tcpdump: Update to 4.99.6

Changes:	https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.99/CHANGES
Obtained from:	https://www.tcpdump.org/release/tcpdump-4.99.6.tar.xz
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D55578
Differential Revision:	https://reviews.freebsd.org/D55871

69 files changed, 1592 insertions, 1669 deletions

diff --git a/contrib/tcpdump/CHANGES b/contrib/tcpdump/CHANGES
index b63d1eb658d3..72496fde7a43 100644
--- a/contrib/tcpdump/CHANGES
+++ b/contrib/tcpdump/CHANGES
@@ -1,3 +1,76 @@
+Tuesday, December 30, 2025 / The Tcpdump Group
+  Summary for 4.99.6 tcpdump release
+    Remove protocol decoding for:
+      OTV (draft-hasmit-otv-04, this Internet-Draft is no longer active).
+    Refine protocol decoding for:
+      DNS: Use ND_TCHECK_LEN() instead of a custom bounds check.
+      IPv6: Add a missing comma and remove a colon in the output.
+      TCP: Note if the Urgent Pointer is non-zero while URG flag not set,
+           if the verbose level is > 1 (option -vv and more).
+      TCP: Note if the Acknowledgment Number is non-zero while ACK flag not set,
+           if the verbose level is > 1 (option -vv and more).
+      TCP: Fix Reset segment processing.
+      IP, IPv6: Fix setting the snapshot length for the payload.
+      IP: Use ND_TTEST_LEN() instead of a custom bounds check.
+      frag6: Add a bounds check in non-verbose mode.
+      PTP: Remove spaces before colons in output.
+      PTP: Fix management packet fields.
+      ISO: Avoid undefined behavior and integer overflow in the Fletcher
+           checksum calculation.
+      NFS: Delete dead code.
+      BOOTP: Use an uint16_t variable to get the result of a GET_BE_U_2().
+      ZEP: use the existing NTP time formatting code.
+      NTP: Fix p_ntp_time_fmt() using epoch 1/epoch 2 convention (RFC 4330).
+      NTP: Update a field name with the RFC 5905 name (Origin Timestamp).
+      IPv6 mobility: Modernize packet parsing and make fixes.
+      IP6OPTS: Modernize packet parsing and make fixes.
+      VXLAN: Add UDP port 8472 used by Linux as the default port.
+      EGP: Replace custom code with tok2str(); Modernize packet parsing and
+        fix printing with -v option.
+    User interface:
+      Add optional unit suffix on -C file size.
+      Improve the handling of size suffixes for -C.
+      Print errors for options -A, -x[x] and -X[X] (mutually exclusive).
+      Print errors about -C, -G and -z options usage.
+      For PCAP_ERROR_CAPTURE_NOTSUP, show the error message provided
+        by libpcap for that error if it's non-empty.
+      Update the -z option processing. Print "invalid option -- z" when it is.
+      Add the -g option, causing IPv4 output in verbose mode to be on one line.
+    Other:
+      Avoid race condition when receiving signal during shutdown.
+      Always show the interface name in error messages when the
+        interface can't be opened.
+      Clean up the message shown if a -i flag is specified with an
+        interface index that's too large.
+    Source code:
+      Fix '-tt' option printing when time > 2106-02-07T06:28:15Z.
+      Add sub-second packet timestamp checks for invalid micro/nano.
+      Remove unused missing/snprintf.c.
+      Fix incompatible pointer types with time functions calls on Windows.
+      Use C99 macros to define 64-bit constants and maximum 64-bit values.
+    Windows:
+      Fixed to find wpcap.dll if WinPcap isn't installed and Npcap was
+        installed without the WinPcap API compatibility option. (GitHub
+        issue #1226).
+    Building and testing:
+      Makefile.in: Use a local libpcap in the releasecheck target.
+      CMake: Fix build with CMake 3.31.
+      autotools, CMake: don't separately test whether snprintf(3) is
+        available and whether it's suitable - the test for whether it's
+        suitable also fails if it's unavailable.
+      CMake: Skip snprintf(3) tests when cross-compiling.
+      autotools, CMake: fix issues with snprintf test and sanitizers.
+      CMake: check whether check_c_source_runs() works, treat the build
+        as a cross-compile if it doesn't work.
+      Autoconf: Use AC_SYS_YEAR2038_RECOMMENDED when possible if the
+        environment variable BUILD_YEAR2038 = yes (via autogen.sh).
+      Autoconf: Avoid incorrectly include the libpcap's config.h.
+      Autoconf: Refine reporting of os-proto.h.
+      Require config.h to be from the tcpdump build.
+      AppVeyor: Update Npcap SDK to 1.15.
+      autogen.sh: Allow to configure Autoconf warnings.
+      autogen.sh: Delete all trailing blank lines at end of configure.
+
 Friday, August 30, 2024 / The Tcpdump Group
   Summary for 4.99.5 tcpdump release
     Refine protocol decoding for:
@@ -38,7 +111,7 @@ Friday, August 30, 2024 / The Tcpdump Group
       OSPF: Pad TLVs in LS_OPAQUE_TYPE_RI to multiples of 4 bytes.
       OSPF: Update LS-Ack printing not to run off the end of the packet.
       OSPF6: Fix an undefined behavior.
-      pflog: use nd_ types in struct pfloghdr.
+      pflog: Use nd_ types in struct pfloghdr.
       PPP: Check if there is some data to hexdump.
       PPP: Remove an extra colon before LCP Callback Operation.
       Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397;
@@ -122,6 +195,7 @@ Friday, August 30, 2024 / The Tcpdump Group
       Make various improvements to the man page.
       Add initial README file for Haiku.
       Make various improvements to CONTRIBUTING.md.
+      man: Clarify the "any" pseudo-interface further.
 
 Friday, April 7, 2023 / The Tcpdump Group
   Summary for 4.99.4 tcpdump release
@@ -179,7 +253,7 @@ Saturday, December 31, 2022 / The Tcpdump Group
       802.11: Fetch the CF and TIM IEs a field at a time.
       802.15.4, BGP, LISP: fix some length checks, compiler warnings,
         and undefined behavior warnings.
-      PFLOG: handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
+      PFLOG: Handle LINKTYPE_PFLOG/DLT_PFLOG files from all OSes on all
         OSes.
       RRCP: support more Realtek protocols than just RRCP.
       MPLS: show the EXP field as TC, as per RFC 5462.
diff --git a/contrib/tcpdump/CMakeLists.txt b/contrib/tcpdump/CMakeLists.txt
index f9071295eff1..6b8647201038 100644
--- a/contrib/tcpdump/CMakeLists.txt
+++ b/contrib/tcpdump/CMakeLists.txt
@@ -13,14 +13,21 @@ else(WIN32)
     #  on a "long-term support" version # of some OS and that
     #  version supplies an older version of CMake;
     #
-    #  otherwise, require 3.5, so we don't get messages warning
-    #  that support for versions of CMake lower than 3.5 is
+    #  otherwise, if it's a version less than 3.10, require only
+    #  3.5, just in case somebody is configuring with CMake
+    #  on a "long-term support" version # of some OS and that
+    #  version supplies an older version of CMake;
+    #
+    #  otherwise, require 3.10, so we don't get messages warning
+    #  that support for versions of CMake lower than 3.10 is
     #  deprecated.
     #
     if(CMAKE_VERSION VERSION_LESS "3.5")
         cmake_minimum_required(VERSION 2.8.12)
-    else()
+    elseif(CMAKE_VERSION VERSION_LESS "3.10")
         cmake_minimum_required(VERSION 3.5)
+    else()
+        cmake_minimum_required(VERSION 3.10)
     endif()
 endif(WIN32)
 
@@ -392,6 +399,35 @@ if(MSVC)
    endif (USE_STATIC_RT)
 endif(MSVC)
 
+#
+# CMake's definition of "cross-compiling" appears to be "compiling
+# for an *operating system* other than the one on which the build
+# is being done*.
+#
+# This is an inadequate definition, as people build for the same
+# operating system but a different instruction set, e.g. building
+# on an IA-32 or x86-64 Linux box for an Arm embedded Linux box,
+# or building Arm code on an IA-32 or x86-64 Windows box.
+#
+# So just test whether check_c_source_runs() on a trivial program
+# works; if not, it's probably because the generated code won't
+# run on the platform on which we're running.
+#
+include(CheckCSourceRuns)
+if (NOT CMAKE_CROSSCOMPILING)
+    check_c_source_runs("
+    int main()
+    {
+        return 0;
+    }
+    "
+        CHECK_C_SOURCE_RUNS_WORKS
+    )
+    if (NOT CHECK_C_SOURCE_RUNS_WORKS)
+        set(CMAKE_CROSSCOMPILING TRUE)
+    endif()
+endif()
+
 ###################################################################
 #   Detect available platform features
 ###################################################################
@@ -407,11 +443,16 @@ include(CheckVariableExists)
 include(CheckTypeSize)
 
 #
-# Get the size of a time_t, to know whether it's 32-bit or 64-bit.
+# Get the size of a time_t, to know whether it's 32-bit or 64-bit. Print it.
 #
 cmake_push_check_state()
 set(CMAKE_EXTRA_INCLUDE_FILES time.h)
 check_type_size("time_t" SIZEOF_TIME_T)
+if(SIZEOF_TIME_T EQUAL 4)
+  message(STATUS "32-bit time_t")
+elseif(SIZEOF_TIME_T EQUAL 8)
+  message(STATUS "64-bit time_t")
+endif()
 cmake_pop_check_state()
 
 #
@@ -493,67 +534,77 @@ else(STDLIBS_HAVE_GETSERVENT)
 endif(STDLIBS_HAVE_GETSERVENT)
 cmake_pop_check_state()
 
-#
-# Make sure we have snprintf(); we require it.
-# We use check_symbol_exists(), as it isn't necessarily an external
-# function - in Visual Studio, for example, it is an inline function
-# calling an external function.
-#
-check_symbol_exists(snprintf "stdio.h" HAVE_SNPRINTF)
-if(NOT HAVE_SNPRINTF)
-    message(FATAL_ERROR "snprintf() is required but wasn't found")
-endif()
-
-#
-# Require a proof of suitable snprintf(3), same as in Autoconf.
-#
-include(CheckCSourceRuns)
-check_c_source_runs("
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
-#include <sys/types.h>
-
-int main()
-{
-  char buf[100];
-  uint64_t t = (uint64_t)1 << 32;
-
-  snprintf(buf, sizeof(buf), \"%zu\", sizeof(buf));
-  if (strncmp(buf, \"100\", sizeof(buf)))
-    return 1;
-
-  snprintf(buf, sizeof(buf), \"%zd\", -sizeof(buf));
-  if (strncmp(buf, \"-100\", sizeof(buf)))
-    return 2;
-
-  snprintf(buf, sizeof(buf), \"%\" PRId64, -t);
-  if (strncmp(buf, \"-4294967296\", sizeof(buf)))
-    return 3;
-
-  snprintf(buf, sizeof(buf), \"0o%\" PRIo64, t);
-  if (strncmp(buf, \"0o40000000000\", sizeof(buf)))
-    return 4;
-
-  snprintf(buf, sizeof(buf), \"0x%\" PRIx64, t);
-  if (strncmp(buf, \"0x100000000\", sizeof(buf)))
-    return 5;
-
-  snprintf(buf, sizeof(buf), \"%\" PRIu64, t);
-  if (strncmp(buf, \"4294967296\", sizeof(buf)))
-    return 6;
-
-  return 0;
-}
-
-"
-    SUITABLE_SNPRINTF
-)
-if(NOT SUITABLE_SNPRINTF)
-    message(FATAL_ERROR
+if (NOT CMAKE_CROSSCOMPILING)
+    #
+    # Require a proof of suitable snprintf(3), same as in Autoconf.
+    #
+    check_c_source_runs("
+    #include <stdio.h>
+    #include <string.h>
+    #include <inttypes.h>
+    #include <sys/types.h>
+
+    #if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
+    /*
+     * On UN*Xes, this is a signed integer type of the same size as size_t.
+     *
+     * It's not defined by Visual Studio; we assume that ptrdiff_t will
+     * be a type that is a signed integer type of the same size as size_t.
+     */
+    typedef ptrdiff_t ssize_t;
+    #endif
+
+    /*
+     * Avoid trying to cast negative values to unsigned types, or doing
+     * shifts of signed types, in order not to have the test program fail
+     * if we're building with undefined-behavior sanitizers enabled.
+     */
+    int main()
+    {
+      char buf[100];
+      unsigned int ui = sizeof(buf);
+      int i = sizeof(buf);
+      int64_t i64 = INT64_C(0x100000000);
+      uint64_t ui64 = UINT64_C(0x100000000);
+
+      snprintf(buf, sizeof(buf), \"%zu\", (size_t)ui);
+      if (strncmp(buf, \"100\", sizeof(buf)))
+        return 1;
+
+      snprintf(buf, sizeof(buf), \"%zd\", (ssize_t)(-i));
+      if (strncmp(buf, \"-100\", sizeof(buf)))
+        return 2;
+
+      snprintf(buf, sizeof(buf), \"%\" PRId64, -i64);
+      if (strncmp(buf, \"-4294967296\", sizeof(buf)))
+        return 3;
+
+      snprintf(buf, sizeof(buf), \"0o%\" PRIo64, ui64);
+      if (strncmp(buf, \"0o40000000000\", sizeof(buf)))
+        return 4;
+
+      snprintf(buf, sizeof(buf), \"0x%\" PRIx64, ui64);
+      if (strncmp(buf, \"0x100000000\", sizeof(buf)))
+        return 5;
+
+      snprintf(buf, sizeof(buf), \"%\" PRIu64, ui64);
+      if (strncmp(buf, \"4294967296\", sizeof(buf)))
+        return 6;
+
+      return 0;
+    }
+
+    "
+        SUITABLE_SNPRINTF
+    )
+    if(NOT SUITABLE_SNPRINTF)
+        message(FATAL_ERROR
 "The snprintf(3) implementation in this libc is not suitable,
 tcpdump would not work correctly even if it managed to compile."
-    )
+        )
+    endif()
+else()
+    message(STATUS "Skipped SUITABLE_SNPRINTF because cross-compiling.")
 endif()
 
 check_function_exists(getopt_long HAVE_GETOPT_LONG)
@@ -908,7 +959,7 @@ check_function_exists(pcap_dump_ftell64 HAVE_PCAP_DUMP_FTELL64)
 # we should check for it, so that we can use it if it's present.
 #
 # So we check for pcap_open() and pcap_findalldevs_ex() if 1) this isn't
-# macOS or 2) the the libpcap we found is not a system library, meaning
+# macOS or 2) the libpcap we found is not a system library, meaning
 # that its path begins neither with /usr/lib (meaning it's a system
 # dylib) nor /Application/Xcode.app (meaning it's a file in
 # the Xcode SDK).
@@ -1160,6 +1211,7 @@ if(EXISTS ${CMAKE_SOURCE_DIR}/.devel OR EXISTS ${CMAKE_BINARY_DIR}/.devel)
         check_and_add_compiler_option(-Wall)
         check_and_add_compiler_option(-Wassign-enum)
         check_and_add_compiler_option(-Wcast-qual)
+        check_and_add_compiler_option(-Wcomma)
         check_and_add_compiler_option(-Wmissing-prototypes)
         check_and_add_compiler_option(-Wmissing-variable-declarations)
         check_and_add_compiler_option(-Wold-style-definition)
@@ -1331,7 +1383,6 @@ set(NETDISSECT_SOURCE_LIST_C
     print-openflow.c
     print-ospf.c
     print-ospf6.c
-    print-otv.c
     print-pflog.c
     print-pgm.c
     print-pim.c
@@ -1496,6 +1547,9 @@ add_executable(tcpdump ${TCPDUMP_SOURCE_LIST_C})
 if(NOT C_ADDITIONAL_FLAGS STREQUAL "")
     set_target_properties(tcpdump PROPERTIES COMPILE_FLAGS ${C_ADDITIONAL_FLAGS})
 endif()
+if(NOT "${PCAP_LINK_FLAGS}" STREQUAL "")
+    set_target_properties(tcpdump PROPERTIES LINK_FLAGS ${PCAP_LINK_FLAGS})
+endif()
 target_link_libraries(tcpdump netdissect ${TCPDUMP_LINK_LIBRARIES})
 
 ######################################
@@ -1551,7 +1605,7 @@ add_custom_target(uninstall
     COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake)
 
 #
-# Tcpdump tests
+# tcpdump tests
 # We try to find the Perl interpreter and, if we do, we have the check
 # rule run tests/TESTrun with it, because just trying to run the TESTrun
 # script as a command won't work on Windows.
diff --git a/contrib/tcpdump/CONTRIBUTING.md b/contrib/tcpdump/CONTRIBUTING.md
index 215e4c6831c4..fdad452b47b8 100644
--- a/contrib/tcpdump/CONTRIBUTING.md
+++ b/contrib/tcpdump/CONTRIBUTING.md
@@ -39,7 +39,7 @@ and ask!
 1) Check that there isn't a pull request already opened for the changes you
    intend to make.
 
-2) [Fork](https://help.github.com/articles/fork-a-repo/) the Tcpdump
+2) [Fork](https://help.github.com/articles/fork-a-repo/) the tcpdump
    [repository](https://github.com/the-tcpdump-group/tcpdump).
 
 3) The easiest way to test your changes on multiple operating systems and
diff --git a/contrib/tcpdump/INSTALL.md b/contrib/tcpdump/INSTALL.md
index 08fc31b682d0..15b8270ccced 100644
--- a/contrib/tcpdump/INSTALL.md
+++ b/contrib/tcpdump/INSTALL.md
@@ -18,6 +18,10 @@ directory), do the following steps:
 run `./autogen.sh` (a shell script). The autogen.sh script will
 build the `configure` and `config.h.in` files.
 
+* If you build on a Linux 32-bit system, with Autoconf version >= 2.72
+and GNU C Library version >= 2.34, run `export BUILD_YEAR2038=yes`
+before running `./autogen.sh` to build with 64-bit time_t (Y2038-safe).
+
 On some system, you may need to set the `AUTORECONF` variable, like:
 `AUTORECONF=autoreconf-2.69 ./autogen.sh`
 to select the `autoreconf` version you want to use.
diff --git a/contrib/tcpdump/Makefile.in b/contrib/tcpdump/Makefile.in
index e991cce2da0f..72dd01d6e3c0 100644
--- a/contrib/tcpdump/Makefile.in
+++ b/contrib/tcpdump/Makefile.in
@@ -49,7 +49,7 @@ DEFS = @DEFS@ @CPPFLAGS@ @V_DEFS@
 
 # Standard CFLAGS
 CFLAGS = @CFLAGS@
-FULL_CFLAGS = $(CCOPT) $(DEFS) $(INCLS) $(CFLAGS)
+FULL_CFLAGS = $(INCLS) $(CCOPT) $(DEFS) $(CFLAGS)
 
 # Standard LDFLAGS
 LDFLAGS = @LDFLAGS@
@@ -192,7 +192,6 @@ LIBNETDISSECT_SRC=\
 	print-openflow.c \
 	print-ospf.c \
 	print-ospf6.c \
-	print-otv.c \
 	print-pflog.c \
 	print-pgm.c \
 	print-pim.c \
@@ -373,7 +372,6 @@ EXTRA_DIST = \
 	missing/getopt_long.h \
 	missing/getservent.c \
 	missing/pcap_dump_ftell.c \
-	missing/snprintf.c \
 	missing/strdup.c \
 	missing/strlcat.c \
 	missing/strlcpy.c \
@@ -409,8 +407,6 @@ getservent.o: $(srcdir)/missing/getservent.c
 	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/getservent.c
 getopt_long.o: $(srcdir)/missing/getopt_long.c
 	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/getopt_long.c
-snprintf.o: $(srcdir)/missing/snprintf.c
-	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/snprintf.c
 strdup.o: $(srcdir)/missing/strdup.c
 	$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/strdup.c
 strlcat.o: $(srcdir)/missing/strlcat.c
@@ -504,7 +500,7 @@ releasetar:
 	     tar xf -) && \
 	    echo "No $$TAG tag. Archive build from HEAD."; \
 	fi && \
-	(cd "$$TAG" && "$${AUTORECONF:-autoreconf}" && rm -rf autom4te.cache) && \
+	(cd "$$TAG" && ./autogen.sh && rm -rf autom4te.cache) && \
 	tar cf "$$DIR/$$TAG".tar "$$TAG" && \
 	rm -f "$$DIR/$$TAG".tar.gz && \
 	gzip --best "$$DIR/$$TAG".tar && \
@@ -516,6 +512,22 @@ releasecheck: releasetar
 	INSTALL_DIR=/tmp/install_"$$TAG"_$$$$ && \
 	DIR=`pwd` && \
 	cd /tmp && \
+	rm -rf libpcap && \
+	rm -rf install_libpcap && \
+	echo "[$@] $$ git clone [...] libpcap.git" && \
+	git clone --depth 3 --quiet https://github.com/the-tcpdump-group/libpcap.git && \
+	echo "[$@] $$ cd libpcap" && \
+	cd libpcap && \
+	echo "[$@] $$ ./autogen.sh" && \
+	./autogen.sh && \
+	echo "[$@] $$ ./configure --quiet --prefix=/tmp/install_libpcap" && \
+	./configure --quiet --prefix=/tmp/install_libpcap && \
+	echo "[$@] $$ make -s " && \
+	make -s && \
+	echo "[$@] $$ make -s install" && \
+	make -s install && \
+	echo "[$@] $$ cd .." && \
+	cd .. && \
 	rm -rf "$$TAG" && \
 	rm -rf "$$INSTALL_DIR" && \
 	tar xf "$$DIR"/"$$TAG".tar.gz && \
@@ -537,6 +549,8 @@ releasecheck: releasetar
 	touch .devel && \
 	mkdir build && \
 	cd build && \
+	echo "[$@] $$ export PKG_CONFIG_PATH=/tmp/install_libpcap/lib/pkgconfig" && \
+	export PKG_CONFIG_PATH=/tmp/install_libpcap/lib/pkgconfig && \
 	echo '[$@] $$ cmake -DENABLE_SMB=yes [...] ..' && \
 	cmake -DENABLE_SMB=yes \
 	    -DCMAKE_INSTALL_PREFIX="$$INSTALL_DIR" \
@@ -551,6 +565,8 @@ releasecheck: releasetar
 	cd ../.. && \
 	rm -rf "$$TAG" && \
 	rm -rf "$$INSTALL_DIR" && \
+	rm -rf install_libpcap && \
+	rm -rf libpcap && \
 	echo '[$@] Done.'
 
