks to Cristian 1513 Gafton (gafton@redhat.com) 1514 1515v0.3 Sat Nov 30 20:56:27 PST 1996 1516 1517- Added Linux support. 1518 1519- Fixed savefile bugs. 1520 1521- Solaris x86 fix from Tim Rylance (t.rylance@elsevier.nl) 1522 1523- Add support for bpf kernel port filters. 1524 1525- Remove duplicate atalk protocol table entry. Thanks to Christian 1526 Hopps (chopps@water.emich.edu) 1527 1528- Fixed pcap_lookupdev() to ignore nonexistent devices. This was 1529 reported to happen under BSD/OS by David Vincenzetti 1530 (vince@cryptonet.it) 1531 1532- Avoid solaris compiler warnings. Thanks to Bruce Barnett 1533 (barnett@grymoire.crd.ge.com) 1534 1535v0.2.1 Sun Jul 14 03:02:26 PDT 1996 1536 1537- Fixes for HP-UX 10. Thanks in part to Thomas Wolfram 1538 (wolf@prz.tu-berlin.de) and Rick Jones (raj@hpisrdq.cup.hp.com) 1539 1540- Added support for SINIX. Thanks to Andrej Borsenkow 1541 (borsenkow.msk@sni.de) 1542 1543- Fixes for AIX (although this system is not yet supported). Thanks to 1544 John Hawkinson (jhawk@mit.edu) 1545 1546- Use autoconf's idea of the top level directory in install targets. 1547 Thanks to John Hawkinson. 1548 1549- Add missing autoconf packet capture result message. Thanks to Bill 1550 Fenner (fenner@parc.xerox.com) 1551 1552- Fixed padding problems in the pf module. 1553 1554- Fixed some more alignment problems on the alpha. 1555 1556- Added explicit netmask support. Thanks to Steve Nuchia 1557 (steve@research.oknet.com) 1558 1559- Fixed to handle raw ip addresses such as 0.0.0.1 without "left 1560 justifying" 1561 1562- Add "sca" keyword (for DEC cluster services) as suggested by Terry 1563 Kennedy (terry@spcvxa.spc.edu) 1564 1565- Add "atalk" keyword as suggested by John Hawkinson. 1566 1567- Add "igrp" keyword. 1568 1569- Fixed HID definition in grammar.y to be a string, not a value. 1570 1571- Use $CC when checking gcc version. Thanks to Carl Lindberg 1572 (carl_lindberg@blacksmith.com) 1573 1574- Removed obsolete reference to pcap_immediate() from the man page. 1575 Michael Stolarchuk (mts@terminator.rs.itd.umich.edu) 1576 1577- DLT_NULL has a 4 byte family header. Thanks to Jeffrey Honig 1578 (jch@bsdi.com) 1579 1580v0.2 Sun Jun 23 02:28:42 PDT 1996 1581 1582- Add support for HP-UX. Resulted from code contributed by Tom Murray 1583 (tmurray@hpindck.cup.hp.com) and Philippe-Andri Prindeville 1584 (philipp@res.enst.fr) 1585 1586- Update INSTALL with a reminder to install include files. Thanks to 1587 Mark Andrews (mandrews@aw.sgi.com) 1588 1589- Fix bpf compiler alignment bug on the alpha. 1590 1591- Use autoconf to detect architectures that can't handle misaligned 1592 accesses. 1593 1594- Added loopback support for snoop. Resulted from report Steve 1595 Alexander (sca@engr.sgi.com) 1596 1597v0.1 Fri Apr 28 18:11:03 PDT 1995 1598 1599- Fixed compiler and optimizer bugs. The BPF filter engine uses unsigned 1600 comparison operators, while the code generator and optimizer assumed 1601 signed semantics in several places. Thanks to Charlie Slater 1602 (cslater@imatek.com) for pointing this out. 1603 1604- Removed FDDI ifdef's, they aren't really needed. Resulted from report 1605 by Gary Veum (veum@boa.gsfc.nasa.gov). 1606 1607- Add pcap-null.c which allows offline use of libpcap on systems that 1608 don't support live package capture. This feature resulting from a 1609 request from Jan van Oorschot (j.p.m.voorschot@et.tudelft.nl). 