 whitespacecheck:
diff --git a/contrib/tcpdump/README.md b/contrib/tcpdump/README.md
index 566b7b7a874f..a227e126d00c 100644
--- a/contrib/tcpdump/README.md
+++ b/contrib/tcpdump/README.md
@@ -40,7 +40,7 @@ tcpdump compiles and works on at least the following platforms:
 * Windows (requires WinPcap or Npcap, and Visual Studio with CMake)
 
 ### Dependency on libpcap
-Tcpdump uses libpcap, a system-independent interface for user-level
+tcpdump uses libpcap, a system-independent interface for user-level
 packet capture.  Before building tcpdump, you must first retrieve and
 build libpcap.
 
diff --git a/contrib/tcpdump/VERSION b/contrib/tcpdump/VERSION
index 33640cd1b928..aeec4132fdd6 100644
--- a/contrib/tcpdump/VERSION
+++ b/contrib/tcpdump/VERSION
@@ -1 +1 @@
-4.99.5
+4.99.6
diff --git a/contrib/tcpdump/addrtostr.c b/contrib/tcpdump/addrtostr.c
index 1fd2cf0908bf..2c4133b5be72 100644
--- a/contrib/tcpdump/addrtostr.c
+++ b/contrib/tcpdump/addrtostr.c
@@ -127,9 +127,11 @@ addrtostr6 (const void *src, char *dst, size_t size)
   cur.base  = -1;
   for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
     if (words[i] == 0) {
-      if (cur.base == -1)
-           cur.base = i, cur.len = 1;
-      else cur.len++;
+      if (cur.base == -1) {
+         cur.base = i;
+         cur.len = 1;
+      } else
+         cur.len++;
     } else if (cur.base != -1) {
       if (best.base == -1 || cur.len > best.len)
          best = cur;
diff --git a/contrib/tcpdump/autogen.sh b/contrib/tcpdump/autogen.sh
index c84a6b5c5dd2..95c0233c80de 100755
--- a/contrib/tcpdump/autogen.sh
+++ b/contrib/tcpdump/autogen.sh
@@ -1,6 +1,7 @@
 #!/bin/sh -e
 
 : "${AUTORECONF:=autoreconf}"
+: "${BUILD_YEAR2038:=no}"
 
 AUTORECONFVERSION=`$AUTORECONF --version 2>&1 | grep "^autoreconf" | sed 's/.*) *//'`
 
@@ -21,5 +22,43 @@ if [ "$maj" = "" ] || [ "$min" = "" ] || \
 	exit 1
 fi
 
+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
+# s/AC_SYS_LARGEFILE/AC_SYS_YEAR2038_RECOMMENDED/ to ensure time_t
+# is Y2038-safe.
+if [ "$BUILD_YEAR2038" = yes ] && [ "`uname -s`" = Linux ]; then
+	if [ "$maj" -gt 2 ] || { [ "$maj" -eq 2 ] && [ "$min" -ge 72 ]; }; then
+		GLIBC_VERSION=`ldd --version|head -1|grep GLIBC|sed 's/.* //'`
+		maj_glibc=`echo "$GLIBC_VERSION" | cut -d. -f1`
+		min_glibc=`echo "$GLIBC_VERSION" | cut -d. -f2`
+		echo "GNU C Library identification: $GLIBC_VERSION"
+		if [ "$maj_glibc" -gt 2 ] || { [ "$maj_glibc" -eq 2 ] && \
+		   [ "$min_glibc" -ge 34 ]; }; then
+			CONFIGURE_AC_NEW="configure.ac.new$$"
+			sed 's/^# \(AC_SYS_YEAR2038_RECOMMENDED\)/\1/' \
+				<configure.ac >"$CONFIGURE_AC_NEW"
+			cmp -s configure.ac "$CONFIGURE_AC_NEW" || \
+			cat "$CONFIGURE_AC_NEW" >configure.ac
+			rm -f "$CONFIGURE_AC_NEW"
+			echo 'Setup to ensure time_t is Y2038-safe.'
+		fi
+	fi
+fi
+
 echo "$AUTORECONF identification: $AUTORECONFVERSION"
-"$AUTORECONF" -f
+
+# configure.ac is an Autoconf 2.69 file, but it works as expected even with
+# Autoconf 2.72.  However, in Autoconf versions 2.70 and later obsolete
+# construct warnings are enabled by default, which adds varying (depending on
+# the branch) amount of noise to the build matrix output, so provide a means
+# to silence that.
+env ${AUTOCONF_WARNINGS:+WARNINGS="$AUTOCONF_WARNINGS"} "$AUTORECONF" -f
+
+# Autoconf 2.71 adds a blank line after the final "exit 0" on Linux, but not
+# on OpenBSD.  Remove this difference to make it easier to compare the result
+# of "make releasetar" across different platforms.  From sed one-liners:
+# "delete all trailing blank lines at end of file (works on all seds)".  Don't
+# use mktemp(1) because AIX does not have it.
+CONFIGURE_NEW="configure.new$$"
+sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' <configure >"$CONFIGURE_NEW"
+cmp -s configure "$CONFIGURE_NEW" || cat "$CONFIGURE_NEW" >configure
+rm -f "$CONFIGURE_NEW"
diff --git a/contrib/tcpdump/checksum.c b/contrib/tcpdump/checksum.c
index 4bb97f1e33f4..bb07664dcec7 100644
--- a/contrib/tcpdump/checksum.c
+++ b/contrib/tcpdump/checksum.c
@@ -106,9 +106,9 @@ create_osi_cksum (const uint8_t *pptr, int checksum_offset, int length)
 
     int x;
     int y;
-    uint32_t mul;
+    int32_t mul;
     uint32_t c0;
-    uint32_t c1;
+    uint64_t c1;
     uint16_t checksum;
     int idx;
 
@@ -134,21 +134,23 @@ create_osi_cksum (const uint8_t *pptr, int checksum_offset, int length)
 
     mul = (length - checksum_offset)*(c0);
 
-    x = mul - c0 - c1;
-    y = c1 - mul - 1;
-
-    if ( y >= 0 ) y++;
-    if ( x < 0 ) x--;
+    /*
+     * Casting c0 and c1 here is guaranteed to be safe, because we know
+     * they have values between 0 and 254 inclusive.  These casts are
+     * done to ensure that all of the arithmetic operations are
+     * well-defined (i.e., not mixing signed and unsigned integers).
+     */
+    x = mul - (int)c0 - (int)c1;
+    y = (int)c1 - mul;
 
     x %= 255;
     y %= 255;
 
-
-    if (x == 0) x = 255;
-    if (y == 0) y = 255;
+    if (x <= 0) x += 255;
+    if (y <= 0) y += 255;
 
     y &= 0x00FF;
-    checksum = ((x << 8) | y);
+    checksum = (uint16_t)((x << 8) | y);
 
     return checksum;
 }
diff --git a/contrib/tcpdump/cmake/Modules/FindPCAP.cmake b/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
index 11074655f457..e27709256f72 100644
--- a/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
+++ b/contrib/tcpdump/cmake/Modules/FindPCAP.cmake
@@ -61,6 +61,42 @@ if(WIN32)
   if(PCAP_FOUND)
     set(PCAP_LIBRARIES ${PCAP_LIBRARY})
     set(PCAP_INCLUDE_DIRS ${PCAP_INCLUDE_DIR})
+
+    #
+    # We need to look for wpcap.dll in \Windows\System32\Npcap first,
+    # as either:
+    #
+    #  1) WinPcap isn't installed and Npcap isn't installed in "WinPcap
+    #     API-compatible Mode", so there's no wpcap.dll in
+    #     \Windows\System32, only in \Windows\System32\Npcap;
+    #
+    #  2) WinPcap is installed and Npcap isn't installed in "WinPcap
+    #     API-compatible Mode", so the wpcap.dll in \Windows\System32
+    #     is a WinPcap DLL, but we'd prefer an Npcap DLL (we should
+    #     work with either one if we're configured against WinPcap,
+    #     and we'll probably require Npcap if we're configured against
+    #     it), and that's in \Windows\System32\Npcap;
+    #
+    #  3) Npcap is installed in "WinPcap API-compatible Mode", so both
+    #     \Windows\System32 and \Windows\System32\Npcap have an Npcap
+    #     wpcap.dll.
+    #
+    # Unfortunately, Windows has no notion of an rpath, so we can't
+    # set the rpath to include \Windows\System32\Npcap at link time;
+    # what we need to do is to link wpcap as a delay-load DLL and
+    # add \Windows\System32\Npcap to the DLL search path early in
+    # main() with a call to SetDllDirectory().
+    #
+    # We add /delayload:wpcap.dll to the linker options here.
+    #
+    # See https://npcap.com/guide/npcap-devguide.html#npcap-feature-native-dll-implicitly
+    #
+    set(PCAP_LINK_FLAGS /delayload:wpcap.dll)
+
+    #
+    # Delay-loading libraries means we need to link with delayimp.lib.
+    #
+    set(PCAP_LIBRARIES ${PCAP_LIBRARIES} delayimp.lib)
   endif()
 else(WIN32)
   #
diff --git a/contrib/tcpdump/cmakeconfig.h.in b/contrib/tcpdump/cmakeconfig.h.in
index 0bd1e96e165a..244bcb818a6a 100644
--- a/contrib/tcpdump/cmakeconfig.h.in
+++ b/contrib/tcpdump/cmakeconfig.h.in
@@ -1,5 +1,8 @@
 /* cmakeconfig.h.in */
 
+#ifndef TCPDUMP_CONFIG_H_
+#define TCPDUMP_CONFIG_H_
+
 /* Define to 1 if arpa/inet.h declares `ether_ntohost' */
 #cmakedefine ARPA_INET_H_DECLARES_ETHER_NTOHOST 1
 
@@ -288,3 +291,5 @@
 /* Define to the type of an unsigned integer type wide enough to hold a
    pointer, if such a type exists, and if the system does not define it. */
 #cmakedefine uintptr_t 1
+
+#endif // TCPDUMP_CONFIG_H_
diff --git a/contrib/tcpdump/config.h.in b/contrib/tcpdump/config.h.in
index c1bc5f7d9de8..da600e885fde 100644
--- a/contrib/tcpdump/config.h.in
+++ b/contrib/tcpdump/config.h.in
@@ -1,5 +1,10 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+
+#ifndef TCPDUMP_CONFIG_H_
+#define TCPDUMP_CONFIG_H_
+
+
 /* Define to 1 if arpa/inet.h declares `ether_ntohost' */
 #undef ARPA_INET_H_DECLARES_ETHER_NTOHOST
 
@@ -75,7 +80,7 @@
 /* define if the OS provides AF_INET6 and struct in6_addr */
 #undef HAVE_OS_IPV6_SUPPORT
 
-/* if there's an os_proto.h for this platform, to use additional prototypes */
+/* if there's an os-proto.h for this platform, to use additional prototypes */
 #undef HAVE_OS_PROTO_H
 
 /* Define to 1 if you have the `pcap_breakloop' function. */
@@ -287,3 +292,7 @@
 /* Define to the type of an unsigned integer type wide enough to hold a
    pointer, if such a type exists, and if the system does not define it. */
 #undef uintptr_t
+
+
+#endif // TCPDUMP_CONFIG_H_
+
diff --git a/contrib/tcpdump/configure b/contrib/tcpdump/configure
index 9400d62bc838..222d8a513fd0 100755
--- a/contrib/tcpdump/configure
+++ b/contrib/tcpdump/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for tcpdump 4.99.5.
+# Generated by GNU Autoconf 2.71 for tcpdump 4.99.6.
 #
 #
 # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
@@ -608,8 +608,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='tcpdump'
 PACKAGE_TARNAME='tcpdump'
-PACKAGE_VERSION='4.99.5'
-PACKAGE_STRING='tcpdump 4.99.5'
+PACKAGE_VERSION='4.99.6'
+PACKAGE_STRING='tcpdump 4.99.6'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -1306,7 +1306,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures tcpdump 4.99.5 to adapt to many kinds of systems.
+\`configure' configures tcpdump 4.99.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1372,7 +1372,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of tcpdump 4.99.5:";;
+     short | recursive ) echo "Configuration of tcpdump 4.99.6:";;
    esac
   cat <<\_ACEOF
 
@@ -1489,7 +1489,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-tcpdump configure 4.99.5
+tcpdump configure 4.99.6
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2086,7 +2086,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by tcpdump $as_me 4.99.5, which was
+It was created by tcpdump $as_me 4.99.6, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -4248,6 +4248,11 @@ then :
 
 fi
 
+
+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
+# uncomment AC_SYS_YEAR2038_RECOMMENDED to ensure time_t is Y2038-safe.
+# (Can be done by autogen.sh)
+# AC_SYS_YEAR2038_RECOMMENDED
 #
 # Get the size of a void *, to know whether this is a 32-bit or 64-bit build.
 #
@@ -5839,18 +5844,6 @@ fi
 
 
 #
-# Make sure we have snprintf(); we require it.
-#
-ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf"
-if test "x$ac_cv_func_snprintf" = xyes
-then :
-
-else $as_nop
-  as_fn_error $? "snprintf() is required but wasn't found" "$LINENO" 5
-fi
-
-
-#
 # It became apparent at some point that using a suitable C99 compiler does not
 # automatically mean snprintf(3) implementation in the libc supports all the
 # modifiers and specifiers used in the project, so let's test that before the
@@ -5883,32 +5876,50 @@ else $as_nop
 #include <inttypes.h>
 #include <sys/types.h>
 
+#if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
+/*
+ * On UN*Xes, this is a signed integer type of the same size as size_t.
+ *
+ * It's not defined by Visual Studio; we assume that ptrdiff_t will
+ * be a type that is a signed integer type of the same size as size_t.
+ */
+typedef ptrdiff_t ssize_t;
+#endif
+
+/*
+ * Avoid trying to cast negative values to unsigned types, or doing
+ * shifts of signed types, in order not to have the test program fail
+ * if we're building with undefined-behavior sanitizers enabled.
+ */
 int main()
 {
   char buf[100];
-  uint64_t t = (uint64_t)1 << 32;
+  unsigned int ui = sizeof(buf);
+  int i = sizeof(buf);
+  int64_t i64 = INT64_C(0x100000000);
+  uint64_t ui64 = UINT64_C(0x100000000);
 
-  snprintf(buf, sizeof(buf), "%zu", sizeof(buf));
+  snprintf(buf, sizeof(buf), "%zu", (size_t)ui);
   if (strncmp(buf, "100", sizeof(buf)))
     return 1;
 
-  snprintf(buf, sizeof(buf), "%zd", -sizeof(buf));
+  snprintf(buf, sizeof(buf), "%zd", (ssize_t)(-i));
   if (strncmp(buf, "-100", sizeof(buf)))
     return 2;
 
-  snprintf(buf, sizeof(buf), "%" PRId64, -t);
+  snprintf(buf, sizeof(buf), "%" PRId64, -i64);
   if (strncmp(buf, "-4294967296", sizeof(buf)))
     return 3;
 
-  snprintf(buf, sizeof(buf), "0o%" PRIo64, t);
+  snprintf(buf, sizeof(buf), "0o%" PRIo64, ui64);
   if (strncmp(buf, "0o40000000000", sizeof(buf)))
     return 4;
 
-  snprintf(buf, sizeof(buf), "0x%" PRIx64, t);
+  snprintf(buf, sizeof(buf), "0x%" PRIx64, ui64);
   if (strncmp(buf, "0x100000000", sizeof(buf)))
     return 5;
 
-  snprintf(buf, sizeof(buf), "%" PRIu64, t);
+  snprintf(buf, sizeof(buf), "%" PRIu64, ui64);
   if (strncmp(buf, "4294967296", sizeof(buf)))
     return 6;
 
@@ -7845,6 +7856,11 @@ fi
 
 
 rm -f os-proto.h
+    #
+    # MKDEP defaults to no-op (":") if we don't test whether the compiler
+    # supports generating dependencies
+    #
+    MKDEP=:
     if test "${LBL_CFLAGS+set}" = set; then
 	    V_CCOPT="$V_CCOPT ${LBL_CFLAGS}"
     fi
@@ -8066,6 +8082,59 @@ rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 	ac_c_werror_flag="$save_ac_c_werror_flag"
 
 
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports the -Wcomma option" >&5
+printf %s "checking whether the compiler supports the -Wcomma option... " >&6; }
+	save_CFLAGS="$CFLAGS"
+	CFLAGS="$CFLAGS -Wcomma"
+	#
+	# XXX - yes, this depends on the way AC_LANG_WERROR works,
+	# but no mechanism is provided to turn AC_LANG_WERROR on
+	# *and then turn it back off*, so that we *only* do it when
+	# testing compiler options - 15 years after somebody asked
+	# for it:
+	#
+	#     https://autoconf.gnu.narkive.com/gTAVmfKD/how-to-cancel-flags-set-by-ac-lang-werror
+	#
+	save_ac_c_werror_flag="$ac_c_werror_flag"
+	ac_c_werror_flag=yes
+	#
+	# We use AC_LANG_SOURCE() so that we can control the complete
+	# content of the program being compiled.  We do not, for example,
+	# want the default "int main()" that AC_LANG_PROGRAM() generates,
+	# as it will generate a warning with -Wold-style-definition, meaning
+	# that we would treat it as not working, as the test will fail if
+	# *any* error output, including a warning due to the flag we're
+	# testing, is generated; see
+	#
+	#    https://www.postgresql.org/message-id/2192993.1591682589%40sss.pgh.pa.us
+	#    https://www.postgresql.org/message-id/2192993.1591682589%40sss.pgh.pa.us
+	#
+	# This may, as per those two messages, be fixed in autoconf 2.70,
+	# but we only require 2.69 or newer for now.
+	#
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+int main(void) { return 0; }
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+		CFLAGS="$save_CFLAGS"
+		V_CCOPT="$V_CCOPT -Wcomma"
+
+else $as_nop
+
+		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+		CFLAGS="$save_CFLAGS"
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+	ac_c_werror_flag="$save_ac_c_werror_flag"
+
+
 	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports the -Wmissing-prototypes option" >&5
 printf %s "checking whether the compiler supports the -Wmissing-prototypes option... " >&6; }
 	save_CFLAGS="$CFLAGS"
@@ -9024,16 +9093,20 @@ printf "%s\n" "no" >&6; }
 	    # .devel file; why should the ABI for which we produce code
 	    # depend on .devel?
 	    #
+	    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to use an os-proto.h header" >&5
+printf %s "checking whether to use an os-proto.h header... " >&6; }
 	    os=`echo $host_os | sed -e 's/\([0-9][0-9]*\)[^0-9].*$/\1/'`
 	    name="lbl/os-$os.h"
 	    if test -f $name ; then
+		    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes, at \"$name\"" >&5
+printf "%s\n" "yes, at \"$name\"" >&6; }
 		    ln -s $name os-proto.h
 
 printf "%s\n" "#define HAVE_OS_PROTO_H 1" >>confdefs.h
 
 	    else
-		    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: can't find $name" >&5
-printf "%s\n" "$as_me: WARNING: can't find $name" >&2;}
+		    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 	    fi
     fi
 
@@ -9689,6 +9762,8 @@ test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
 ac_config_headers="$ac_config_headers config.h"
 
 
+
+
 ac_config_commands="$ac_config_commands .devel"
 
 ac_config_files="$ac_config_files Makefile tcpdump.1"
@@ -10192,7 +10267,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by tcpdump $as_me 4.99.5, which was
+This file was extended by tcpdump $as_me 4.99.6, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -10260,7 +10335,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-tcpdump config.status 4.99.5
+tcpdump config.status 4.99.6
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
@@ -10990,4 +11065,3 @@ printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2
 fi
 
 exit 0
-
diff --git a/contrib/tcpdump/configure.ac b/contrib/tcpdump/configure.ac
index 1f2e4d7854a0..b50fef3f8901 100644
--- a/contrib/tcpdump/configure.ac
+++ b/contrib/tcpdump/configure.ac
@@ -32,6 +32,11 @@ AC_LBL_C_INIT(V_CCOPT, V_INCLS)
 AC_LBL_C_INLINE
 
 AC_CHECK_HEADERS(rpc/rpc.h rpc/rpcent.h net/if.h)
+
+# On Linux, if Autoconf version >= 2.72 and GNU C Library version >= 2.34,
+# uncomment AC_SYS_YEAR2038_RECOMMENDED to ensure time_t is Y2038-safe.
+# (Can be done by autogen.sh)
+# AC_SYS_YEAR2038_RECOMMENDED
 #
 # Get the size of a void *, to know whether this is a 32-bit or 64-bit build.
 #
@@ -446,12 +451,6 @@ AC_CHECK_FUNCS(fork vfork)
 AC_CHECK_FUNCS(setlinebuf)
 
 #
-# Make sure we have snprintf(); we require it.
-#
-AC_CHECK_FUNC(snprintf,,
-    AC_MSG_ERROR([snprintf() is required but wasn't found]))
-
-#
 # It became apparent at some point that using a suitable C99 compiler does not
 # automatically mean snprintf(3) implementation in the libc supports all the
 # modifiers and specifiers used in the project, so let's test that before the
@@ -474,32 +473,50 @@ AC_RUN_IFELSE(
 #include <inttypes.h>
 #include <sys/types.h>
 
+#if defined(_WIN32) && !defined(_SSIZE_T_DEFINED)
+/*
+ * On UN*Xes, this is a signed integer type of the same size as size_t.
+ *
+ * It's not defined by Visual Studio; we assume that ptrdiff_t will
+ * be a type that is a signed integer type of the same size as size_t.
+ */
+typedef ptrdiff_t ssize_t;
+#endif
+
+/*
+ * Avoid trying to cast negative values to unsigned types, or doing
+ * shifts of signed types, in order not to have the test program fail
+ * if we're building with undefined-behavior sanitizers enabled.
+ */
 int main()
 {
   char buf[100];
-  uint64_t t = (uint64_t)1 << 32;
+  unsigned int ui = sizeof(buf);
+  int i = sizeof(buf);
+  int64_t i64 = INT64_C(0x100000000);
+  uint64_t ui64 = UINT64_C(0x100000000);
 
-  snprintf(buf, sizeof(buf), "%zu", sizeof(buf));
+  snprintf(buf, sizeof(buf), "%zu", (size_t)ui);
   if (strncmp(buf, "100", sizeof(buf)))
     return 1;
 
-  snprintf(buf, sizeof(buf), "%zd", -sizeof(buf));
+  snprintf(buf, sizeof(buf), "%zd", (ssize_t)(-i));
   if (strncmp(buf, "-100", sizeof(buf)))
     return 2;
 
-  snprintf(buf, sizeof(buf), "%" PRId64, -t);
+  snprintf(buf, sizeof(buf), "%" PRId64, -i64);
   if (strncmp(buf, "-4294967296", sizeof(buf)))
     return 3;
 
-  snprintf(buf, sizeof(buf), "0o%" PRIo64, t);
+  snprintf(buf, sizeof(buf), "0o%" PRIo64, ui64);
   if (strncmp(buf, "0o40000000000", sizeof(buf)))
     return 4;
 
-  snprintf(buf, sizeof(buf), "0x%" PRIx64, t);
+  snprintf(buf, sizeof(buf), "0x%" PRIx64, ui64);
   if (strncmp(buf, "0x100000000", sizeof(buf)))
     return 5;
 
-  snprintf(buf, sizeof(buf), "%" PRIu64, t);
+  snprintf(buf, sizeof(buf), "%" PRIu64, ui64);
   if (strncmp(buf, "4294967296", sizeof(buf)))
     return 6;
 
@@ -1276,6 +1293,13 @@ AC_SUBST(MAN_MISC_INFO)
 AC_PROG_INSTALL
 
 AC_CONFIG_HEADER(config.h)
+AH_TOP([
+#ifndef TCPDUMP_CONFIG_H_
+#define TCPDUMP_CONFIG_H_
+])
+AH_BOTTOM([
+#endif // TCPDUMP_CONFIG_H_
+])
 
 AC_CONFIG_COMMANDS([.devel],[[if test -f .devel; then
 	echo timestamp > stamp-h
diff --git a/contrib/tcpdump/diag-control.h b/contrib/tcpdump/diag-control.h
index 5e5a2dfe461a..ec50e679c9db 100644
--- a/contrib/tcpdump/diag-control.h
+++ b/contrib/tcpdump/diag-control.h
@@ -132,7 +132,7 @@
     #define DIAG_ON_STRICT_PROTOTYPES \
       DIAG_DO_PRAGMA(clang diagnostic pop)
   #endif
-#elif ND_IS_AT_LEAST_GNUC_VERSION(4,2)
+#elif ND_IS_AT_LEAST_GNUC_VERSION(4,6)
   /* GCC apparently doesn't complain about ORing enums together. */
 
   /*
@@ -145,21 +145,19 @@
   #define DIAG_ON_CAST_QUAL \
     DIAG_DO_PRAGMA(GCC diagnostic pop)
 
-  #if ND_IS_AT_LEAST_GNUC_VERSION(4,5)
-    /*
-     * GCC warns about unused return values if a function is marked as
-     * "warn about ignoring this function's return value".
-     *
-     * Clang appears to let you ignore a result without a warning by
-     * casting the function result to void, so we don't appear to
-     * need this for Clang.
-     */
-    #define DIAG_OFF_WARN_UNUSED_RESULT \
-      DIAG_DO_PRAGMA(GCC diagnostic push) \
-      DIAG_DO_PRAGMA(GCC diagnostic ignored "-Wunused-result")
-    #define DIAG_ON_WARN_UNUSED_RESULT \
-      DIAG_DO_PRAGMA(GCC diagnostic pop)
-  #endif
+  /*
+   * GCC warns about unused return values if a function is marked as
+   * "warn about ignoring this function's return value".
+   *
+   * Clang appears to let you ignore a result without a warning by
+   * casting the function result to void, so we don't appear to
+   * need this for Clang.
+   */
+  #define DIAG_OFF_WARN_UNUSED_RESULT \
+    DIAG_DO_PRAGMA(GCC diagnostic push) \
+    DIAG_DO_PRAGMA(GCC diagnostic ignored "-Wunused-result")
+  #define DIAG_ON_WARN_UNUSED_RESULT \
+    DIAG_DO_PRAGMA(GCC diagnostic pop)
 
   /*
    * Suppress deprecation warnings.
diff --git a/contrib/tcpdump/doc/README.NetBSD.md b/contrib/tcpdump/doc/README.NetBSD.md
deleted file mode 100644
index b49be0efad5d..000000000000
--- a/contrib/tcpdump/doc/README.NetBSD.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# Compiling tcpdump on NetBSD
-
-NetBSD has two libpcap libraries: one that is always installed as a part of the
-OS and another that can be installed as a package from pkgsrc.  Also the usual
-method of compiling with the upstream libpcap in `../libpcap` is available.
-
-GCC, Clang, Autoconf and CMake are presumed to work, if this is not the case,
-please report a bug as explained in the
-[guidelines for contributing](../CONTRIBUTING.md).
-
-## NetBSD 9.3
-
-* Upstream libpcap works.
-* OS libpcap works.
-* pkgsrc libpcap works.
-
-## NetBSD 9.2, 9.1 and 9.0
-
-* Upstream libpcap works.
-* OS libpcap cannot be used due to
-  [this bug](https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=55901).
-
diff --git a/contrib/tcpdump/doc/README.aix.md b/contrib/tcpdump/doc/README.aix.md
deleted file mode 100644
index 3bfa550be10a..000000000000
--- a/contrib/tcpdump/doc/README.aix.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Compiling tcpdump on AIX
-
-* Autoconf works everywhere.
-
-## AIX 7.1/POWER7
-
-* Only local libpcap is suitable.
-* CMake 3.16.0 does not work.
-* GCC 8.3.0 and XL C 12.1.0.0 work.
-* System m4 does not work, GNU m4 1.4.17 works.
-
-## AIX 7.2/POWER8
-
-* Only local libpcap is suitable.
-* GCC 7.2.0 and XL C 13.1.3.6 work.
-* System m4 does not work, GNU m4 1.4.17 works.
-
diff --git a/contrib/tcpdump/doc/README.haiku.md b/contrib/tcpdump/doc/README.haiku.md
deleted file mode 100644
index f9341523b7b2..000000000000
--- a/contrib/tcpdump/doc/README.haiku.md
+++ /dev/null
@@ -1,33 +0,0 @@
-# Compiling tcpdump on Haiku
-
-## 64-bit x86 R1/beta4
-
-* Both system and local libpcap are suitable.
-* Autoconf 2.71 works.
-* CMake 3.24.2 works.
-* GCC 11.2.0 works.
-* Clang 12.0.1 works with the latest llvm12_clang-12.0.1-5 version.
-
-The following command will install respective non-default packages:
-```
-pkgman install libpcap_devel cmake llvm12_clang
-```
-
-For reference, the tests were done using a system installed from
-`haiku-r1beta4-x86_64-anyboot.iso`.
-
-## 32-bit x86 R1/beta4
-
-* Both system and local libpcap are suitable.
-* Autoconf 2.71 works.
-* CMake 3.24.2 works.
-* GCC 11.2.0 works.
-* Clang does not work.
-
-The following command will install respective non-default packages:
-```
-pkgman install libpcap_x86_devel cmake_x86
-```
-
-For reference, the tests were done using a system installed from
-`haiku-r1beta4-x86_gcc2h-anyboot.iso`.
diff --git a/contrib/tcpdump/doc/README.solaris.md b/contrib/tcpdump/doc/README.solaris.md
deleted file mode 100644
index 86571e21ae11..000000000000
--- a/contrib/tcpdump/doc/README.solaris.md
+++ /dev/null
@@ -1,46 +0,0 @@
-# Compiling tcpdump on Solaris and related OSes
-
-* Autoconf works everywhere.
-
-## OmniOS r151042/AMD64
-
-* Both system and local libpcap are suitable.
-* CMake 3.23.1 works.
-* GCC 11.2.0 and Clang 14.0.3 work.
-
-## OpenIndiana 2021.04/AMD64
-
-* Both system and local libpcap are suitable.
-* CMake 3.21.1 works.
-* GCC 7.5.0 and GCC 10.3.0 work, Clang 9.0.1 works.
-
-For reference, the tests were done using a system installed from
-`OI-hipster-text-20210430.iso` plus the following packages:
-```shell
-xargs -L1 pkg install <<ENDOFTEXT
-developer/build/autoconf
-developer/build/cmake
-developer/gcc-10
-developer/clang-90
-ENDOFTEXT
-```
-
-## Oracle Solaris 11.4.42/AMD64
-
-* Both system and local libpcap are suitable.
-* GCC 11.2 and Clang 11.0 work.
-
-For reference, the tests were done on a VM booted from `sol-11_4-vbox.ova`
-and updated to 11.4.42.111.0 plus the following packages:
-```shell
-xargs -L1 pkg install <<ENDOFTEXT
-developer/build/autoconf
-developer/gcc
-developer/llvm/clang
-ENDOFTEXT
-```
-
-## Solaris 9
-
-This version of this OS is not supported because the snprintf(3) implementation
-in its libc is not suitable.
diff --git a/contrib/tcpdump/extract.h b/contrib/tcpdump/extract.h
index c1b486d37a7e..3abffbca2177 100644
--- a/contrib/tcpdump/extract.h
+++ b/contrib/tcpdump/extract.h
@@ -415,7 +415,7 @@ EXTRACT_IPV4_TO_NETWORK_ORDER(const void *p)
 	             ((uint64_t)(*((const uint8_t *)(p) + 2)) << 16) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 3)) << 8) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 4)) << 0))) : \
-	  ((int64_t)(INT64_T_CONSTANT(0xFFFFFF0000000000U) | \
+	  ((int64_t)(UINT64_C(0xFFFFFF0000000000) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 0)) << 32) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 1)) << 24) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 2)) << 16) | \
@@ -438,7 +438,7 @@ EXTRACT_IPV4_TO_NETWORK_ORDER(const void *p)
 	              ((uint64_t)(*((const uint8_t *)(p) + 3)) << 16) | \
 	              ((uint64_t)(*((const uint8_t *)(p) + 4)) << 8) | \
 	              ((uint64_t)(*((const uint8_t *)(p) + 5)) << 0))) : \
-	  ((int64_t)(INT64_T_CONSTANT(0xFFFFFFFF00000000U) | \
+	  ((int64_t)(UINT64_C(0xFFFFFFFF00000000) | \
 	              ((uint64_t)(*((const uint8_t *)(p) + 0)) << 40) | \
 	              ((uint64_t)(*((const uint8_t *)(p) + 1)) << 32) | \
 	              ((uint64_t)(*((const uint8_t *)(p) + 2)) << 24) | \
@@ -464,7 +464,7 @@ EXTRACT_IPV4_TO_NETWORK_ORDER(const void *p)
 	             ((uint64_t)(*((const uint8_t *)(p) + 4)) << 16) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 5)) << 8) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 6)) << 0))) : \
-	    ((int64_t)(INT64_T_CONSTANT(0xFFFFFFFFFF000000U) | \
+	    ((int64_t)(UINT64_C(0xFFFFFFFFFF000000) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 0)) << 48) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 1)) << 40) | \
 	             ((uint64_t)(*((const uint8_t *)(p) + 2)) << 32) | \
diff --git a/contrib/tcpdump/ipproto.c b/contrib/tcpdump/ipproto.c
index c34d1e2284ed..63319f5767f3 100644
--- a/contrib/tcpdump/ipproto.c
+++ b/contrib/tcpdump/ipproto.c
@@ -21,7 +21,7 @@
 #include "ipproto.h"
 
 const struct tok ipproto_values[] = {
-    { IPPROTO_HOPOPTS, "Options" },
+    { IPPROTO_HOPOPTS, "HBH" },
     { IPPROTO_ICMP, "ICMP" },
     { IPPROTO_IGMP, "IGMP" },
     { IPPROTO_IPV4, "IPIP" },
@@ -39,6 +39,7 @@ const struct tok ipproto_values[] = {
     { IPPROTO_AH, "AH" },
     { IPPROTO_MOBILE, "Mobile IP" },
     { IPPROTO_ICMPV6, "ICMPv6" },
+    { IPPROTO_DSTOPTS, "DSTOPT" },
     { IPPROTO_MOBILITY_OLD, "Mobile IP (old)" },
     { IPPROTO_EIGRP, "EIGRP" },
     { IPPROTO_OSPF, "OSPF" },
diff --git a/contrib/tcpdump/ipproto.h b/contrib/tcpdump/ipproto.h
index c8ce6673c1c4..30be911eba5e 100644
--- a/contrib/tcpdump/ipproto.h
+++ b/contrib/tcpdump/ipproto.h
@@ -32,7 +32,7 @@
  *
  * From:
  *	@(#)in.h	8.3 (Berkeley) 1/3/94
- * $FreeBSD: projects/clang400-import/contrib/tcpdump/ipproto.h 276788 2015-01-07 19:55:18Z delphij $
+ * $FreeBSD: src/sys/netinet/in.h,v 1.38.2.3 1999/08/29 16:29:34 peter Exp $
  */
 
 extern const struct tok ipproto_values[];
diff --git a/contrib/tcpdump/missing/getopt_long.h b/contrib/tcpdump/missing/getopt_long.h
index a63f490006c7..af97965e4f73 100644
--- a/contrib/tcpdump/missing/getopt_long.h
+++ b/contrib/tcpdump/missing/getopt_long.h
@@ -1,5 +1,5 @@
 /*	$NetBSD: getopt.h,v 1.4 2000/07/07 10:43:54 ad Exp $	*/
-/*	$FreeBSD: projects/clang400-import/contrib/tcpdump/getopt_long.h 276788 2015-01-07 19:55:18Z delphij $ */
+/*	$FreeBSD$ */
 
 /*-
  * Copyright (c) 2000 The NetBSD Foundation, Inc.
diff --git a/contrib/tcpdump/missing/snprintf.c b/contrib/tcpdump/missing/snprintf.c
deleted file mode 100644
index 52eb9a61ca66..000000000000
--- a/contrib/tcpdump/missing/snprintf.c
+++ /dev/null
@@ -1,508 +0,0 @@
-/*
- * Copyright (c) 1995-1999 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdarg.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-#include <sys/types.h>
-
-#include "netdissect.h"
-
-enum format_flags {
-    minus_flag     =  1,
-    plus_flag      =  2,
-    space_flag     =  4,
-    alternate_flag =  8,
-    zero_flag      = 16
-};
-
-/*
- * Common state
- */
-
-struct state {
-  unsigned char *str;
-  unsigned char *s;
-  unsigned char *theend;
-  size_t sz;
-  size_t max_sz;
-  int (*append_char)(struct state *, unsigned char);
-  int (*reserve)(struct state *, size_t);
-  /* XXX - methods */
-};
-
-#if 0
-static int
-as_reserve (struct state *state, size_t n)
-{
-  if (state->s + n > state->theend) {
-    int off = state->s - state->str;
-    unsigned char *tmp;
-
-    if (state->max_sz && state->sz >= state->max_sz)
-      return 1;
-
-    state->sz = max(state->sz * 2, state->sz + n);
-    if (state->max_sz)
-      state->sz = min(state->sz, state->max_sz);
-    tmp = realloc (state->str, state->sz);
-    if (tmp == NULL)
-      return 1;
-    state->str = tmp;
-    state->s = state->str + off;
-    state->theend = state->str + state->sz - 1;
-  }
-  return 0;
-}
-
-static int
-as_append_char (struct state *state, unsigned char c)
-{
-  if(as_reserve (state, 1))
-    return 1;
-  else {
-    *state->s++ = c;
-    return 0;
-  }
-}
-#endif
-
-static int
-append_number(struct state *state,
-	      unsigned long num, unsigned base, char *rep,
-	      int width, int prec, int flags, int minusp)
-{
-  int len = 0;
-  int i;
-
-  /* given precision, ignore zero flag */
-  if(prec != -1)
-    flags &= ~zero_flag;
-  else
-    prec = 1;
-  /* zero value with zero precision -> "" */
-  if(prec == 0 && num == 0)
-    return 0;
-  do{
-    if((*state->append_char)(state, rep[num % base]))
-      return 1;
-    len++;
-    num /= base;
-  }while(num);
-  prec -= len;
-  /* pad with prec zeros */
-  while(prec-- > 0){
-    if((*state->append_char)(state, '0'))
-      return 1;
-    len++;
-  }
-  /* add length of alternate prefix (added later) to len */
-  if(flags & alternate_flag && (base == 16 || base == 8))
-    len += base / 8;
-  /* pad with zeros */
-  if(flags & zero_flag){
-    width -= len;
-    if(minusp || (flags & space_flag) || (flags & plus_flag))
-      width--;
-    while(width-- > 0){
-      if((*state->append_char)(state, '0'))
-	return 1;
-      len++;
-    }
-  }
-  /* add alternate prefix */
-  if(flags & alternate_flag && (base == 16 || base == 8)){
-    if(base == 16)
-      if((*state->append_char)(state, rep[10] + 23)) /* XXX */
-	return 1;
-    if((*state->append_char)(state, '0'))
-      return 1;
-  }
-  /* add sign */
-  if(minusp){
-    if((*state->append_char)(state, '-'))
-      return 1;
-    len++;
-  } else if(flags & plus_flag) {
-    if((*state->append_char)(state, '+'))
-      return 1;
-    len++;
-  } else if(flags & space_flag) {
-    if((*state->append_char)(state, ' '))
-      return 1;
-    len++;
-  }
-  if(flags & minus_flag)
-    /* swap before padding with spaces */
-    for(i = 0; i < len / 2; i++){
-      char c = state->s[-i-1];
-      state->s[-i-1] = state->s[-len+i];
-      state->s[-len+i] = c;
-    }
-  width -= len;
-  while(width-- > 0){
-    if((*state->append_char)(state,  ' '))
-      return 1;
-    len++;
-  }
-  if(!(flags & minus_flag))
-    /* swap after padding with spaces */
-    for(i = 0; i < len / 2; i++){
-      char c = state->s[-i-1];
-      state->s[-i-1] = state->s[-len+i];
-      state->s[-len+i] = c;
-    }
-
-  return 0;
-}
-
-static int
-append_string (struct state *state,
-	       unsigned char *arg,
-	       int width,
-	       int prec,
-	       int flags)
-{
-  if(prec != -1)
-    width -= prec;
-  else
-    width -= strlen((char *)arg);
-  if(!(flags & minus_flag))
-    while(width-- > 0)
-      if((*state->append_char) (state, ' '))
-	return 1;
-  if (prec != -1) {
-    while (*arg && prec--)
-      if ((*state->append_char) (state, *arg++))
-	return 1;
-  } else {
-    while (*arg)
-      if ((*state->append_char) (state, *arg++))
-	return 1;
-  }
-  if(flags & minus_flag)
-    while(width-- > 0)
-      if((*state->append_char) (state, ' '))
-	return 1;
-  return 0;
-}
-
-static int
-append_char(struct state *state,
-	    unsigned char arg,
-	    int width,
-	    int flags)
-{
-  while(!(flags & minus_flag) && --width > 0)
-    if((*state->append_char) (state, ' '))
-      return 1;
-
-  if((*state->append_char) (state, arg))
-    return 1;
-  while((flags & minus_flag) && --width > 0)
-    if((*state->append_char) (state, ' '))
-      return 1;
-
-  return 0;
-}
-
-/*
- * This can't be made into a function...
- */
-
-#define PARSE_INT_FORMAT(res, arg, unsig) \
-if (long_flag) \
-     res = (unsig long)va_arg(arg, unsig long); \
-else if (short_flag) \
-     res = (unsig short)va_arg(arg, unsig int); \
-else \
-     res = (unsig int)va_arg(arg, unsig int)
-
-/*
- * zyxprintf - return 0 or -1
- */
-
-static int
-xyzprintf (struct state *state, const char *char_format, va_list ap)
-{
-  const unsigned char *format = (const unsigned char *)char_format;
-  unsigned char c;
-
-  while((c = *format++)) {
-    if (c == '%') {
-      int flags      = 0;
-      int width      = 0;
-      int prec       = -1;
-      int long_flag  = 0;
-      int short_flag = 0;
-
-      /* flags */
-      while((c = *format++)){
-	if(c == '-')
-	  flags |= minus_flag;
-	else if(c == '+')
-	  flags |= plus_flag;
-	else if(c == ' ')
-	  flags |= space_flag;
-	else if(c == '#')
-	  flags |= alternate_flag;
-	else if(c == '0')
-	  flags |= zero_flag;
-	else
-	  break;
-      }
-
-      if((flags & space_flag) && (flags & plus_flag))
-	flags ^= space_flag;
-
-      if((flags & minus_flag) && (flags & zero_flag))
-	flags ^= zero_flag;
-
-      /* width */
-      if (isdigit(c))
-	do {
-	  width = width * 10 + c - '0';
-	  c = *format++;
-	} while(isdigit(c));
-      else if(c == '*') {
-	width = va_arg(ap, int);
-	c = *format++;
-      }
-
-      /* precision */
-      if (c == '.') {
-	prec = 0;
-	c = *format++;
-	if (isdigit(c))
-	  do {
-	    prec = prec * 10 + c - '0';
-	    c = *format++;
-	  } while(isdigit(c));
-	else if (c == '*') {
-	  prec = va_arg(ap, int);
-	  c = *format++;
-	}
-      }
-
-      /* size */
-
-      if (c == 'h') {
-	short_flag = 1;
-	c = *format++;
-      } else if (c == 'l') {
-	long_flag = 1;
-	c = *format++;
-      }
-
-      switch (c) {
-      case 'c' :
-	if(append_char(state, va_arg(ap, int), width, flags))
-	  return -1;
-	break;
-      case 's' :
-	if (append_string(state,
-			  va_arg(ap, unsigned char*),
-			  width,
-			  prec,
-			  flags))
-	  return -1;
-	break;
-      case 'd' :
-      case 'i' : {
-	long arg;
-	unsigned long num;
-	int minusp = 0;
-
-	PARSE_INT_FORMAT(arg, ap, signed);
-
-	if (arg < 0) {
-	  minusp = 1;
-	  num = -arg;
-	} else
-	  num = arg;
-
-	if (append_number (state, num, 10, "0123456789",
-			   width, prec, flags, minusp))
-	  return -1;
-	break;
-      }
-      case 'u' : {
-	unsigned long arg;
-
-	PARSE_INT_FORMAT(arg, ap, unsigned);
-
-	if (append_number (state, arg, 10, "0123456789",
-			   width, prec, flags, 0))
-	  return -1;
-	break;
-      }
-      case 'o' : {
-	unsigned long arg;
-
-	PARSE_INT_FORMAT(arg, ap, unsigned);
-
-	if (append_number (state, arg, 010, "01234567",
-			   width, prec, flags, 0))
-	  return -1;
-	break;
-      }
-      case 'x' : {
-	unsigned long arg;
-
-	PARSE_INT_FORMAT(arg, ap, unsigned);
-
-	if (append_number (state, arg, 0x10, "0123456789abcdef",
-			   width, prec, flags, 0))
-	  return -1;
-	break;
-      }
-      case 'X' :{
-	unsigned long arg;
-
-	PARSE_INT_FORMAT(arg, ap, unsigned);
-
-	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
-			   width, prec, flags, 0))
-	  return -1;
-	break;
-      }
-      case 'p' : {
-	unsigned long arg = (unsigned long)va_arg(ap, void*);
-
-	if (append_number (state, arg, 0x10, "0123456789ABCDEF",
-			   width, prec, flags, 0))
-	  return -1;
-	break;
-      }
-      case 'n' : {
-	int *arg = va_arg(ap, int *);
-	*arg = state->s - state->str;
-	break;
-      }
-      case '\0' :
-	  --format;
-	  /* FALLTHROUGH */
-      case '%' :
-	if ((*state->append_char)(state, c))
-	  return -1;
-	break;
-      default :
-	if (   (*state->append_char)(state, '%')
-	    || (*state->append_char)(state, c))
-	  return -1;
-	break;
-      }
-    } else
-      if ((*state->append_char) (state, c))
-	return -1;
-  }
-  return 0;
-}
-
-#if 0
-#ifndef HAVE_ASPRINTF
-int
-asprintf (char **ret, const char *format, ...)
-{
-  va_list args;
-  int val;
-
-  va_start(args, format);
-  val = vasprintf (ret, format, args);
-
-#ifdef PARANOIA
-  {
-    int ret2;
-    char *tmp;
-    tmp = malloc (val + 1);
-    if (tmp == NULL)
-      abort ();
-
-    ret2 = vsprintf (tmp, format, args);
-    if (val != ret2 || strcmp(*ret, tmp))
-      abort ();
-    free (tmp);
-  }
-#endif
-
-  va_end(args);
-  return val;
-}
-#endif
-
-#ifndef HAVE_VASNPRINTF
-int
-nd_vasnprintf (char **ret, size_t max_sz, const char *format, va_list args)
-{
-  int st;
-  size_t len;
-  struct state state;
-
-  state.max_sz = max_sz;
-  state.sz     = 1;
-  state.str    = malloc(state.sz);
-  if (state.str == NULL) {
-    *ret = NULL;
-    return -1;
-  }
-  state.s = state.str;
-  state.theend = state.s + state.sz - 1;
-  state.append_char = as_append_char;
-  state.reserve     = as_reserve;
-
-  st = xyzprintf (&state, format, args);
-  if (st) {
-    free (state.str);
-    *ret = NULL;
-    return -1;
-  } else {
-    char *tmp;
-
-    *state.s = '\0';
-    len = state.s - state.str;
-    tmp = realloc (state.str, len+1);
-    if (tmp == NULL) {
-      free (state.str);
-      *ret = NULL;
-      return -1;
-    }
-    *ret = tmp;
-    return len;
-  }
-}
-#endif
-#endif
diff --git a/contrib/tcpdump/netdissect-stdinc.h b/contrib/tcpdump/netdissect-stdinc.h
index e81c90bd590b..f4e5fb98abed 100644
--- a/contrib/tcpdump/netdissect-stdinc.h
+++ b/contrib/tcpdump/netdissect-stdinc.h
@@ -139,11 +139,6 @@
    * strtoint64_t().
    */
   #define strtoint64_t	strtoll
-
-  /*
-   * And we have LL as a suffix for constants, so use that.
-   */
-  #define INT64_T_CONSTANT(constant)	(constant##LL)
 #else
   /*
    * Non-Microsoft compiler.
@@ -151,11 +146,6 @@
    * XXX - should we use strtoll or should we use _strtoi64()?
    */
   #define strtoint64_t		strtoll
-
-  /*
-   * Assume LL works.
-   */
-  #define INT64_T_CONSTANT(constant)	(constant##LL)
 #endif
 