1610 1611- Make bpf_compile() reentrant. Fix thanks to Pascal Hennequin 1612 (Pascal.Hennequin@hugo.int-evry.fr). 1613 1614- Port to GNU autoconf. 1615 1616- Fix pcap-dlpi.c to work with isdn. Resulted from report by Flemming 1617 Johansen (fsj@csd.cri.dk). 1618 1619- Handle multi-digit interface unit numbers (aka ppa's) under dlpi. 1620 Resulted from report by Daniel Ehrlich (ehrlich@cse.psu.edu). 1621 1622- Fix pcap-dlpi.c to work in non-promiscuous mode. Resulted from report 1623 by Jeff Murphy (jcmurphy@acsu.buffalo.edu). 1624 1625- Add support for "long jumps". Thanks to Jeffrey Mogul 1626 (mogul@pa.dec.com). 1627 1628- Fix minor problems when compiling with BDEBUG as noticed by Scott 1629 Bertilson (scott@unet.umn.edu). 1630 1631- Declare sys_errlist "const char *const" to avoid problems under 1632 FreeBSD. Resulted from report by jher@eden.com. 1633 1634v0.0.6 Fri Apr 28 04:07:13 PDT 1995 1635 1636- Add missing variable declaration missing from 0.0.6 1637 1638v0.0.5 Fri Apr 28 00:22:21 PDT 1995 1639 1640- Workaround for problems when pcap_read() returns 0 due to the timeout 1641 expiring. 1642 1643v0.0.4 Thu Apr 20 20:41:48 PDT 1995 1644 1645- Change configuration to not use gcc v2 flags with gcc v1. 1646 1647- Fixed a bug in pcap_next(); if pcap_dispatch() returns 0, pcap_next() 1648 should also return 0. Thanks to Richard Stevens (rstevens@noao.edu). 1649 1650- Fixed configure to test for snoop before dlpi to avoid problems under 1651 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). 1652 1653- Hack around deficiency in Ultrix's make. 1654 1655- Fix two bugs related to the Solaris pre-5.3.2 bufmod bug; handle 1656 savefiles that have more than snapshot bytes of data in them (so we 1657 can read old savefiles) and avoid writing such files. 1658 1659- Added checkioctl which is used with gcc to check that the 1660 "fixincludes" script has been run. 1661 1662v0.0.3 Tue Oct 18 18:13:46 PDT 1994 1663 1664- Fixed configure to test for snoop before dlpi to avoid problems under 1665 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). 1666 1667v0.0.2 Wed Oct 12 20:56:37 PDT 1994 1668 1669- Implement timeout in the dlpi pcap_open_live(). Thanks to Richard 1670 Stevens. 1671 1672- Determine pcap link type from dlpi media type. Resulted from report 1673 by Mahesh Jethanandani (mahesh@npix.com). 1674 1675v0.0.1 Fri Jun 24 14:50:57 PDT 1994 1676 1677- Fixed bug in nit_setflags() in pcap-snit.c. The streams ioctl timeout 1678 wasn't being initialized sometimes resulting in an "NIOCSFLAGS: 1679 Invalid argument" error under OSF/1. Reported by Matt Day 1680 (mday@artisoft.com) and Danny Mitzel (dmitzel@whitney.hitc.com). 1681 1682- Turn on FDDI support by default. 1683 1684v0.0 Mon Jun 20 19:20:16 PDT 1994 1685 1686- Initial release. 1687 1688- Fixed bug with greater/less keywords, reported by Mark Andrews 1689 (mandrews@alias.com). 1690 1691- Fix bug where '|' was defined as BPF_AND instead of BPF_OR, reported 1692 by Elan Amir (elan@leeb.cs.berkeley.edu). 1693 1694- Machines with little-endian byte ordering are supported thanks to 1695 Jeff Mogul. 1696 1697- Add hack for version 2.3 savefiles which don't have caplen and len 1698 swapped thanks to Vern Paxson. 1699 1700- Added "&&" and "||" aliases for "and" and "or" thanks to Vern Paxson. 1701 1702- Added length, inbound and outbound keywords. 1703