 #ifdef _MSC_VER
@@ -251,11 +241,6 @@ typedef char *caddr_t;
  * Assume all UN*Xes have strtoll(), and use it for strtoint64_t().
  */
 #define strtoint64_t	strtoll
-
-/*
- * Assume LL works.
- */
-#define INT64_T_CONSTANT(constant)	(constant##LL)
 #endif /* _WIN32 */
 
 /*
diff --git a/contrib/tcpdump/netdissect.c b/contrib/tcpdump/netdissect.c
index e78ccbc72b52..5b1236a0bbc6 100644
--- a/contrib/tcpdump/netdissect.c
+++ b/contrib/tcpdump/netdissect.c
@@ -79,7 +79,7 @@ nd_init(char *errbuf, size_t errbuf_size)
 }
 
 /*
- * Clean up anything that ndo_init() did.
+ * Clean up anything that nd_init() did.
  */
 void
 nd_cleanup(void)
diff --git a/contrib/tcpdump/netdissect.h b/contrib/tcpdump/netdissect.h
index 95d17b3db8b7..52dfa878c4a9 100644
--- a/contrib/tcpdump/netdissect.h
+++ b/contrib/tcpdump/netdissect.h
@@ -208,6 +208,7 @@ struct netdissect_options {
   int ndo_bflag;		/* print 4 byte ASes in ASDOT notation */
   int ndo_eflag;		/* print ethernet header */
   int ndo_fflag;		/* don't translate "foreign" IP address */
+  int ndo_gflag;		/* don't split IP output into two lines in verbose mode */
   int ndo_Kflag;		/* don't check IP, TCP or UDP checksums */
   int ndo_nflag;		/* leave addresses as numbers */
   int ndo_Nflag;		/* remove domains from printed host names */
@@ -374,9 +375,15 @@ NORETURN void nd_trunc_longjmp(netdissect_options *ndo);
 
 /* Bail out if "l" bytes from "p" were not captured */
 #ifdef ND_LONGJMP_FROM_TCHECK
-#define ND_TCHECK_LEN(p, l) if (!ND_TTEST_LEN(p, l)) nd_trunc_longjmp(ndo)
+#define ND_TCHECK_LEN(p, l) \
+do { \
+if (!ND_TTEST_LEN(p, l)) nd_trunc_longjmp(ndo); \
+} while (0)
 #else
-#define ND_TCHECK_LEN(p, l) if (!ND_TTEST_LEN(p, l)) goto trunc
+#define ND_TCHECK_LEN(p, l) \
+do { \
+if (!ND_TTEST_LEN(p, l)) goto trunc; \
+} while (0)
 #endif
 
 /* Bail out if "*(p)" was not captured */
@@ -398,10 +405,12 @@ NORETURN void nd_trunc_longjmp(netdissect_options *ndo);
  * a custom message, format %u
  */
 #define ND_ICHECKMSG_U(message, expression_1, operator, expression_2) \
+do { \
 if ((expression_1) operator (expression_2)) { \
 ND_PRINT(" [%s %u %s %u]", (message), (expression_1), (#operator), (expression_2)); \
 goto invalid; \
-}
+} \
+} while (0)
 
 /*
  * Check (expression_1 operator expression_2) for invalid packet with
@@ -415,10 +424,12 @@ ND_ICHECKMSG_U((#expression_1), (expression_1), operator, (expression_2))
  * a custom message, format %zu
  */
 #define ND_ICHECKMSG_ZU(message, expression_1, operator, expression_2) \
+do { \
 if ((expression_1) operator (expression_2)) { \
 ND_PRINT(" [%s %u %s %zu]", (message), (expression_1), (#operator), (expression_2)); \
 goto invalid; \
-}
+} \
+} while (0)
 
 /*
  * Check (expression_1 operator expression_2) for invalid packet with
@@ -644,8 +655,8 @@ extern void geonet_print(netdissect_options *, const u_char *, u_int, const stru
 extern void gre_print(netdissect_options *, const u_char *, u_int);
 extern int hbhopt_process(netdissect_options *, const u_char *, int *, uint32_t *);
 extern void hex_and_ascii_print(netdissect_options *, const char *, const u_char *, u_int);
-extern void hex_print(netdissect_options *, const char *ident, const u_char *cp, u_int);
-extern void hex_print_with_offset(netdissect_options *, const char *ident, const u_char *cp, u_int, u_int);
+extern void hex_print(netdissect_options *, const char *indent, const u_char *cp, u_int);
+extern void hex_print_with_offset(netdissect_options *, const char *indent, const u_char *cp, u_int, u_int);
 extern void hncp_print(netdissect_options *, const u_char *, u_int);
 extern void hsrp_print(netdissect_options *, const u_char *, u_int);
 extern void http_print(netdissect_options *, const u_char *, u_int);
@@ -708,7 +719,6 @@ extern void ospf6_print(netdissect_options *, const u_char *, u_int);
 extern void ospf_print(netdissect_options *, const u_char *, u_int, const u_char *);
 extern int ospf_grace_lsa_print(netdissect_options *, const u_char *, u_int);
 extern int ospf_te_lsa_print(netdissect_options *, const u_char *, u_int);
-extern void otv_print(netdissect_options *, const u_char *, u_int);
 extern void pfsync_ip_print(netdissect_options *, const u_char *, u_int);
 extern void pfsync_if_print(netdissect_options *, const struct pcap_pkthdr *, const u_char *);
 extern void pgm_print(netdissect_options *, const u_char *, u_int, const u_char *);
diff --git a/contrib/tcpdump/nfs.h b/contrib/tcpdump/nfs.h
index 87ba1a7184e8..e4f21340c3d8 100644
--- a/contrib/tcpdump/nfs.h
+++ b/contrib/tcpdump/nfs.h
@@ -293,7 +293,7 @@ struct nfsv3_spec {
 typedef	struct nfsv3_spec	nfsv3spec;
 
 /*
- * File attributes and setable attributes. These structures cover both
+ * File attributes and settable attributes. These structures cover both
  * NFS version 2 and the version 3 protocol. Note that the union is only
  * used so that one pointer can refer to both variants. These structures
  * go out on the wire and must be densely packed, so no quad data types
diff --git a/contrib/tcpdump/ntp.c b/contrib/tcpdump/ntp.c
index 967644e0e1b9..d1825664bbc7 100644
--- a/contrib/tcpdump/ntp.c
+++ b/contrib/tcpdump/ntp.c
@@ -26,10 +26,14 @@
 
 #include "extract.h"
 
-#define	JAN_1970	INT64_T_CONSTANT(2208988800)	/* 1970 - 1900 in seconds */
+/* NTP epoch 1: January 1, 1900, 00:00:00 UTC. */
+#define DIFF_1970_1900 INT64_C(2208988800) /* 1970 - 1900 in seconds */
+/* RFC4330 - 3. NTP Timestamp Format - 6h 28m 16s UTC on 7 February 2036 */
+/* NTP epoch 2: February 7, 2036, 06:28:16 UTC. */
+#define DIFF_2036_1970 INT64_C(2085978496) /* 2036 - 1970 in seconds */
 
 void
-p_ntp_time(netdissect_options *ndo,
+p_ntp_time_fmt(netdissect_options *ndo, const char *fmt,
 	   const struct l_fixedpt *lfp)
 {
 	uint32_t i;
@@ -50,23 +54,33 @@ p_ntp_time(netdissect_options *ndo,
 	 * print the UTC time in human-readable format.
 	 */
 	if (i) {
-	    int64_t seconds_64bit = (int64_t)i - JAN_1970;
+	    int64_t seconds_64bit;
 	    time_t seconds;
 	    char time_buf[128];
 	    const char *time_string;
 
+	    if ((i & 0x80000000) != 0)
+		seconds_64bit = (int64_t)i - DIFF_1970_1900;
+	    else
+		seconds_64bit = (int64_t)i + DIFF_2036_1970;
 	    seconds = (time_t)seconds_64bit;
 	    if (seconds != seconds_64bit) {
 		/*
 		 * It doesn't fit into a time_t, so we can't hand it
 		 * to gmtime.
 		 */
-		time_string = "[Time is too large to fit into a time_t]";
+		time_string = "[timestamp overflow]";
 	    } else {
-		/* use ISO 8601 (RFC3339) format */
 		time_string = nd_format_time(time_buf, sizeof (time_buf),
-		  "%Y-%m-%dT%H:%M:%SZ", gmtime(&seconds));
+					     fmt, gmtime(&seconds));
 	    }
 	    ND_PRINT(" (%s)", time_string);
 	}
 }
+
+void
+p_ntp_time(netdissect_options *ndo, const struct l_fixedpt *lfp)
+{
+	/* use ISO 8601 (RFC3339) format */
+	p_ntp_time_fmt(ndo, "%Y-%m-%dT%H:%M:%SZ", lfp);
+}
diff --git a/contrib/tcpdump/ntp.h b/contrib/tcpdump/ntp.h
index 78644e282156..0fe4214281a2 100644
--- a/contrib/tcpdump/ntp.h
+++ b/contrib/tcpdump/ntp.h
@@ -51,4 +51,6 @@ struct s_fixedpt {
 	nd_uint16_t fraction;
 };
 
+void p_ntp_time_fmt(netdissect_options *, const char *fmt,
+                    const struct l_fixedpt *);
 void p_ntp_time(netdissect_options *, const struct l_fixedpt *);
diff --git a/contrib/tcpdump/parsenfsfh.c b/contrib/tcpdump/parsenfsfh.c
index 15e9bcd01634..d20088f13c60 100644
--- a/contrib/tcpdump/parsenfsfh.c
+++ b/contrib/tcpdump/parsenfsfh.c
@@ -329,20 +329,9 @@ Parse_fh(netdissect_options *ndo, const unsigned char *fh, u_int len,
 
 	case FHT_VMSUCX:
 	    /* No numeric file system ID, so hash on the device-name */
-	    if (sizeof(*fsidp) >= 14) {
-		if (sizeof(*fsidp) > 14)
-		    memset((char *)fsidp, 0, sizeof(*fsidp));
-		/* just use the whole thing */
-		memcpy((char *)fsidp, (const char *)fh, 14);
-	    } else {
-		uint32_t tempa[4];	/* at least 16 bytes, maybe more */
-
-		memset((char *)tempa, 0, sizeof(tempa));
-		memcpy((char *)tempa, (const char *)fh, 14); /* ensure alignment */
-		fsidp->Fsid_dev.Minor = tempa[0] + (tempa[1]<<1);
-		fsidp->Fsid_dev.Major = tempa[2] + (tempa[3]<<1);
-		fsidp->fsid_code = 0;
-	    }
+	    memset((char *)fsidp, 0, sizeof(*fsidp));
+	    /* just use the whole thing */
+	    memcpy((char *)fsidp, (const char *)fh, 14);
 
 	    /* VMS file ID is: (RVN, FidHi, FidLo) */
 	    *inop = (((uint32_t) GET_U_1(fhp + 26)) << 24) |
diff --git a/contrib/tcpdump/print-802_11.c b/contrib/tcpdump/print-802_11.c
index 31c23bfca02f..45350ab23f9d 100644
--- a/contrib/tcpdump/print-802_11.c
+++ b/contrib/tcpdump/print-802_11.c
@@ -2282,7 +2282,7 @@ ieee802_11_if_print(netdissect_options *ndo,
 }
 
 
-/* $FreeBSD: projects/clang400-import/contrib/tcpdump/print-802_11.c 276788 2015-01-07 19:55:18Z delphij $ */
+/* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp  */
 
 /*-
diff --git a/contrib/tcpdump/print-arista.c b/contrib/tcpdump/print-arista.c
index 6d00956aeeb0..0ec04889b6a2 100644
--- a/contrib/tcpdump/print-arista.c
+++ b/contrib/tcpdump/print-arista.c
@@ -8,6 +8,7 @@
 
 #include "netdissect.h"
 #include "extract.h"
+#include "timeval-operations.h"
 
 /*
 
@@ -86,17 +87,17 @@ static const struct tok hw_info_str[] = {
 };
 
 static inline void
-arista_print_date_hms_time(netdissect_options *ndo, uint32_t seconds,
-		uint32_t nanoseconds)
+arista_print_date_hms_time(netdissect_options *ndo, const uint32_t seconds,
+		const uint32_t nanoseconds)
 {
-	time_t ts;
+	const time_t ts = seconds;
 	char buf[sizeof("-yyyyyyyyyy-mm-dd hh:mm:ss")];
 
-	ts = seconds + (nanoseconds / 1000000000);
-	nanoseconds %= 1000000000;
 	ND_PRINT("%s.%09u",
 	    nd_format_time(buf, sizeof(buf), "%Y-%m-%d %H:%M:%S",
 	       gmtime(&ts)), nanoseconds);
+	if (nanoseconds > ND_NANO_PER_SEC - 1)
+		ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
 }
 
 int
@@ -117,7 +118,7 @@ arista_ethertype_print(netdissect_options *ndo, const u_char *bp, u_int len _U_)
 
 	// TapAgg Header Timestamping
 	if (subTypeId == ARISTA_SUBTYPE_TIMESTAMP) {
-		uint64_t seconds;
+		uint32_t seconds;
 		uint32_t nanoseconds;
 		uint8_t ts_timescale = GET_U_1(bp);
 		bp += 1;
@@ -147,9 +148,9 @@ arista_ethertype_print(netdissect_options *ndo, const u_char *bp, u_int len _U_)
 		case FORMAT_48BIT:
 			seconds = GET_BE_U_2(bp);
 			nanoseconds = GET_BE_U_4(bp + 2);
-			seconds += nanoseconds / 1000000000;
-			nanoseconds %= 1000000000;
-			ND_PRINT("%" PRIu64 ".%09u", seconds, nanoseconds);
+			ND_PRINT("%u.%09u", seconds, nanoseconds);
+			if (nanoseconds > ND_NANO_PER_SEC - 1)
+				ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
 			bytesConsumed += 6;
 			break;
 		default:
diff --git a/contrib/tcpdump/print-ascii.c b/contrib/tcpdump/print-ascii.c
index f379c6c43678..4a5557867d04 100644
--- a/contrib/tcpdump/print-ascii.c
+++ b/contrib/tcpdump/print-ascii.c
@@ -100,7 +100,7 @@ ascii_print(netdissect_options *ndo,
 }
 
 static void
-hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident,
+hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *indent,
     const u_char *cp, u_int length, u_int oset)
 {
 	u_int caplength;
@@ -133,7 +133,7 @@ hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident,
 		if (i >= HEXDUMP_SHORTS_PER_LINE) {
 			*hsp = *asp = '\0';
 			ND_PRINT("%s0x%04x: %-*s  %s",
-			    ident, oset, HEXDUMP_HEXSTUFF_PER_LINE,
+			    indent, oset, HEXDUMP_HEXSTUFF_PER_LINE,
 			    hexstuff, asciistuff);
 			i = 0; hsp = hexstuff; asp = asciistuff;
 			oset += HEXDUMP_BYTES_PER_LINE;
@@ -152,7 +152,7 @@ hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident,
 	if (i > 0) {
 		*hsp = *asp = '\0';
 		ND_PRINT("%s0x%04x: %-*s  %s",
-		     ident, oset, HEXDUMP_HEXSTUFF_PER_LINE,
+		     indent, oset, HEXDUMP_HEXSTUFF_PER_LINE,
 		     hexstuff, asciistuff);
 	}
 	if (truncated)
@@ -160,10 +160,10 @@ hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident,
 }
 
 void
-hex_and_ascii_print(netdissect_options *ndo, const char *ident,
+hex_and_ascii_print(netdissect_options *ndo, const char *indent,
     const u_char *cp, u_int length)
 {
-	hex_and_ascii_print_with_offset(ndo, ident, cp, length, 0);
+	hex_and_ascii_print_with_offset(ndo, indent, cp, length, 0);
 }
 
 /*
@@ -171,7 +171,7 @@ hex_and_ascii_print(netdissect_options *ndo, const char *ident,
  */
 void
 hex_print_with_offset(netdissect_options *ndo,
-                      const char *ident, const u_char *cp, u_int length,
+                      const char *indent, const u_char *cp, u_int length,
 		      u_int oset)
 {
 	u_int caplength;
@@ -188,7 +188,7 @@ hex_print_with_offset(netdissect_options *ndo,
 	i = 0;
 	while (nshorts != 0) {
 		if ((i++ % 8) == 0) {
-			ND_PRINT("%s0x%04x: ", ident, oset);
+			ND_PRINT("%s0x%04x: ", indent, oset);
 			oset += HEXDUMP_BYTES_PER_LINE;
 		}
 		s = GET_U_1(cp);
@@ -199,7 +199,7 @@ hex_print_with_offset(netdissect_options *ndo,
 	}
 	if (length & 1) {
 		if ((i % 8) == 0)
-			ND_PRINT("%s0x%04x: ", ident, oset);
+			ND_PRINT("%s0x%04x: ", indent, oset);
 		ND_PRINT(" %02x", GET_U_1(cp));
 	}
 	if (truncated)
@@ -208,9 +208,9 @@ hex_print_with_offset(netdissect_options *ndo,
 
 void
 hex_print(netdissect_options *ndo,
-	  const char *ident, const u_char *cp, u_int length)
+	  const char *indent, const u_char *cp, u_int length)
 {
-	hex_print_with_offset(ndo, ident, cp, length, 0);
+	hex_print_with_offset(ndo, indent, cp, length, 0);
 }
 
 #ifdef MAIN
diff --git a/contrib/tcpdump/print-bootp.c b/contrib/tcpdump/print-bootp.c
index b20dabc64052..10048b4e53a3 100644
--- a/contrib/tcpdump/print-bootp.c
+++ b/contrib/tcpdump/print-bootp.c
@@ -178,7 +178,7 @@ struct bootp {
 /* RFC 2485 */
 #define	TAG_OPEN_GROUP_UAP	((uint8_t)  98)
 /* RFC 2563 */
-#define	TAG_DISABLE_AUTOCONF	((uint8_t) 116)
+#define	TAG_AUTO_CONFIGURE	((uint8_t) 116)
 /* RFC 2610 */
 #define	TAG_SLP_DA		((uint8_t)  78)
 #define	TAG_SLP_SCOPE		((uint8_t)  79)
@@ -394,9 +394,9 @@ trunc:
  * The first character specifies the format to print:
  *     i - ip address (32 bits)
  *     p - ip address pairs (32 bits + 32 bits)
- *     l - long (32 bits)
- *     L - unsigned long (32 bits)
- *     s - short (16 bits)
+ *     l - unsigned longs (32 bits)
+ *     L - longs (32 bits)
+ *     s - unsigned shorts (16 bits)
  *     b - period-separated decimal bytes (variable length)
  *     x - colon-separated hex bytes (variable length)
  *     a - ASCII string (variable length)
@@ -486,7 +486,7 @@ static const struct tok tag2str[] = {
 /* RFC 2485 */
 	{ TAG_OPEN_GROUP_UAP,	"aUAP" },
 /* RFC 2563 */
-	{ TAG_DISABLE_AUTOCONF,	"BNOAUTO" },
+	{ TAG_AUTO_CONFIGURE,	"BAuto-Configure" },
 /* RFC 2610 */
 	{ TAG_SLP_DA,		"bSLP-DA" },	/*"b" is a little wrong */
 	{ TAG_SLP_SCOPE,	"bSLP-SCOPE" },	/*"b" is a little wrong */
@@ -511,7 +511,7 @@ static const struct tok tag2str[] = {
 	{ TAG_TZ_STRING,	"aTZSTR" },
 	{ TAG_FQDN_OPTION,	"bFQDNS" },	/* XXX 'b' */
 	{ TAG_AUTH,		"bAUTH" },	/* XXX 'b' */
-	{ TAG_CLIENT_LAST_TRANSACTION_TIME, "LLast-Transaction-Time" },
+	{ TAG_CLIENT_LAST_TRANSACTION_TIME, "lLast-Transaction-Time" },
 	{ TAG_ASSOCIATED_IP,	"iAssociated-IP" },
 	{ TAG_CLIENT_ARCH,	"sARCH" },
 	{ TAG_CLIENT_NDI,	"bNDI" },	/* XXX 'b' */
@@ -703,6 +703,14 @@ rfc1048_print(netdissect_options *ndo,
 
 		case 'p':
 			/* IP address pairs */
+			/* this option should be N x 8 bytes long */
+			if (len < 8 || len % 8 != 0) {
+				ND_PRINT("%s[length != N x 8 bytes]",
+					 len == 0 ? " " : "");
+				bp += len;
+				len = 0;
+				break;
+			}
 			while (len >= 2*4) {
 				if (!first)
 					ND_PRINT(",");
@@ -717,7 +725,7 @@ rfc1048_print(netdissect_options *ndo,
 			break;
 
 		case 's':
-			/* shorts */
+			/* unsigned shorts */
 			while (len >= 2) {
 				if (!first)
 					ND_PRINT(",");
@@ -730,27 +738,33 @@ rfc1048_print(netdissect_options *ndo,
 
 		case 'B':
 			/* boolean */
-			while (len > 0) {
-				uint8_t bool_value;
-				if (!first)
-					ND_PRINT(",");
-				bool_value = GET_U_1(bp);
-				switch (bool_value) {
-				case 0:
-					ND_PRINT("N");
-					break;
-				case 1:
-					ND_PRINT("Y");
-					break;
-				default:
-					ND_PRINT("%u?", bool_value);
-					break;
-				}
-				++bp;
-				--len;
-				first = 0;
+		    {
+			/* this option should be 1 byte long */
+			if (len != 1) {
+				ND_PRINT("[length != 1 byte]");
+				nd_print_invalid(ndo);
+				bp += len;
+				len = 0;
+				break;
 			}
+
+			uint8_t bool_value;
+			bool_value = GET_U_1(bp);
+			switch (bool_value) {
+			case 0:
+				ND_PRINT("N");
+				break;
+			case 1:
+				ND_PRINT("Y");
+				break;
+			default:
+				ND_PRINT("%u?", bool_value);
+				break;
+			}
+			++bp;
+			--len;
 			break;
+		    }
 
 		case 'b':
 		case 'x':
@@ -778,7 +792,8 @@ rfc1048_print(netdissect_options *ndo,
 			case TAG_NETBIOS_NODE:
 				/* this option should be at least 1 byte long */
 				if (len < 1) {
-					ND_PRINT("[ERROR: length < 1 bytes]");
+					ND_PRINT("[length < 1 byte]");
+					nd_print_invalid(ndo);
 					break;
 				}
 				tag = GET_U_1(bp);
@@ -790,7 +805,8 @@ rfc1048_print(netdissect_options *ndo,
 			case TAG_OPT_OVERLOAD:
 				/* this option should be at least 1 byte long */
 				if (len < 1) {
-					ND_PRINT("[ERROR: length < 1 bytes]");
+					ND_PRINT("[length < 1 byte]");
+					nd_print_invalid(ndo);
 					break;
 				}
 				tag = GET_U_1(bp);
@@ -802,14 +818,16 @@ rfc1048_print(netdissect_options *ndo,
 			case TAG_CLIENT_FQDN:
 				/* this option should be at least 3 bytes long */
 				if (len < 3) {
-					ND_PRINT("[ERROR: length < 3 bytes]");
+					ND_PRINT("[length < 3 bytes]");
+					nd_print_invalid(ndo);
 					bp += len;
 					len = 0;
 					break;
 				}
 				if (GET_U_1(bp) & 0xf0) {
-					ND_PRINT("[ERROR: MBZ nibble 0x%x != 0] ",
+					ND_PRINT("[MBZ nibble 0x%x != 0] ",
 						 (GET_U_1(bp) & 0xf0) >> 4);
+					nd_print_invalid(ndo);
 				}
 				if (GET_U_1(bp) & 0x0f)
 					ND_PRINT("[%s] ",
@@ -835,7 +853,8 @@ rfc1048_print(netdissect_options *ndo,
 
 				/* this option should be at least 1 byte long */
 				if (len < 1) {
-					ND_PRINT("[ERROR: length < 1 bytes]");
+					ND_PRINT("[length < 1 byte]");
+					nd_print_invalid(ndo);
 					break;
 				}
 				type = GET_U_1(bp);
@@ -909,7 +928,8 @@ rfc1048_print(netdissect_options *ndo,
 
 				/* this option should be at least 5 bytes long */
 				if (len < 5) {
-					ND_PRINT("[ERROR: length < 5 bytes]");
+					ND_PRINT("[length < 5 bytes]");
+					nd_print_invalid(ndo);
 					bp += len;
 					len = 0;
 					break;
@@ -922,7 +942,8 @@ rfc1048_print(netdissect_options *ndo,
 					len--;
 					/* mask_width <= 32 */
 					if (mask_width > 32) {
-						ND_PRINT("[ERROR: Mask width (%u) > 32]", mask_width);
+						ND_PRINT("[Mask width (%u) > 32]", mask_width);
+						nd_print_invalid(ndo);
 						bp += len;
 						len = 0;
 						break;
@@ -930,7 +951,8 @@ rfc1048_print(netdissect_options *ndo,
 					significant_octets = (mask_width + 7) / 8;
 					/* significant octets + router(4) */
 					if (len < significant_octets + 4) {
-						ND_PRINT("[ERROR: Remaining length (%u) < %u bytes]", len, significant_octets + 4);
+						ND_PRINT("[Remaining length (%u) < %u bytes]", len, significant_octets + 4);
+						nd_print_invalid(ndo);
 						bp += len;
 						len = 0;
 						break;
@@ -964,7 +986,8 @@ rfc1048_print(netdissect_options *ndo,
 
 				first = 1;
 				if (len < 2) {
-					ND_PRINT("[ERROR: length < 2 bytes]");
+					ND_PRINT("[length < 2 bytes]");
+					nd_print_invalid(ndo);
 					bp += len;
 					len = 0;
 					break;
@@ -976,13 +999,16 @@ rfc1048_print(netdissect_options *ndo,
 					ND_PRINT("\n\t      ");
 					ND_PRINT("instance#%u: ", suboptnumber);
 					if (suboptlen == 0) {
-						ND_PRINT("[ERROR: suboption length must be non-zero]");
+						ND_PRINT("[suboption length == 0]");
+						nd_print_invalid(ndo);
 						bp += len;
 						len = 0;
 						break;
 					}
 					if (len < suboptlen) {
-						ND_PRINT("[ERROR: invalid option]");
+						ND_PRINT("[length %u < suboption length %u",
+							 len, suboptlen);
+						nd_print_invalid(ndo);
 						bp += len;
 						len = 0;
 						break;
@@ -1012,25 +1038,28 @@ rfc1048_print(netdissect_options *ndo,
 				 * URI: URI of the SZTP bootstrap server.
 				 */
 				while (len >= 2) {
-					suboptlen = GET_BE_U_2(bp);
+					uint16_t suboptlen2;
+
+					suboptlen2 = GET_BE_U_2(bp);
 					bp += 2;
 					len -= 2;
 					ND_PRINT("\n\t	    ");
-					ND_PRINT("length %u: ", suboptlen);
-					if (len < suboptlen) {
+					ND_PRINT("length %u: ", suboptlen2);
+					if (len < suboptlen2) {
 						ND_PRINT("length goes past end of option");
 						bp += len;
 						len = 0;
 						break;
 					}
 					ND_PRINT("\"");
-					nd_printjn(ndo, bp, suboptlen);
+					nd_printjn(ndo, bp, suboptlen2);
 					ND_PRINT("\"");
-					len -= suboptlen;
-					bp += suboptlen;
+					len -= suboptlen2;
+					bp += suboptlen2;
 				}
 				if (len != 0) {
-					ND_PRINT("[ERROR: length < 2 bytes]");
+					ND_PRINT("[length < 2 bytes]");
+					nd_print_invalid(ndo);
 				}
 				break;
 
diff --git a/contrib/tcpdump/print-domain.c b/contrib/tcpdump/print-domain.c
index 7ac891f04716..08d8460a4995 100644
--- a/contrib/tcpdump/print-domain.c
+++ b/contrib/tcpdump/print-domain.c
@@ -722,11 +722,10 @@ ns_rprint(netdissect_options *ndo,
 	len = GET_BE_U_2(cp);
 	cp += 2;
 
-	rp = cp + len;
-
 	ND_PRINT(" %s", tok2str(ns_type2str, "Type%u", typ));
-	if (rp > ndo->ndo_snapend)
-		return(NULL);
+
+	ND_TCHECK_LEN(cp, len);
+	rp = cp + len;
 
 	switch (typ) {
 	case T_A:
@@ -896,6 +895,9 @@ ns_rprint(netdissect_options *ndo,
 	    }
 	}
 	return (rp);		/* XXX This isn't always right */
+
+trunc:
+	return(NULL);
 }
 
 void
diff --git a/contrib/tcpdump/print-egp.c b/contrib/tcpdump/print-egp.c
index 60a3fb4f59d9..c7f98d9931e4 100644
--- a/contrib/tcpdump/print-egp.c
+++ b/contrib/tcpdump/print-egp.c
@@ -26,6 +26,7 @@
 
 #include "netdissect-stdinc.h"
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
@@ -87,44 +88,58 @@ struct egp_packet {
 #define  egp_sourcenet  egp_pands.egpu_sourcenet
 };
 
-static const char *egp_acquire_codes[] = {
-	"request",
-	"confirm",
-	"refuse",
-	"cease",
-	"cease_ack"
+static const struct tok egp_type_str[] = {
+	{ EGPT_ACQUIRE, "acquire" },
+	{ EGPT_REACH,   "reach"   },
+	{ EGPT_POLL,    "poll"    },
+	{ EGPT_UPDATE,  "update"  },
+	{ EGPT_ERROR,   "error"   },
+	{ 0, NULL }
 };
 
-static const char *egp_acquire_status[] = {
-	"unspecified",
-	"active_mode",
-	"passive_mode",
-	"insufficient_resources",
-	"administratively_prohibited",
-	"going_down",
-	"parameter_violation",
-	"protocol_violation"
+static const struct tok egp_acquire_codes_str[] = {
+	{ EGPC_REQUEST,  "request"   },
+	{ EGPC_CONFIRM,  "confirm"   },
+	{ EGPC_REFUSE,   "refuse"    },
+	{ EGPC_CEASE,    "cease"     },
+	{ EGPC_CEASEACK, "cease_ack" },
+	{ 0, NULL }
 };
 
-static const char *egp_reach_codes[] = {
-	"hello",
-	"i-h-u"
+static const struct tok egp_acquire_status_str[] = {
+	{ EGPS_UNSPEC,  "unspecified"                 },
+	{ EGPS_ACTIVE,  "active_mode"                 },
+	{ EGPS_PASSIVE, "passive_mode"                },
+	{ EGPS_NORES,   "insufficient_resources"      },
+	{ EGPS_ADMIN,   "administratively_prohibited" },
+	{ EGPS_GODOWN,  "going_down"                  },
+	{ EGPS_PARAM,   "parameter_violation"         },
+	{ EGPS_PROTO,   "protocol_violation"          },
+	{ 0, NULL }
 };
 
-static const char *egp_status_updown[] = {
-	"indeterminate",
-	"up",
-	"down"
+static const struct tok egp_reach_codes_str[] = {
+	{ EGPC_HELLO,  "hello" },
+	{ EGPC_HEARDU, "i-h-u" },
+	{ 0, NULL }
 };
 
-static const char *egp_reasons[] = {
-	"unspecified",
-	"bad_EGP_header_format",
-	"bad_EGP_data_field_format",
-	"reachability_info_unavailable",
-	"excessive_polling_rate",
-	"no_response",
-	"unsupported_version"
+static const struct tok egp_status_updown_str[] = {
+	{ EGPS_INDET, "indeterminate" },
+	{ EGPS_UP,    "up"            },
+	{ EGPS_DOWN,  "down"          },
+	{ 0, NULL }
+};
+
+static const struct tok egp_reasons_str[] = {
+	{ EGPR_UNSPEC,   "unspecified"                   },
+	{ EGPR_BADHEAD,  "bad_EGP_header_format"         },
+	{ EGPR_BADDATA,  "bad_EGP_data_field_format"     },
+	{ EGPR_NOREACH,  "reachability_info_unavailable" },
+	{ EGPR_XSPOLL,   "excessive_polling_rate"        },
+	{ EGPR_NORESP,   "no_response"                   },
+	{ EGPR_UVERSION, "unsupported_version"           },
+	{ 0, NULL }
 };
 
 static void
@@ -162,8 +177,7 @@ egpnr_print(netdissect_options *ndo,
 	for (gateways = 0; gateways < t_gateways; ++gateways) {
 		/* Pickup host part of gateway address */
 		addr = 0;
-		if (length < 4 - netlen)
-			goto trunc;
+		ND_ICHECK_U(length, <, 4 - netlen);
 		ND_TCHECK_LEN(cp, 4 - netlen);
 		switch (netlen) {
 
@@ -182,8 +196,7 @@ egpnr_print(netdissect_options *ndo,
 		}
 		addr |= net;
 		length -= 4 - netlen;
-		if (length < 1)
-			goto trunc;
+		ND_ICHECK_U(length, <, 1);
 		distances = GET_U_1(cp);
 		cp++;
 		length--;
@@ -194,8 +207,7 @@ egpnr_print(netdissect_options *ndo,
 		comma = "";
 		ND_PRINT("(");
 		while (distances != 0) {
-			if (length < 2)
-				goto trunc;
+			ND_ICHECK_U(length, <, 2);
 			ND_PRINT("%sd%u:", comma, GET_U_1(cp));
 			cp++;
 			comma = ", ";
@@ -204,20 +216,17 @@ egpnr_print(netdissect_options *ndo,
 			length -= 2;
 			while (networks != 0) {
 				/* Pickup network number */
-				if (length < 1)
-					goto trunc;
+				ND_ICHECK_U(length, <, 1);
 				addr = ((uint32_t) GET_U_1(cp)) << 24;
 				cp++;
 				length--;
 				if (IN_CLASSB(addr)) {
-					if (length < 1)
-						goto trunc;
+					ND_ICHECK_U(length, <, 1);
 					addr |= ((uint32_t) GET_U_1(cp)) << 16;
 					cp++;
 					length--;
 				} else if (!IN_CLASSA(addr)) {
-					if (length < 2)
-						goto trunc;
+					ND_ICHECK_U(length, <, 2);
 					addr |= ((uint32_t) GET_U_1(cp)) << 16;
 					cp++;
 					addr |= ((uint32_t) GET_U_1(cp)) << 8;
@@ -232,8 +241,8 @@ egpnr_print(netdissect_options *ndo,
 		ND_PRINT(")");
 	}
 	return;
-trunc:
-	nd_print_trunc(ndo);
+invalid:
+	nd_print_invalid(ndo);
 }
 
 void
@@ -247,46 +256,42 @@ egp_print(netdissect_options *ndo,
 	u_int status;
 
 	ndo->ndo_protocol = "egp";
+	nd_print_protocol_caps(ndo);
+
 	egp = (const struct egp_packet *)bp;
-	if (length < sizeof(*egp) || !ND_TTEST_SIZE(egp)) {
-		nd_print_trunc(ndo);
-		return;
-	}
+	ND_ICHECK_ZU(length, <, sizeof(*egp));
 
 	version = GET_U_1(egp->egp_version);
-        if (!ndo->ndo_vflag) {
-            ND_PRINT("EGPv%u, AS %u, seq %u, length %u",
-                   version,
-                   GET_BE_U_2(egp->egp_as),
-                   GET_BE_U_2(egp->egp_sequence),
-                   length);
-            return;
-        } else
-            ND_PRINT("EGPv%u, length %u",
-                   version,
-                   length);
-
-	if (version != EGP_VERSION) {
-		ND_PRINT("[version %u]", version);
+	ND_ICHECK_U(version, !=, EGP_VERSION);
+	ND_TCHECK_SIZE(egp);
+
+	ND_PRINT("v%u", version);
+	if (ndo->ndo_vflag) {
+		ND_PRINT(", AS %u, seq %u, length %u",
+			 GET_BE_U_2(egp->egp_as),
+			 GET_BE_U_2(egp->egp_sequence),
+			 length);
+	} else {
+		ND_PRINT(", length %u", length);
 		return;
 	}
 
 	type = GET_U_1(egp->egp_type);
+	ND_PRINT(", %s", tok2str(egp_type_str, "[type %u]", type));
 	code = GET_U_1(egp->egp_code);
 	status = GET_U_1(egp->egp_status);
 
 	switch (type) {
 	case EGPT_ACQUIRE:
-		ND_PRINT(" acquire");
+		ND_PRINT(" %s", tok2str(egp_acquire_codes_str, "[code %u]", code));
 		switch (code) {
 		case EGPC_REQUEST:
 		case EGPC_CONFIRM:
-			ND_PRINT(" %s", egp_acquire_codes[code]);
 			switch (status) {
 			case EGPS_UNSPEC:
 			case EGPS_ACTIVE:
 			case EGPS_PASSIVE:
-				ND_PRINT(" %s", egp_acquire_status[status]);
+				ND_PRINT(" %s", tok2str(egp_acquire_status_str, "%u", status));
 				break;
 
 			default:
@@ -301,7 +306,6 @@ egp_print(netdissect_options *ndo,
 		case EGPC_REFUSE:
 		case EGPC_CEASE:
 		case EGPC_CEASEACK:
-			ND_PRINT(" %s", egp_acquire_codes[code]);
 			switch (status ) {
 			case EGPS_UNSPEC:
 			case EGPS_NORES:
@@ -309,7 +313,7 @@ egp_print(netdissect_options *ndo,
 			case EGPS_GODOWN:
 			case EGPS_PARAM:
 			case EGPS_PROTO:
-				ND_PRINT(" %s", egp_acquire_status[status]);
+				ND_PRINT(" %s", tok2str(egp_acquire_status_str, "%u", status));
 				break;
 
 			default:
@@ -317,50 +321,30 @@ egp_print(netdissect_options *ndo,
 				break;
 			}
 			break;
-
-		default:
-			ND_PRINT("[code %u]", code);
-			break;
 		}
 		break;
 
 	case EGPT_REACH:
+		ND_PRINT(" %s", tok2str(egp_reach_codes_str, "[reach code %u]", code));
 		switch (code) {
-
 		case EGPC_HELLO:
 		case EGPC_HEARDU:
-			ND_PRINT(" %s", egp_reach_codes[code]);
-			if (status <= EGPS_DOWN)
-				ND_PRINT(" state:%s", egp_status_updown[status]);
-			else
-				ND_PRINT(" [status %u]", status);
-			break;
-
-		default:
-			ND_PRINT("[reach code %u]", code);
+			ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
 			break;
 		}
 		break;
 
 	case EGPT_POLL:
-		ND_PRINT(" poll");
-		if (status <= EGPS_DOWN)
-			ND_PRINT(" state:%s", egp_status_updown[status]);
-		else
-			ND_PRINT(" [status %u]", status);
+		ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
 		ND_PRINT(" net:%s", GET_IPADDR_STRING(egp->egp_sourcenet));
 		break;
 
 	case EGPT_UPDATE:
-		ND_PRINT(" update");
 		if (status & EGPS_UNSOL) {
 			status &= ~EGPS_UNSOL;
 			ND_PRINT(" unsolicited");
 		}
-		if (status <= EGPS_DOWN)
-			ND_PRINT(" state:%s", egp_status_updown[status]);
-		else
-			ND_PRINT(" [status %u]", status);
+		ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
 		ND_PRINT(" %s int %u ext %u",
 		       GET_IPADDR_STRING(egp->egp_sourcenet),
 		       GET_U_1(egp->egp_intgw),
@@ -370,21 +354,11 @@ egp_print(netdissect_options *ndo,
 		break;
 
 	case EGPT_ERROR:
-		ND_PRINT(" error");
-		if (status <= EGPS_DOWN)
-			ND_PRINT(" state:%s", egp_status_updown[status]);
-		else
-			ND_PRINT(" [status %u]", status);
-
-		if (GET_BE_U_2(egp->egp_reason) <= EGPR_UVERSION)
-			ND_PRINT(" %s",
-				 egp_reasons[GET_BE_U_2(egp->egp_reason)]);
-		else
-			ND_PRINT(" [reason %u]", GET_BE_U_2(egp->egp_reason));
-		break;
-
-	default:
-		ND_PRINT("[type %u]", type);
+		ND_PRINT(" state:%s", tok2str(egp_status_updown_str, "%u", status));
+		ND_PRINT(" %s", tok2str(egp_reasons_str, "[reason %u]", GET_BE_U_2(egp->egp_reason)));
 		break;
 	}
+	return;
+invalid:
+	nd_print_invalid(ndo);
 }
diff --git a/contrib/tcpdump/print-frag6.c b/contrib/tcpdump/print-frag6.c
index a4b3be0d43ff..abc2a6367380 100644
--- a/contrib/tcpdump/print-frag6.c
+++ b/contrib/tcpdump/print-frag6.c
@@ -25,6 +25,7 @@
 
 #include "netdissect-stdinc.h"
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
 #include "extract.h"
 
@@ -43,6 +44,8 @@ frag6_print(netdissect_options *ndo, const u_char *bp, const u_char *bp2)
 	ND_PRINT("frag (");
 	if (ndo->ndo_vflag)
 		ND_PRINT("0x%08x:", GET_BE_U_4(dp->ip6f_ident));
+	else
+		ND_TCHECK_4(dp->ip6f_ident);
 	ND_PRINT("%u|", GET_BE_U_2(dp->ip6f_offlg) & IP6F_OFF_MASK);
 	if ((bp - bp2) + sizeof(struct ip6_frag) >
 	    sizeof(struct ip6_hdr) + GET_BE_U_2(ip6->ip6_plen))
diff --git a/contrib/tcpdump/print-icmp6.c b/contrib/tcpdump/print-icmp6.c
index e67b19b40bdc..29fce0ef85cd 100644
--- a/contrib/tcpdump/print-icmp6.c
+++ b/contrib/tcpdump/print-icmp6.c
@@ -100,11 +100,8 @@ struct icmp6_hdr {
 
 #define ICMP6_ECHO_REQUEST		128	/* echo service */
 #define ICMP6_ECHO_REPLY		129	/* echo reply */
-#define ICMP6_MEMBERSHIP_QUERY		130	/* group membership query */
 #define MLD6_LISTENER_QUERY		130	/* multicast listener query */
-#define ICMP6_MEMBERSHIP_REPORT		131	/* group membership report */
 #define MLD6_LISTENER_REPORT		131	/* multicast listener report */
-#define ICMP6_MEMBERSHIP_REDUCTION	132	/* group membership termination */
 #define MLD6_LISTENER_DONE		132	/* multicast listener done */
 
 #define ND_ROUTER_SOLICIT		133	/* router solicitation */
@@ -115,11 +112,7 @@ struct icmp6_hdr {
 
 #define ICMP6_ROUTER_RENUMBERING	138	/* router renumbering */
 
-#define ICMP6_WRUREQUEST		139	/* who are you request */
-#define ICMP6_WRUREPLY			140	/* who are you reply */
-#define ICMP6_FQDN_QUERY		139	/* FQDN query */
-#define ICMP6_FQDN_REPLY		140	/* FQDN reply */
-#define ICMP6_NI_QUERY			139	/* node information request - RFC 4620 */
+#define ICMP6_NI_QUERY			139	/* node information query - RFC 4620 */
 #define ICMP6_NI_REPLY			140	/* node information reply - RFC 4620 */
 #define IND_SOLICIT			141	/* inverse neighbor solicitation */
 #define IND_ADVERT			142	/* inverse neighbor advertisement */
@@ -385,10 +378,9 @@ struct icmp6_nodeinfo {
 #define ni_qtype	icmp6_ni_hdr.icmp6_data16[0]
 #define ni_flags	icmp6_ni_hdr.icmp6_data16[1]
 
-#define NI_QTYPE_NOOP		0 /* NOOP  */
-#define NI_QTYPE_SUPTYPES	1 /* Supported Qtypes (drafts up to 09) */
-#define NI_QTYPE_FQDN		2 /* FQDN (draft 04) */
-#define NI_QTYPE_DNSNAME	2 /* DNS Name */
+#define NI_QTYPE_NOOP		0 /* NOOP */
+#define NI_QTYPE_SUPTYPES	1 /* Supported Qtypes (Obsolete) */
+#define NI_QTYPE_NODENAME	2 /* Node Name */
 #define NI_QTYPE_NODEADDR	3 /* Node Addresses */
 #define NI_QTYPE_IPV4ADDR	4 /* IPv4 Addresses */
 
@@ -398,7 +390,22 @@ struct icmp6_nodeinfo {
 #define NI_NODEADDR_FLAG_LINKLOCAL	0x0008
 #define NI_NODEADDR_FLAG_SITELOCAL	0x0010
 #define NI_NODEADDR_FLAG_GLOBAL		0x0020
-#define NI_NODEADDR_FLAG_ANYCAST	0x0040 /* just experimental. not in spec */
+
+static const struct tok ni_nodeaddr_flag_values[] = {
+        { NI_NODEADDR_FLAG_TRUNCATE, "T" },
+        { NI_NODEADDR_FLAG_ALL, "A" },
+        { NI_NODEADDR_FLAG_COMPAT, "C" },
+        { NI_NODEADDR_FLAG_LINKLOCAL, "L" },
+        { NI_NODEADDR_FLAG_SITELOCAL, "S" },
+        { NI_NODEADDR_FLAG_GLOBAL, "G" },
+        { 0, NULL }
+};
+
+static const struct tok ni_ipv4addr_flag_values[] = {
+        { NI_NODEADDR_FLAG_TRUNCATE, "T" },
+        { NI_NODEADDR_FLAG_ALL, "A" },
+        { 0, NULL }
+};
 
 struct ni_reply_fqdn {
 	nd_uint32_t ni_fqdn_ttl;	/* TTL */
@@ -422,6 +429,15 @@ struct icmp6_router_renum {	/* router renumbering header */
 #define ICMP6_RR_FLAGS_SPECSITE		0x10
 #define ICMP6_RR_FLAGS_PREVDONE		0x08
 
+static const struct tok router_renum_flag_values[] = {
+	{ ICMP6_RR_FLAGS_TEST, "T" },
+	{ ICMP6_RR_FLAGS_REQRESULT, "R" },
+	{ ICMP6_RR_FLAGS_FORCEAPPLY, "A" },
+	{ ICMP6_RR_FLAGS_SPECSITE, "S" },
+	{ ICMP6_RR_FLAGS_PREVDONE, "P" },
+	{ 0, NULL },
+};
+
 #define rr_type		rr_hdr.icmp6_type
 #define rr_code		rr_hdr.icmp6_code
 #define rr_cksum	rr_hdr.icmp6_cksum
@@ -659,8 +675,6 @@ static const struct tok icmp6_type_values[] = {
     { ICMP6_HADISCOV_REPLY, "ha discovery reply"},
     { ICMP6_MOBILEPREFIX_SOLICIT, "mobile router solicitation"},
     { ICMP6_MOBILEPREFIX_ADVERT, "mobile router advertisement"},
-    { ICMP6_WRUREQUEST, "who-are-you request"},
-    { ICMP6_WRUREPLY, "who-are-you reply"},
     { ICMP6_NI_QUERY, "node information query"},
     { ICMP6_NI_REPLY, "node information reply"},
     { MLD6_MTRACE, "mtrace message"},
@@ -1152,7 +1166,7 @@ icmp6_print(netdissect_options *ndo,
                 ND_PRINT(", id %u, seq %u", GET_BE_U_2(dp->icmp6_id),
 			 GET_BE_U_2(dp->icmp6_seq));
 		break;
-	case ICMP6_MEMBERSHIP_QUERY:
+	case MLD6_LISTENER_QUERY:
 		if (length == MLD_MINLEN) {
 			mld6_print(ndo, (const u_char *)dp);
 		} else if (length >= MLDV2_MINLEN) {
@@ -1162,10 +1176,10 @@ icmp6_print(netdissect_options *ndo,
                         ND_PRINT(" unknown-version (len %u) ", length);
 		}
 		break;
-	case ICMP6_MEMBERSHIP_REPORT:
+	case MLD6_LISTENER_REPORT:
 		mld6_print(ndo, (const u_char *)dp);
 		break;
-	case ICMP6_MEMBERSHIP_REDUCTION:
+	case MLD6_LISTENER_DONE:
 		mld6_print(ndo, (const u_char *)dp);
 		break;
 	case ND_ROUTER_SOLICIT:
@@ -1700,6 +1714,7 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 	const struct icmp6_hdr *dp;
 	const u_char *cp;
 	size_t siz, i;
+	uint16_t flags;
 	int needcomma;
 
 	if (ep < bp)
@@ -1715,7 +1730,6 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 			ND_PRINT(" who-are-you request");
 			break;
 		}
-		ND_PRINT(" node information query");
 
 		ND_TCHECK_LEN(dp, sizeof(*ni6));
 		ni6 = (const struct icmp6_nodeinfo *)dp;
@@ -1724,36 +1738,35 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 		case NI_QTYPE_NOOP:
 			ND_PRINT("noop");
 			break;
-		case NI_QTYPE_SUPTYPES:
-			ND_PRINT("supported qtypes");
-			i = GET_BE_U_2(ni6->ni_flags);
-			if (i)
-				ND_PRINT(" [%s]", (i & 0x01) ? "C" : "");
-			break;
-		case NI_QTYPE_FQDN:
-			ND_PRINT("DNS name");
+		case NI_QTYPE_NODENAME:
+			ND_PRINT("node name");
 			break;
 		case NI_QTYPE_NODEADDR:
 			ND_PRINT("node addresses");
-			i = GET_BE_U_2(ni6->ni_flags);
-			if (!i)
-				break;
-			/* NI_NODEADDR_FLAG_TRUNCATE undefined for query */
-			ND_PRINT(" [%s%s%s%s%s%s]",
-			    (i & NI_NODEADDR_FLAG_ANYCAST) ? "a" : "",
-			    (i & NI_NODEADDR_FLAG_GLOBAL) ? "G" : "",
-			    (i & NI_NODEADDR_FLAG_SITELOCAL) ? "S" : "",
-			    (i & NI_NODEADDR_FLAG_LINKLOCAL) ? "L" : "",
-			    (i & NI_NODEADDR_FLAG_COMPAT) ? "C" : "",
-			    (i & NI_NODEADDR_FLAG_ALL) ? "A" : "");
+			flags = GET_BE_U_2(ni6->ni_flags);
+			if (flags)
+				ND_PRINT(" [%s]",
+					 bittok2str_nosep(ni_nodeaddr_flag_values,
+					 "none", flags));
+			if (flags & NI_NODEADDR_FLAG_TRUNCATE)
+				ND_PRINT(" [invalid flag Truncate present]");
+			break;
+		case NI_QTYPE_IPV4ADDR:
+			ND_PRINT("ipv4 addresses");
+			flags = GET_BE_U_2(ni6->ni_flags);
+			if (flags)
+				ND_PRINT(" [%s]",
+					 bittok2str_nosep(ni_ipv4addr_flag_values,
+					 "none", flags));
+			if (flags & NI_NODEADDR_FLAG_TRUNCATE)
+				ND_PRINT(" [invalid flag Truncate present]");
 			break;
 		default:
 			ND_PRINT("unknown");
 			break;
 		}
 
-		if (GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_NOOP ||
-		    GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_SUPTYPES) {
+		if (GET_BE_U_2(ni6->ni_qtype) == NI_QTYPE_NOOP) {
 			if (siz != sizeof(*ni6))
 				if (ndo->ndo_vflag)
 					ND_PRINT(", invalid len");
@@ -1762,14 +1775,6 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 			break;
 		}
 
-		/* XXX backward compat, icmp-name-lookup-03 */
-		if (siz == sizeof(*ni6)) {
-			ND_PRINT(", 03 draft");
-			/*(*/
-			ND_PRINT(")");
-			break;
-		}
-
 		cp = (const u_char *)(ni6 + 1);
 		switch (GET_U_1(ni6->ni_code)) {
 		case ICMP6_NI_SUBJ_IPV6:
@@ -1785,19 +1790,7 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 			break;
 		case ICMP6_NI_SUBJ_FQDN:
 			ND_PRINT(", subject=DNS name");
-			if (GET_U_1(cp) == ep - cp - 1) {
-				/* icmp-name-lookup-03, pascal string */
-				if (ndo->ndo_vflag)
-					ND_PRINT(", 03 draft");
-				cp++;
-				ND_PRINT(", \"");
-				while (cp < ep) {
-					fn_print_char(ndo, GET_U_1(cp));
-					cp++;
-				}
-				ND_PRINT("\"");
-			} else
-				dnsname_print(ndo, cp, ep);
+			dnsname_print(ndo, cp, ep);
 			break;
 		case ICMP6_NI_SUBJ_IPV4:
 			if (!ND_TTEST_LEN(dp, sizeof(*ni6) + sizeof(nd_ipv4)))
@@ -1827,7 +1820,6 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 
 		ND_TCHECK_LEN(dp, sizeof(*ni6));
 		ni6 = (const struct icmp6_nodeinfo *)dp;
-		ND_PRINT(" node information reply");
 		ND_PRINT(" (");	/*)*/
 		switch (GET_U_1(ni6->ni_code)) {
 		case ICMP6_NI_SUCCESS:
@@ -1867,32 +1859,12 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 				if (ndo->ndo_vflag)
 					ND_PRINT(", invalid length");
 			break;
-		case NI_QTYPE_SUPTYPES:
+		case NI_QTYPE_NODENAME:
 			if (needcomma)
 				ND_PRINT(", ");
-			ND_PRINT("supported qtypes");
-			i = GET_BE_U_2(ni6->ni_flags);
-			if (i)
-				ND_PRINT(" [%s]", (i & 0x01) ? "C" : "");
-			break;
-		case NI_QTYPE_FQDN:
-			if (needcomma)
-				ND_PRINT(", ");
-			ND_PRINT("DNS name");
+			ND_PRINT("node name");
 			cp = (const u_char *)(ni6 + 1) + 4;
-			if (GET_U_1(cp) == ep - cp - 1) {
-				/* icmp-name-lookup-03, pascal string */
-				if (ndo->ndo_vflag)
-					ND_PRINT(", 03 draft");
-				cp++;
-				ND_PRINT(", \"");
-				while (cp < ep) {
-					fn_print_char(ndo, GET_U_1(cp));
-					cp++;
-				}
-				ND_PRINT("\"");
-			} else
-				dnsname_print(ndo, cp, ep);
+			dnsname_print(ndo, cp, ep);
 			if ((GET_BE_U_2(ni6->ni_flags) & 0x01) != 0)
 				ND_PRINT(" [TTL=%u]", GET_BE_U_4(ni6 + 1));
 			break;
@@ -1900,6 +1872,11 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 			if (needcomma)
 				ND_PRINT(", ");
 			ND_PRINT("node addresses");
+			flags = GET_BE_U_2(ni6->ni_flags);
+			if (flags)
+				ND_PRINT(" [%s]",
+					 bittok2str_nosep(ni_nodeaddr_flag_values,
+					 "none", flags));
 			i = sizeof(*ni6);
 			while (i < siz) {
 				if (i + sizeof(uint32_t) + sizeof(nd_ipv6) > siz)
@@ -1909,17 +1886,25 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 				    GET_BE_U_4(bp + i));
 				i += sizeof(uint32_t) + sizeof(nd_ipv6);
 			}
-			i = GET_BE_U_2(ni6->ni_flags);
-			if (!i)
-				break;
-			ND_PRINT(" [%s%s%s%s%s%s%s]",
-                                  (i & NI_NODEADDR_FLAG_ANYCAST) ? "a" : "",
-                                  (i & NI_NODEADDR_FLAG_GLOBAL) ? "G" : "",
-                                  (i & NI_NODEADDR_FLAG_SITELOCAL) ? "S" : "",
-                                  (i & NI_NODEADDR_FLAG_LINKLOCAL) ? "L" : "",
-                                  (i & NI_NODEADDR_FLAG_COMPAT) ? "C" : "",
-                                  (i & NI_NODEADDR_FLAG_ALL) ? "A" : "",
-                                  (i & NI_NODEADDR_FLAG_TRUNCATE) ? "T" : "");
+			break;
+		case NI_QTYPE_IPV4ADDR:
+			if (needcomma)
+				ND_PRINT(", ");
+			ND_PRINT("ipv4 addresses");
+			flags = GET_BE_U_2(ni6->ni_flags);
+			if (flags)
+				ND_PRINT(" [%s]",
+					 bittok2str_nosep(ni_nodeaddr_flag_values,
+					 "none", flags));
+			cp = (const u_char *)(ni6 + 1);
+			while (cp < ep) {
+				uint32_t ttl;
+
+				ttl = GET_BE_U_4(cp);
+				cp += 4;
+				ND_PRINT(" %s(%u)", GET_IPADDR_STRING(cp), ttl);
+				cp += 4;
+			}
 			break;
 		default:
 			if (needcomma)
@@ -1973,14 +1958,11 @@ icmp6_rrenum_print(netdissect_options *ndo, const u_char *bp, const u_char *ep)
 
 	if (ndo->ndo_vflag) {
 		uint8_t rr_flags = GET_U_1(rr6->rr_flags);
-#define F(x, y)	(rr_flags & (x) ? (y) : "")
 		ND_PRINT("[");	/*]*/
 		if (rr_flags) {
-			ND_PRINT("%s%s%s%s%s,", F(ICMP6_RR_FLAGS_TEST, "T"),
-                                  F(ICMP6_RR_FLAGS_REQRESULT, "R"),
-                                  F(ICMP6_RR_FLAGS_FORCEAPPLY, "A"),
-                                  F(ICMP6_RR_FLAGS_SPECSITE, "S"),
-                                  F(ICMP6_RR_FLAGS_PREVDONE, "P"));
+			ND_PRINT("%s,",
+				 bittok2str_nosep(router_renum_flag_values,
+				 "none", rr_flags));
 		}
                 ND_PRINT("seg=%u,", GET_U_1(rr6->rr_segnum));
                 ND_PRINT("maxdelay=%u", GET_BE_U_2(rr6->rr_maxdelay));
@@ -1988,7 +1970,6 @@ icmp6_rrenum_print(netdissect_options *ndo, const u_char *bp, const u_char *ep)
 			ND_PRINT("rsvd=0x%x", GET_BE_U_4(rr6->rr_reserved));
 		/*[*/
 		ND_PRINT("]");
-#undef F
 	}
 
 	if (GET_U_1(rr6->rr_code) == ICMP6_ROUTER_RENUMBERING_COMMAND) {
diff --git a/contrib/tcpdump/print-ip.c b/contrib/tcpdump/print-ip.c
index 5edc62215e27..baf64db2bafd 100644
--- a/contrib/tcpdump/print-ip.c
+++ b/contrib/tcpdump/print-ip.c
@@ -353,14 +353,19 @@ ip_print(netdissect_options *ndo,
 		/* we guess that it is a TSO send */
 		len = length;
 		presumed_tso = 1;
-	} else
-		ND_ICHECKMSG_U("total length", len, <, hlen);
+	}
+	if (len < hlen) {
+		ND_PRINT("[total length %u < header length %u]", len, hlen);
+		goto invalid;
+	}
 
 	ND_TCHECK_SIZE(ip);
 	/*
-	 * Cut off the snapshot length to the end of the IP payload.
+	 * Cut off the snapshot length to the end of the IP payload
+	 * or the end of the data in which it's contained, whichever
+	 * comes first.
 	 */
-	if (!nd_push_snaplen(ndo, bp, len)) {
+	if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 			"%s: can't push snaplen on buffer stack", __func__);
 	}
@@ -414,7 +419,7 @@ ip_print(netdissect_options *ndo,
 	    else
                 ND_PRINT(", length %u", GET_BE_U_2(ip->ip_len));
 
-            if ((hlen - sizeof(struct ip)) > 0) {
+            if ((hlen > sizeof(struct ip))) {
                 ND_PRINT(", options (");
                 if (ip_optprint(ndo, (const u_char *)(ip + 1),
                     hlen - sizeof(struct ip)) == -1) {
@@ -424,7 +429,7 @@ ip_print(netdissect_options *ndo,
                 ND_PRINT(")");
             }
 
-	    if (!ndo->ndo_Kflag && (const u_char *)ip + hlen <= ndo->ndo_snapend) {
+	    if (!ndo->ndo_Kflag && ND_TTEST_LEN((const u_char *)ip, hlen)) {
 	        vec[0].ptr = (const uint8_t *)(const void *)ip;
 	        vec[0].len = hlen;
 	        sum = in_cksum(vec, 1);
@@ -435,7 +440,10 @@ ip_print(netdissect_options *ndo,
 		}
 	    }
 
-	    ND_PRINT(")\n    ");
+	    if (ndo->ndo_gflag)
+		ND_PRINT(") ");
+	    else
+		ND_PRINT(")\n    ");
 	    if (truncated) {
 		ND_PRINT("%s > %s: ",
 			 GET_IPADDR_STRING(ip->ip_src),
diff --git a/contrib/tcpdump/print-ip6.c b/contrib/tcpdump/print-ip6.c
index dc4aa268b9ca..269b41fb2a7a 100644
--- a/contrib/tcpdump/print-ip6.c
+++ b/contrib/tcpdump/print-ip6.c
@@ -292,7 +292,7 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	    if (flow & 0x000fffff)
 	        ND_PRINT("flowlabel 0x%05x, ", flow & 0x000fffff);
 
-	    ND_PRINT("hlim %u, next-header %s (%u) payload length: %u) ",
+	    ND_PRINT("hlim %u, next-header %s (%u), payload length %u) ",
 	                 GET_U_1(ip6->ip6_hlim),
 	                 tok2str(ipproto_values,"unknown",nh),
 	                 nh,
@@ -301,9 +301,11 @@ ip6_print(netdissect_options *ndo, const u_char *bp, u_int length)
 	ND_TCHECK_SIZE(ip6);
 
 	/*
-	 * Cut off the snapshot length to the end of the IP payload.
+	 * Cut off the snapshot length to the end of the IP payload
+	 * or the end of the data in which it's contained, whichever
+	 * comes first.
 	 */
-	if (!nd_push_snaplen(ndo, bp, len)) {
+	if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
 		(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 			"%s: can't push snaplen on buffer stack", __func__);
 	}
diff --git a/contrib/tcpdump/print-ip6opts.c b/contrib/tcpdump/print-ip6opts.c
index cbd2d9667310..c3eeb1e0a92a 100644
--- a/contrib/tcpdump/print-ip6opts.c
+++ b/contrib/tcpdump/print-ip6opts.c
@@ -33,6 +33,7 @@
 
 #include "netdissect-stdinc.h"
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
@@ -40,107 +41,84 @@
 #include "ip6.h"
 
 static int
-ip6_sopt_print(netdissect_options *ndo, const u_char *bp, int len)
+ip6_sopt_print(netdissect_options *ndo, const u_char *bp, const u_int len)
 {
-    int i;
-    int optlen;
+    unsigned int i, opttype, optlen;
 
     for (i = 0; i < len; i += optlen) {
-	if (GET_U_1(bp + i) == IP6OPT_PAD1)
+	opttype = GET_U_1(bp + i);
+	if (opttype == IP6OPT_PAD1)
 	    optlen = 1;
 	else {
-	    if (i + 1 < len)
-		optlen = GET_U_1(bp + i + 1) + 2;
-	    else
-		goto trunc;
+	    ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+			   IP6OPT_MINLEN);
+	    optlen = GET_U_1(bp + i + 1) + 2;
 	}
-	if (i + optlen > len)
-	    goto trunc;
+	ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
+	ND_TCHECK_LEN(bp + i, optlen);
 
-	switch (GET_U_1(bp + i)) {
+	switch (opttype) {
 	case IP6OPT_PAD1:
             ND_PRINT(", pad1");
 	    break;
 	case IP6OPT_PADN:
-	    if (len - i < IP6OPT_MINLEN) {
-		ND_PRINT(", padn: trunc");
-		goto trunc;
-	    }
             ND_PRINT(", padn");
 	    break;
 	default:
-	    if (len - i < IP6OPT_MINLEN) {
-		ND_PRINT(", sopt_type %u: trunc)", GET_U_1(bp + i));
-		goto trunc;
-	    }
-	    ND_PRINT(", sopt_type 0x%02x: len=%u", GET_U_1(bp + i),
-                     GET_U_1(bp + i + 1));
+	    ND_PRINT(", unknown subopt-type 0x%02x len=%u", opttype, optlen - 2);
 	    break;
 	}
     }
     return 0;
 
-trunc:
+invalid:
     return -1;
 }
 
 static int
-ip6_opt_process(netdissect_options *ndo, const u_char *bp, int len,
+ip6_opt_process(netdissect_options *ndo, const u_char *bp, const u_int len,
 		int *found_jumbop, uint32_t *payload_len)
 {
-    int i;
-    int optlen = 0;
+    unsigned int i, opttype, optlen;
     int found_jumbo = 0;
     uint32_t jumbolen = 0;
 
     if (len == 0)
         return 0;
     for (i = 0; i < len; i += optlen) {
-	if (GET_U_1(bp + i) == IP6OPT_PAD1)
+	opttype = GET_U_1(bp + i);
+	if (opttype == IP6OPT_PAD1)
 	    optlen = 1;
 	else {
-	    if (i + 1 < len)
-		optlen = GET_U_1(bp + i + 1) + 2;
-	    else
-		goto trunc;
+	    ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+			   IP6OPT_MINLEN);
+	    optlen = GET_U_1(bp + i + 1) + 2;
 	}
-	if (i + optlen > len)
-	    goto trunc;
+	ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
+	ND_TCHECK_LEN(bp + i, optlen);
 
-	switch (GET_U_1(bp + i)) {
+	switch (opttype) {
 	case IP6OPT_PAD1:
 	    if (ndo->ndo_vflag)
                 ND_PRINT("(pad1)");
 	    break;
 	case IP6OPT_PADN:
-	    if (len - i < IP6OPT_MINLEN) {
-		ND_PRINT("(padn: trunc)");
-		goto trunc;
-	    }
 	    if (ndo->ndo_vflag)
                 ND_PRINT("(padn)");
 	    break;
 	case IP6OPT_ROUTER_ALERT:
-	    if (len - i < IP6OPT_RTALERT_LEN) {
-		ND_PRINT("(rtalert: trunc)");
-		goto trunc;
-	    }
-	    if (GET_U_1(bp + i + 1) != IP6OPT_RTALERT_LEN - 2) {
-		ND_PRINT("(rtalert: invalid len %u)", GET_U_1(bp + i + 1));
-		goto trunc;
-	    }
+	    ND_ICHECKMSG_U("(rtalert) remaining length", (u_int)(len - i), <,
+			   IP6OPT_RTALERT_LEN);
+	    ND_ICHECKMSG_U("(rtalert) length", optlen - 2, !=,
+			   IP6OPT_RTALERT_LEN - 2);
 	    if (ndo->ndo_vflag)
 		ND_PRINT("(rtalert: 0x%04x) ", GET_BE_U_2(bp + i + 2));
 	    break;
 	case IP6OPT_JUMBO:
-	    if (len - i < IP6OPT_JUMBO_LEN) {
-		ND_PRINT("(jumbo: trunc)");
-		goto trunc;
-	    }
-	    if (GET_U_1(bp + i + 1) != IP6OPT_JUMBO_LEN - 2) {
-		ND_PRINT("(jumbo: invalid len %u)", GET_U_1(bp + i + 1));
-		goto trunc;
-	    }
+	    ND_ICHECKMSG_U("(jumbo) remaining length", (u_int)(len - i), <,
+			   IP6OPT_JUMBO_LEN);
+	    ND_ICHECKMSG_U("(jumbo) length", optlen - 2, !=,
+			   IP6OPT_JUMBO_LEN - 2);
 	    jumbolen = GET_BE_U_4(bp + i + 2);
 	    if (found_jumbo) {
 		/* More than one Jumbo Payload option */
@@ -176,32 +154,23 @@ ip6_opt_process(netdissect_options *ndo, const u_char *bp, int len,
 	    }
 	    break;
         case IP6OPT_HOME_ADDRESS:
-	    if (len - i < IP6OPT_HOMEADDR_MINLEN) {
-		ND_PRINT("(homeaddr: trunc)");
-		goto trunc;
-	    }
-	    if (GET_U_1(bp + i + 1) < IP6OPT_HOMEADDR_MINLEN - 2) {
-		ND_PRINT("(homeaddr: invalid len %u)", GET_U_1(bp + i + 1));
-		goto trunc;
-	    }
+	    ND_ICHECKMSG_U("(homeaddr) remaining length", (u_int)(len - i), <,
+			   IP6OPT_HOMEADDR_MINLEN);
+	    ND_ICHECKMSG_U("(homeaddr) length", optlen - 2, <,
+			   IP6OPT_HOMEADDR_MINLEN - 2);
 	    if (ndo->ndo_vflag) {
 		ND_PRINT("(homeaddr: %s", GET_IP6ADDR_STRING(bp + i + 2));
-		if (GET_U_1(bp + i + 1) > IP6OPT_HOMEADDR_MINLEN - 2) {
+		if (optlen > IP6OPT_HOMEADDR_MINLEN) {
 		    if (ip6_sopt_print(ndo, bp + i + IP6OPT_HOMEADDR_MINLEN,
 				       (optlen - IP6OPT_HOMEADDR_MINLEN)) == -1)
-			goto trunc;
+			goto invalid;
 		}
 		ND_PRINT(")");
 	    }
 	    break;
 	default:
-	    if (len - i < IP6OPT_MINLEN) {
-		ND_PRINT("(type %u: trunc)", GET_U_1(bp + i));
-		goto trunc;
-	    }
 	    if (ndo->ndo_vflag)
-		ND_PRINT("(opt_type 0x%02x: len=%u)", GET_U_1(bp + i),
-			 GET_U_1(bp + i + 1));
+		ND_PRINT("(unknown opt-type 0x%02x len=%u)", opttype, optlen - 2);
 	    break;
 	}
     }
@@ -209,7 +178,7 @@ ip6_opt_process(netdissect_options *ndo, const u_char *bp, int len,
         ND_PRINT(" ");
     return 0;
 
-trunc:
+invalid:
     return -1;
 }
 
@@ -220,17 +189,18 @@ hbhopt_process(netdissect_options *ndo, const u_char *bp, int *found_jumbo,
     const struct ip6_hbh *dp = (const struct ip6_hbh *)bp;
     u_int hbhlen = 0;
 
-    ndo->ndo_protocol = "hbhopt";
+    ndo->ndo_protocol = "hbh";
     hbhlen = (GET_U_1(dp->ip6h_len) + 1) << 3;
     ND_TCHECK_LEN(dp, hbhlen);
-    ND_PRINT("HBH ");
+    nd_print_protocol_caps(ndo);
+    ND_PRINT(" ");
     if (ip6_opt_process(ndo, (const u_char *)dp + sizeof(*dp),
 			hbhlen - sizeof(*dp), found_jumbo, jumbolen) == -1)
-	goto trunc;
+	goto invalid;
     return hbhlen;
 
-trunc:
-    nd_print_trunc(ndo);
+invalid:
+    nd_print_invalid(ndo);
     return -1;
 }
 
@@ -243,7 +213,8 @@ dstopt_process(netdissect_options *ndo, const u_char *bp)
     ndo->ndo_protocol = "dstopt";
     dstoptlen = (GET_U_1(dp->ip6d_len) + 1) << 3;
     ND_TCHECK_LEN(dp, dstoptlen);
-    ND_PRINT("DSTOPT ");
+    nd_print_protocol_caps(ndo);
+    ND_PRINT(" ");
     if (ndo->ndo_vflag) {
 	/*
 	 * The Jumbo Payload option is a hop-by-hop option; we don't
@@ -252,12 +223,12 @@ dstopt_process(netdissect_options *ndo, const u_char *bp)
 	 */
 	if (ip6_opt_process(ndo, (const u_char *)dp + sizeof(*dp),
 			    dstoptlen - sizeof(*dp), NULL, NULL) == -1)
-	    goto trunc;
+	    goto invalid;
     }
 
     return dstoptlen;
 
-trunc:
-    nd_print_trunc(ndo);
+invalid:
+    nd_print_invalid(ndo);
     return -1;
 }
diff --git a/contrib/tcpdump/print-isakmp.c b/contrib/tcpdump/print-isakmp.c
index 471935e55a45..6a978ad0c7e0 100644
--- a/contrib/tcpdump/print-isakmp.c
+++ b/contrib/tcpdump/print-isakmp.c
@@ -113,9 +113,9 @@ struct isakmp {
 #define ISAKMP_FLAG_extra 0x04
 
 /* IKEv2 */
-#define ISAKMP_FLAG_I (1 << 3)  /* (I)nitiator */
-#define ISAKMP_FLAG_V (1 << 4)  /* (V)ersion   */
-#define ISAKMP_FLAG_R (1 << 5)  /* (R)esponse  */
+#define ISAKMP_FLAG_I (1 << 3)  /* Initiator */
+#define ISAKMP_FLAG_V (1 << 4)  /* Version   */
+#define ISAKMP_FLAG_R (1 << 5)  /* Response  */
 
 
 /* 3.2 Payload Generic Header
@@ -234,7 +234,7 @@ struct ikev1_pl_cr {
 	Certificate Types (variable length)
 	  -- Contains a list of the types of certificates requested,
 	  sorted in order of preference.  Each individual certificate
-	  type is 1 octet.  This field is NOT requiredo
+	  type is 1 octet.  This field is NOT required.
 	*/
 	/* # Certificate Authorities (1 octet) */
 	/* Certificate Authorities (variable length) */
diff --git a/contrib/tcpdump/print-isoclns.c b/contrib/tcpdump/print-isoclns.c
index 5b8c2c2db80f..4695107441e9 100644
--- a/contrib/tcpdump/print-isoclns.c
+++ b/contrib/tcpdump/print-isoclns.c
@@ -1794,7 +1794,7 @@ isis_print_metric_block(netdissect_options *ndo,
 
 static int
 isis_print_tlv_ip_reach(netdissect_options *ndo,
-                        const uint8_t *cp, const char *ident, u_int length)
+                        const uint8_t *cp, const char *indent, u_int length)
 {
 	int prefix_len;
 	const struct isis_tlv_ip_reach *tlv_ip_reach;
@@ -1815,12 +1815,12 @@ isis_print_tlv_ip_reach(netdissect_options *ndo,
 
 		if (prefix_len == -1)
 			ND_PRINT("%sIPv4 prefix: %s mask %s",
-                               ident,
+                               indent,
 			       GET_IPADDR_STRING(tlv_ip_reach->prefix),
 			       GET_IPADDR_STRING(tlv_ip_reach->mask));
 		else
 			ND_PRINT("%sIPv4 prefix: %15s/%u",
-                               ident,
+                               indent,
 			       GET_IPADDR_STRING(tlv_ip_reach->prefix),
 			       prefix_len);
 
@@ -1831,19 +1831,19 @@ isis_print_tlv_ip_reach(netdissect_options *ndo,
 
 		if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_delay))
                     ND_PRINT("%s  Delay Metric: %u, %s",
-                           ident,
+                           indent,
                            ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_delay),
                            ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_delay) ? "External" : "Internal");
 
 		if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_expense))
                     ND_PRINT("%s  Expense Metric: %u, %s",
-                           ident,
+                           indent,
                            ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_expense),
                            ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_expense) ? "External" : "Internal");
 
 		if (!ISIS_LSP_TLV_METRIC_SUPPORTED(tlv_ip_reach->isis_metric_block.metric_error))
                     ND_PRINT("%s  Error Metric: %u, %s",
-                           ident,
+                           indent,
                            ISIS_LSP_TLV_METRIC_VALUE(tlv_ip_reach->isis_metric_block.metric_error),
                            ISIS_LSP_TLV_METRIC_IE(tlv_ip_reach->isis_metric_block.metric_error) ? "External" : "Internal");
 
@@ -1863,11 +1863,11 @@ trunc:
 static int
 isis_print_ip_reach_subtlv(netdissect_options *ndo,
                            const uint8_t *tptr, u_int subt, u_int subl,
-                           const char *ident)
+                           const char *indent)
 {
     /* first lets see if we know the subTLVs name*/
     ND_PRINT("%s%s subTLV #%u, length: %u",
-              ident, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
+              indent, tok2str(isis_ext_ip_reach_subtlv_values, "unknown", subt),
               subt, subl);
 
     ND_TCHECK_LEN(tptr, subl);
@@ -1940,10 +1940,10 @@ trunc:
 
 static int
 isis_print_ext_is_reach(netdissect_options *ndo,
-                        const uint8_t *tptr, const char *ident, u_int tlv_type,
+                        const uint8_t *tptr, const char *indent, u_int tlv_type,
                         u_int tlv_remaining)
 {
-    char ident_buffer[20];
+    char indent_buffer[20];
     u_int subtlv_type,subtlv_len,subtlv_sum_len;
     int proc_bytes = 0; /* how many bytes did we process ? */
     u_int te_class,priority_level,gmpls_switch_cap;
@@ -1956,7 +1956,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
     if (tlv_remaining < NODE_ID_LEN)
         return(0);
 
-    ND_PRINT("%sIS Neighbor: %s", ident, isis_print_id(ndo, tptr, NODE_ID_LEN));
+    ND_PRINT("%sIS Neighbor: %s", indent, isis_print_id(ndo, tptr, NODE_ID_LEN));
     tptr+=NODE_ID_LEN;
     tlv_remaining-=NODE_ID_LEN;
     proc_bytes+=NODE_ID_LEN;
@@ -1982,17 +1982,17 @@ isis_print_ext_is_reach(netdissect_options *ndo,
     if (subtlv_sum_len) {
         ND_PRINT(" (%u)", subtlv_sum_len);
         /* prepend the indent string */
-        snprintf(ident_buffer, sizeof(ident_buffer), "%s  ",ident);
-        ident = ident_buffer;
+        snprintf(indent_buffer, sizeof(indent_buffer), "%s  ", indent);
+        indent = indent_buffer;
         while (subtlv_sum_len != 0) {
             ND_TCHECK_2(tptr);
             if (tlv_remaining < 2) {
-                ND_PRINT("%sRemaining data in TLV shorter than a subTLV header",ident);
+                ND_PRINT("%sRemaining data in TLV shorter than a subTLV header", indent);
                 proc_bytes += tlv_remaining;
                 break;
             }
             if (subtlv_sum_len < 2) {
-                ND_PRINT("%sRemaining data in subTLVs shorter than a subTLV header",ident);
+                ND_PRINT("%sRemaining data in subTLVs shorter than a subTLV header", indent);
                 proc_bytes += subtlv_sum_len;
                 break;
             }
@@ -2003,7 +2003,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
             subtlv_sum_len -= 2;
             proc_bytes += 2;
             ND_PRINT("%s%s subTLV #%u, length: %u",
-                      ident, tok2str(isis_ext_is_reach_subtlv_values, "unknown", subtlv_type),
+                      indent, tok2str(isis_ext_is_reach_subtlv_values, "unknown", subtlv_type),
                       subtlv_type, subtlv_len);
 
             if (subtlv_sum_len < subtlv_len) {
@@ -2047,7 +2047,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                     for (te_class = 0; te_class < 8; te_class++) {
                         bw.i = GET_BE_U_4(tptr);
                         ND_PRINT("%s  TE-Class %u: %.3f Mbps",
-                                  ident,
+                                  indent,
                                   te_class,
                                   bw.f * 8 / 1000000);
                         tptr += 4;
@@ -2062,7 +2062,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                 if (subtlv_len == 0)
                     break;
                 ND_PRINT("%sBandwidth Constraints Model ID: %s (%u)",
-                          ident,
+                          indent,
                           tok2str(diffserv_te_bc_values, "unknown", GET_U_1(tptr)),
                           GET_U_1(tptr));
                 tptr++;
@@ -2075,7 +2075,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                         break;
                     bw.i = GET_BE_U_4(tptr);
                     ND_PRINT("%s  Bandwidth constraint CT%u: %.3f Mbps",
-                              ident,
+                              indent,
                               te_class,
                               bw.f * 8 / 1000000);
                     tptr += 4;
@@ -2123,7 +2123,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                 if (subtlv_len >= 36) {
                     gmpls_switch_cap = GET_U_1(tptr);
                     ND_PRINT("%s  Interface Switching Capability:%s",
-                              ident,
+                              indent,
                               tok2str(gmpls_switch_cap_values, "Unknown", gmpls_switch_cap));
                     ND_PRINT(", LSP Encoding: %s",
                               tok2str(gmpls_encoding_values, "Unknown", GET_U_1((tptr + 1))));
@@ -2131,11 +2131,11 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                     subtlv_len -= 4;
                     subtlv_sum_len -= 4;
                     proc_bytes += 4;
-                    ND_PRINT("%s  Max LSP Bandwidth:", ident);
+                    ND_PRINT("%s  Max LSP Bandwidth:", indent);
                     for (priority_level = 0; priority_level < 8; priority_level++) {
                         bw.i = GET_BE_U_4(tptr);
                         ND_PRINT("%s    priority level %u: %.3f Mbps",
-                                  ident,
+                                  indent,
                                   priority_level,
                                   bw.f * 8 / 1000000);
                         tptr += 4;
@@ -2151,16 +2151,16 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                         if (subtlv_len < 6)
                             break;
                         bw.i = GET_BE_U_4(tptr);
-                        ND_PRINT("%s  Min LSP Bandwidth: %.3f Mbps", ident, bw.f * 8 / 1000000);
-                        ND_PRINT("%s  Interface MTU: %u", ident,
+                        ND_PRINT("%s  Min LSP Bandwidth: %.3f Mbps", indent, bw.f * 8 / 1000000);
+                        ND_PRINT("%s  Interface MTU: %u", indent,
                                  GET_BE_U_2(tptr + 4));
                         break;
                     case GMPLS_TSC:
                         if (subtlv_len < 8)
                             break;
                         bw.i = GET_BE_U_4(tptr);
-                        ND_PRINT("%s  Min LSP Bandwidth: %.3f Mbps", ident, bw.f * 8 / 1000000);
-                        ND_PRINT("%s  Indication %s", ident,
+                        ND_PRINT("%s  Min LSP Bandwidth: %.3f Mbps", indent, bw.f * 8 / 1000000);
+                        ND_PRINT("%s  Indication %s", indent,
                                   tok2str(gmpls_switch_cap_tsc_indication_values, "Unknown (%u)", GET_U_1((tptr + 4))));
                         break;
                     default:
@@ -2175,7 +2175,7 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                 break;
             case ISIS_SUBTLV_EXT_IS_REACH_LAN_ADJ_SEGMENT_ID:
                 if (subtlv_len >= 8) {
-                    ND_PRINT("%s  Flags: [%s]", ident,
+                    ND_PRINT("%s  Flags: [%s]", indent,
                               bittok2str(isis_lan_adj_sid_flag_values,
                                          "none",
                                          GET_U_1(tptr)));
@@ -2185,14 +2185,14 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                     subtlv_len--;
                     subtlv_sum_len--;
                     proc_bytes++;
-                    ND_PRINT("%s  Weight: %u", ident, GET_U_1(tptr));
+                    ND_PRINT("%s  Weight: %u", indent, GET_U_1(tptr));
                     tptr++;
                     subtlv_len--;
                     subtlv_sum_len--;
                     proc_bytes++;
                     if(subtlv_len>=SYSTEM_ID_LEN) {
                         ND_TCHECK_LEN(tptr, SYSTEM_ID_LEN);
-                        ND_PRINT("%s  Neighbor System-ID: %s", ident,
+                        ND_PRINT("%s  Neighbor System-ID: %s", indent,
                             isis_print_id(ndo, tptr, SYSTEM_ID_LEN));
                     }
                     /* RFC 8667 section 2.2.2 */
@@ -2200,10 +2200,10 @@ isis_print_ext_is_reach(netdissect_options *ndo,
                     /* if V-flag is set to 0 and L-flag is set to 0 ==> 4 octet index */
                     if (vflag && lflag) {
                         ND_PRINT("%s  Label: %u",
-                                  ident, GET_BE_U_3(tptr+SYSTEM_ID_LEN));
+                                  indent, GET_BE_U_3(tptr+SYSTEM_ID_LEN));
                     } else if ((!vflag) && (!lflag)) {
                         ND_PRINT("%s  Index: %u",
-                                  ident, GET_BE_U_4(tptr+SYSTEM_ID_LEN));
+                                  indent, GET_BE_U_4(tptr+SYSTEM_ID_LEN));
                     } else
                         nd_print_invalid(ndo);
                 }
@@ -2233,13 +2233,13 @@ trunc:
 
 static uint8_t
 isis_print_mtid(netdissect_options *ndo,
-                const uint8_t *tptr, const char *ident, u_int tlv_remaining)
+                const uint8_t *tptr, const char *indent, u_int tlv_remaining)
 {
     if (tlv_remaining < 2)
         goto trunc;
 
     ND_PRINT("%s%s",
-           ident,
+           indent,
            tok2str(isis_mt_values,
                    "Reserved for IETF Consensus",
                    ISIS_MASK_MTID(GET_BE_U_2(tptr))));
@@ -2262,9 +2262,9 @@ trunc:
 
 static u_int
 isis_print_extd_ip_reach(netdissect_options *ndo,
-                         const uint8_t *tptr, const char *ident, uint16_t afi)
+                         const uint8_t *tptr, const char *indent, uint16_t afi)
 {
-    char ident_buffer[20];
+    char indent_buffer[20];
     uint8_t prefix[sizeof(nd_ipv6)]; /* shared copy buffer for IPv4 and IPv6 prefixes */
     u_int metric, status_byte, bit_length, byte_length, sublen, processed, subtlvtype, subtlvlen;
 
@@ -2278,7 +2278,7 @@ isis_print_extd_ip_reach(netdissect_options *ndo,
         bit_length = status_byte&0x3f;
         if (bit_length > 32) {
             ND_PRINT("%sIPv4 prefix: bad bit length %u",
-                   ident,
+                   indent,
                    bit_length);
             return (0);
         }
@@ -2288,7 +2288,7 @@ isis_print_extd_ip_reach(netdissect_options *ndo,
         bit_length=GET_U_1(tptr + 1);
         if (bit_length > 128) {
             ND_PRINT("%sIPv6 prefix: bad bit length %u",
-                   ident,
+                   indent,
                    bit_length);
             return (0);
         }
@@ -2306,12 +2306,12 @@ isis_print_extd_ip_reach(netdissect_options *ndo,
 
     if (afi == AF_INET)
         ND_PRINT("%sIPv4 prefix: %15s/%u",
-               ident,
+               indent,
                ipaddr_string(ndo, prefix), /* local buffer, not packet data; don't use GET_IPADDR_STRING() */
                bit_length);
     else if (afi == AF_INET6)
         ND_PRINT("%sIPv6 prefix: %s/%u",
-               ident,
+               indent,
                ip6addr_string(ndo, prefix), /* local buffer, not packet data; don't use GET_IP6ADDR_STRING() */
                bit_length);
 
@@ -2343,8 +2343,8 @@ isis_print_extd_ip_reach(netdissect_options *ndo,
             subtlvlen=GET_U_1(tptr + 1);
             tptr+=2;
             /* prepend the indent string */
-            snprintf(ident_buffer, sizeof(ident_buffer), "%s  ",ident);
-            if (!isis_print_ip_reach_subtlv(ndo, tptr, subtlvtype, subtlvlen, ident_buffer))
+            snprintf(indent_buffer, sizeof(indent_buffer), "%s  ", indent);
+            if (!isis_print_ip_reach_subtlv(ndo, tptr, subtlvtype, subtlvlen, indent_buffer))
                 return(0);
             tptr+=subtlvlen;
             sublen-=(subtlvlen+2);
diff --git a/contrib/tcpdump/print-juniper.c b/contrib/tcpdump/print-juniper.c
index f2d5c75977a0..8e30a6d7fa9e 100644
--- a/contrib/tcpdump/print-juniper.c
+++ b/contrib/tcpdump/print-juniper.c
@@ -1009,7 +1009,7 @@ juniper_mlfr_if_print(netdissect_options *ndo,
  *     ATM1 PIC cookie format
  *
  *     +-----+-------------------------+-------------------------------+
- *     |fmtid|     vc index            |  channel  ID                  |
+ *     |fmtid|     vc index            |  channel ID                   |
  *     +-----+-------------------------+-------------------------------+
  */
 
@@ -1070,7 +1070,7 @@ juniper_atm1_if_print(netdissect_options *ndo,
  *     ATM2 PIC cookie format
  *
  *     +-------------------------------+---------+---+-----+-----------+
- *     |     channel ID                |  reserv |AAL| CCRQ| gap cnt   |
+ *     |     channel ID                |reserved |AAL| CCRQ| gap count |
  *     +-------------------------------+---------+---+-----+-----------+
  */
 
diff --git a/contrib/tcpdump/print-lspping.c b/contrib/tcpdump/print-lspping.c
index 837738a7ad55..04a4b21a588f 100644
--- a/contrib/tcpdump/print-lspping.c
+++ b/contrib/tcpdump/print-lspping.c
@@ -587,13 +587,12 @@ lspping_print(netdissect_options *ndo,
            GET_BE_U_4(lspping_com_header->sender_handle),
            GET_BE_U_4(lspping_com_header->seq_number));
 
-    ND_PRINT("\n\t  Sender Timestamp: ");
+    ND_PRINT("\n\t  TimeStamp Sent: ");
     p_ntp_time(ndo, &lspping_com_header->ts_sent);
-    ND_PRINT(" ");
 
     int_part=GET_BE_U_4(lspping_com_header->ts_rcvd.int_part);
     fraction=GET_BE_U_4(lspping_com_header->ts_rcvd.fraction);
-    ND_PRINT("Receiver Timestamp: ");
+    ND_PRINT("\n\t  TimeStamp Received: ");
     if (! (int_part == 0 && fraction == 0))
         p_ntp_time(ndo, &lspping_com_header->ts_rcvd);
     else
diff --git a/contrib/tcpdump/print-lwapp.c b/contrib/tcpdump/print-lwapp.c
index 7cee32e02735..9144dbd70b97 100644
--- a/contrib/tcpdump/print-lwapp.c
+++ b/contrib/tcpdump/print-lwapp.c
@@ -73,9 +73,9 @@ struct lwapp_control_header {
 #define LWAPP_EXTRACT_CONTROL_BIT(x) (((x)&0x04)>>2)
 
 static const struct tok lwapp_header_bits_values[] = {
-    { 0x01, "Last Fragment Bit"},
-    { 0x02, "Fragment Bit"},
-    { 0x04, "Control Bit"},
+    { 0x01, "Not Last"},	/* L Bit */
+    { 0x02, "Fragment"},	/* F Bit */
+    { 0x04, "Control"},		/* C Bit */
     { 0, NULL}
 };
 
@@ -188,18 +188,18 @@ lwapp_control_print(netdissect_options *ndo,
      * Sanity checking of the header.
      */
     if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
-	ND_PRINT("LWAPP version %u packet not supported",
-               LWAPP_EXTRACT_VERSION(version));
-	return;
+        ND_PRINT("LWAPP version %u packet not supported",
+                 LWAPP_EXTRACT_VERSION(version));
+        return;
     }
 
     /* non-verbose */
     if (ndo->ndo_vflag < 1) {
         ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
-               LWAPP_EXTRACT_VERSION(version),
-               LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
-               bittok2str(lwapp_header_bits_values,"none",version&0x07),
-               len);
+                 LWAPP_EXTRACT_VERSION(version),
+                 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
+                 bittok2str(lwapp_header_bits_values,"none",version&0x07),
+                 len);
         return;
     }
 
@@ -207,12 +207,12 @@ lwapp_control_print(netdissect_options *ndo,
     tlen=GET_BE_U_2(lwapp_trans_header->length);
 
     ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
-           LWAPP_EXTRACT_VERSION(version),
-           LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
-           LWAPP_EXTRACT_RID(version),
-           bittok2str(lwapp_header_bits_values,"none",version&0x07),
-	   GET_U_1(lwapp_trans_header->frag_id),
-	   tlen);
+             LWAPP_EXTRACT_VERSION(version),
+             LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
+             LWAPP_EXTRACT_RID(version),
+             bittok2str(lwapp_header_bits_values,"none",version&0x07),
+             GET_U_1(lwapp_trans_header->frag_id),
+             tlen);
 
     if (has_ap_ident) {
         ND_PRINT("\n\tAP identity: %s", GET_ETHERADDR_STRING(tptr));
@@ -231,25 +231,25 @@ lwapp_control_print(netdissect_options *ndo,
         }
 
         lwapp_control_header = (const struct lwapp_control_header *)tptr;
-	msg_tlen = GET_BE_U_2(lwapp_control_header->len);
+        msg_tlen = GET_BE_U_2(lwapp_control_header->len);
         if (tlen < sizeof(struct lwapp_control_header) + msg_tlen) {
             ND_PRINT("\n\t  Msg goes past end of PDU");
             break;
         }
 
-	/* print message header */
-	msg_type = GET_U_1(lwapp_control_header->msg_type);
+        /* print message header */
+        msg_type = GET_U_1(lwapp_control_header->msg_type);
         ND_PRINT("\n\t  Msg type: %s (%u), Seqnum: %u, Msg len: %u, Session: 0x%08x",
-               tok2str(lwapp_msg_type_values,"Unknown",msg_type),
-               msg_type,
-               GET_U_1(lwapp_control_header->seq_num),
-               msg_tlen,
-               GET_BE_U_4(lwapp_control_header->session_id));
+                 tok2str(lwapp_msg_type_values,"Unknown",msg_type),
+                 msg_type,
+                 GET_U_1(lwapp_control_header->seq_num),
+                 msg_tlen,
+                 GET_BE_U_4(lwapp_control_header->session_id));
 
         /* did we capture enough for fully decoding the message */
         ND_TCHECK_LEN(tptr, msg_tlen);
 
-	/* XXX - Decode sub messages for each message */
+        /* XXX - Decode sub messages for each message */
         switch(msg_type) {
         case LWAPP_MSGTYPE_DISCOVERY_REQUEST:
         case LWAPP_MSGTYPE_DISCOVERY_RESPONSE:
@@ -318,39 +318,39 @@ lwapp_data_print(netdissect_options *ndo,
      */
     if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
         ND_PRINT("LWAPP version %u packet not supported",
-               LWAPP_EXTRACT_VERSION(version));
+                 LWAPP_EXTRACT_VERSION(version));
         return;
     }
 
     /* non-verbose */
     if (ndo->ndo_vflag < 1) {
         ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
-               LWAPP_EXTRACT_VERSION(version),
-               LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
-               bittok2str(lwapp_header_bits_values,"none",version&0x07),
-               len);
+                 LWAPP_EXTRACT_VERSION(version),
+                 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
+                 bittok2str(lwapp_header_bits_values,"none",version&0x07),
+                 len);
         return;
     }
 
     /* ok they seem to want to know everything - lets fully decode it */
     tlen=GET_BE_U_2(lwapp_trans_header->length);
     if (tlen < sizeof(struct lwapp_transport_header)) {
-        ND_PRINT("LWAPPv%u, %s frame, Radio-id  %u, Flags [%s], length %u < transport header length",
-               LWAPP_EXTRACT_VERSION(version),
-               LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
-               LWAPP_EXTRACT_RID(version),
-               bittok2str(lwapp_header_bits_values,"none",version&0x07),
-               tlen);
+        ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], length %u < transport header length",
+                 LWAPP_EXTRACT_VERSION(version),
+                 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
+                 LWAPP_EXTRACT_RID(version),
+                 bittok2str(lwapp_header_bits_values,"none",version&0x07),
+                 tlen);
         return;
     }
 
-    ND_PRINT("LWAPPv%u, %s frame, Radio-id  %u, Flags [%s], Frag-id  %u, length %u",
-           LWAPP_EXTRACT_VERSION(version),
-           LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
-           LWAPP_EXTRACT_RID(version),
-           bittok2str(lwapp_header_bits_values,"none",version&0x07),
-           GET_U_1(lwapp_trans_header->frag_id),
-           tlen);
+    ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
+             LWAPP_EXTRACT_VERSION(version),
+             LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
+             LWAPP_EXTRACT_RID(version),
+             bittok2str(lwapp_header_bits_values,"none",version&0x07),
+             GET_U_1(lwapp_trans_header->frag_id),
+             tlen);
 
     tptr+=sizeof(struct lwapp_transport_header);
     tlen-=sizeof(struct lwapp_transport_header);
diff --git a/contrib/tcpdump/print-mobility.c b/contrib/tcpdump/print-mobility.c
index 945a8ca2b51c..1c044926c154 100644
--- a/contrib/tcpdump/print-mobility.c
+++ b/contrib/tcpdump/print-mobility.c
@@ -28,19 +28,19 @@
  */
 
 /* \summary: IPv6 mobility printer */
-/* RFC 3775 */
+/* RFC 6275 */
 
 #include <config.h>
 
 #include "netdissect-stdinc.h"
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
 #include "ip6.h"
 
-
 /* Mobility header */
 struct ip6_mobility {
 	nd_uint8_t ip6m_pproto;	/* following payload protocol (for PG) */
@@ -90,8 +90,8 @@ static const unsigned ip6m_hdrlen[IP6M_MAX + 1] = {
 	IP6M_MINLEN + 8,  /* IP6M_CAREOF_TEST_INIT */
 	IP6M_MINLEN + 16, /* IP6M_HOME_TEST        */
 	IP6M_MINLEN + 16, /* IP6M_CAREOF_TEST      */
-	IP6M_MINLEN + 4,  /* IP6M_BINDING_UPDATE   */
-	IP6M_MINLEN + 4,  /* IP6M_BINDING_ACK      */
+	IP6M_MINLEN + 8,  /* IP6M_BINDING_UPDATE   */
+	IP6M_MINLEN + 8,  /* IP6M_BINDING_ACK      */
 	IP6M_MINLEN + 16, /* IP6M_BINDING_ERROR    */
 };
 
@@ -120,78 +120,62 @@ static int
 mobility_opt_print(netdissect_options *ndo,
                    const u_char *bp, const unsigned len)
 {
-	unsigned i, optlen;
+	unsigned i, opttype, optlen;
 
 	for (i = 0; i < len; i += optlen) {
-		if (GET_U_1(bp + i) == IP6MOPT_PAD1)
+		opttype = GET_U_1(bp + i);
+		if (opttype == IP6MOPT_PAD1)
 			optlen = 1;
 		else {
-			if (i + 1 < len) {
-				optlen = GET_U_1(bp + i + 1) + 2;
-			} else
-				goto trunc;
+			ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+				       IP6MOPT_MINLEN);
+			optlen = GET_U_1(bp + i + 1) + 2;
 		}
-		if (i + optlen > len)
-			goto trunc;
-		ND_TCHECK_1(bp + i + optlen);
+		ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <, optlen);
+		ND_TCHECK_LEN(bp + i, optlen);
 
-		switch (GET_U_1(bp + i)) {
+		switch (opttype) {
 		case IP6MOPT_PAD1:
 			ND_PRINT("(pad1)");
 			break;
 		case IP6MOPT_PADN:
-			if (len - i < IP6MOPT_MINLEN) {
-				ND_PRINT("(padn: trunc)");
-				goto trunc;
-			}
 			ND_PRINT("(padn)");
 			break;
 		case IP6MOPT_REFRESH:
-			if (len - i < IP6MOPT_REFRESH_MINLEN) {
-				ND_PRINT("(refresh: trunc)");
-				goto trunc;
-			}
+			ND_PRINT("(refresh: ");
+			ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+				       IP6MOPT_REFRESH_MINLEN);
 			/* units of 4 secs */
-			ND_PRINT("(refresh: %u)",
-				GET_BE_U_2(bp + i + 2) << 2);
+			ND_PRINT("%u)", GET_BE_U_2(bp + i + 2) << 2);
 			break;
 		case IP6MOPT_ALTCOA:
-			if (len - i < IP6MOPT_ALTCOA_MINLEN) {
-				ND_PRINT("(altcoa: trunc)");
-				goto trunc;
-			}
-			ND_PRINT("(alt-CoA: %s)", GET_IP6ADDR_STRING(bp + i + 2));
+			ND_PRINT("(alt-CoA: ");
+			ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+				       IP6MOPT_ALTCOA_MINLEN);
+			ND_PRINT("%s)", GET_IP6ADDR_STRING(bp + i + 2));
 			break;
 		case IP6MOPT_NONCEID:
-			if (len - i < IP6MOPT_NONCEID_MINLEN) {
-				ND_PRINT("(ni: trunc)");
-				goto trunc;
-			}
-			ND_PRINT("(ni: ho=0x%04x co=0x%04x)",
-				GET_BE_U_2(bp + i + 2),
-				GET_BE_U_2(bp + i + 4));
+			ND_PRINT("(ni: ");
+			ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+				       IP6MOPT_NONCEID_MINLEN);
+			ND_PRINT("ho=0x%04x co=0x%04x)",
+				 GET_BE_U_2(bp + i + 2),
+				 GET_BE_U_2(bp + i + 4));
 			break;
 		case IP6MOPT_AUTH:
-			if (len - i < IP6MOPT_AUTH_MINLEN) {
-				ND_PRINT("(auth: trunc)");
-				goto trunc;
-			}
 			ND_PRINT("(auth)");
+			ND_ICHECKMSG_U("remaining length", (u_int)(len - i), <,
+				       IP6MOPT_AUTH_MINLEN);
 			break;
 		default:
-			if (len - i < IP6MOPT_MINLEN) {
-				ND_PRINT("(sopt_type %u: trunc)",
-					 GET_U_1(bp + i));
-				goto trunc;
-			}
-			ND_PRINT("(type-0x%02x: len=%u)", GET_U_1(bp + i),
-				 GET_U_1(bp + i + 1));
+			ND_PRINT("(unknown: ");
+			ND_PRINT("type-#%u len=%u)", opttype, optlen - 2);
 			break;
 		}
 	}
 	return 0;
 
-trunc:
+invalid:
 	return 1;
 }
 
@@ -203,42 +187,29 @@ mobility_print(netdissect_options *ndo,
                const u_char *bp, const u_char *bp2 _U_)
 {
 	const struct ip6_mobility *mh;
-	const u_char *ep;
 	unsigned mhlen, hlen;
-	uint8_t type;
+	uint8_t pproto, type;
 
 	ndo->ndo_protocol = "mobility";
+	nd_print_protocol(ndo);
+	ND_PRINT(": ");
 	mh = (const struct ip6_mobility *)bp;
 
-	/* 'ep' points to the end of available data. */
-	ep = ndo->ndo_snapend;
+	pproto = GET_U_1(mh->ip6m_pproto);
+	if (pproto != IPPROTO_NONE)
+		ND_PRINT("(payload protocol %u should be %u) ", pproto,
+			 IPPROTO_NONE);
 
-	if (!ND_TTEST_1(mh->ip6m_len)) {
-		/*
-		 * There's not enough captured data to include the
-		 * mobility header length.
-		 *
-		 * Our caller expects us to return the length, however,
-		 * so return a value that will run to the end of the
-		 * captured data.
-		 *
-		 * XXX - "ip6_print()" doesn't do anything with the
-		 * returned length, however, as it breaks out of the
-		 * header-processing loop.
-		 */
-		mhlen = (unsigned)(ep - bp);
-		goto trunc;
-	}
 	mhlen = (GET_U_1(mh->ip6m_len) + 1) << 3;
 
 	/* XXX ip6m_cksum */
 
 	type = GET_U_1(mh->ip6m_type);
+	ND_PRINT("%s", tok2str(ip6m_str, "type-#%u", type));
 	if (type <= IP6M_MAX && mhlen < ip6m_hdrlen[type]) {
-		ND_PRINT("(header length %u is too small for type %u)", mhlen, type);
-		goto trunc;
+		ND_PRINT(" (header length %u < %u)", mhlen, ip6m_hdrlen[type]);
+		goto invalid;
 	}
-	ND_PRINT("mobility: %s", tok2str(ip6m_str, "type-#%u", type));
 	switch (type) {
 	case IP6M_BINDING_REQUEST:
 		hlen = IP6M_MINLEN;
@@ -248,9 +219,9 @@ mobility_print(netdissect_options *ndo,
 		hlen = IP6M_MINLEN;
 		if (ndo->ndo_vflag) {
 			ND_PRINT(" %s Init Cookie=%08x:%08x",
-			       type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
-			       GET_BE_U_4(bp + hlen),
-			       GET_BE_U_4(bp + hlen + 4));
+			         type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
+			         GET_BE_U_4(bp + hlen),
+			         GET_BE_U_4(bp + hlen + 4));
 		}
 		hlen += 8;
 		break;
@@ -260,16 +231,16 @@ mobility_print(netdissect_options *ndo,
 		hlen = IP6M_MINLEN;
 		if (ndo->ndo_vflag) {
 			ND_PRINT(" %s Init Cookie=%08x:%08x",
-			       type == IP6M_HOME_TEST ? "Home" : "Care-of",
-			       GET_BE_U_4(bp + hlen),
-			       GET_BE_U_4(bp + hlen + 4));
+			         type == IP6M_HOME_TEST ? "Home" : "Care-of",
+			         GET_BE_U_4(bp + hlen),
+			         GET_BE_U_4(bp + hlen + 4));
 		}
 		hlen += 8;
 		if (ndo->ndo_vflag) {
 			ND_PRINT(" %s Keygen Token=%08x:%08x",
-			       type == IP6M_HOME_TEST ? "Home" : "Care-of",
-			       GET_BE_U_4(bp + hlen),
-			       GET_BE_U_4(bp + hlen + 4));
+			         type == IP6M_HOME_TEST ? "Home" : "Care-of",
+			         GET_BE_U_4(bp + hlen),
+			         GET_BE_U_4(bp + hlen + 4));
 		}
 		hlen += 8;
 		break;
@@ -278,7 +249,6 @@ mobility_print(netdissect_options *ndo,
 		int bits;
 		ND_PRINT(" seq#=%u", GET_BE_U_2(mh->ip6m_data16[0]));
 		hlen = IP6M_MINLEN;
-		ND_TCHECK_2(bp + hlen);
 		bits = (GET_U_1(bp + hlen) & 0xf0) >> 4;
 		if (bits) {
 			ND_PRINT(" ");
@@ -321,11 +291,11 @@ mobility_print(netdissect_options *ndo,
 	}
 	if (ndo->ndo_vflag)
 		if (mobility_opt_print(ndo, bp + hlen, mhlen - hlen))
-			goto trunc;
+			goto invalid;
 
 	return(mhlen);
 
- trunc:
-	nd_print_trunc(ndo);
+invalid:
+	nd_print_invalid(ndo);
 	return(-1);
 }
diff --git a/contrib/tcpdump/print-msdp.c b/contrib/tcpdump/print-msdp.c
index 61a332d9d6bd..1d01233c6551 100644
--- a/contrib/tcpdump/print-msdp.c
+++ b/contrib/tcpdump/print-msdp.c
@@ -20,6 +20,7 @@
 
 #include <config.h>
 
+#define ND_LONGJMP_FROM_TCHECK
 #include "netdissect-stdinc.h"
 
 #include "netdissect.h"
@@ -42,6 +43,10 @@ msdp_print(netdissect_options *ndo, const u_char *sp, u_int length)
 	if (len > 1500 || len < 3 || type == 0 || type > MSDP_TYPE_MAX)
 		goto trunc;	/* not really truncated, but still not decodable */
 	while (length != 0) {
+		unsigned int entry_count;
+
+		if (length < 3)
+			goto trunc;
 		type = GET_U_1(sp);
 		len = GET_BE_U_2(sp + 1);
 		if (len > 1400 || ndo->ndo_vflag)
@@ -50,8 +55,6 @@ msdp_print(netdissect_options *ndo, const u_char *sp, u_int length)
 			goto trunc;
 		if (length < len)
 			goto trunc;
-		sp += 3;
-		length -= 3;
 		switch (type) {
 		case 1:	/* IPv4 Source-Active */
 		case 3: /* IPv4 Source-Active Response */
@@ -59,20 +62,47 @@ msdp_print(netdissect_options *ndo, const u_char *sp, u_int length)
 				ND_PRINT(" SA");
 			else
 				ND_PRINT(" SA-Response");
-			ND_PRINT(" %u entries", GET_U_1(sp));
-			if ((u_int)((GET_U_1(sp) * 12) + 8) < len) {
+
+			/* Entry Count */
+			if (len < 4)
+				goto trunc;
+			entry_count = GET_U_1(sp + 3);
+			ND_PRINT(" %u entries", entry_count);
+
+			/* RP Address */
+			if (len < 8)
+				goto trunc;
+			/* XXX -print this based on ndo_vflag? */
+			ND_TCHECK_LEN(sp + 4, 4);
+
+			/* Entries */
+			ND_TCHECK_LEN(sp + 8, entry_count*12);
+
+			if (len > (8 + entry_count*12)) {
+				/* Encapsulated IP packet */
 				ND_PRINT(" [w/data]");
 				if (ndo->ndo_vflag > 1) {
 					ND_PRINT(" ");
-					ip_print(ndo, sp +
-						 GET_U_1(sp) * 12 + 8 - 3,
-						 len - (GET_U_1(sp) * 12 + 8));
+					ip_print(ndo, sp + (8 + entry_count*12),
+					    len - (8 + entry_count*12));
 				}
 			}
 			break;
 		case 2:
+			/* draft-ietf-msdp-spec-13 */
 			ND_PRINT(" SA-Request");
-			ND_PRINT(" for %s", GET_IPADDR_STRING(sp + 1));
+
+			/* Reserved */
+			if (len < 4)
+				goto trunc;
+			ND_TCHECK_1(sp + 3);
+
+			/* Group Address */
+			if (len < 8)
+				goto trunc;
+			if (len != 8)
+				ND_PRINT("[len=%u] ", len);
+			ND_PRINT(" for %s", GET_IPADDR_STRING(sp + 4));
 			break;
 		case 4:
 			ND_PRINT(" Keepalive");
@@ -86,8 +116,9 @@ msdp_print(netdissect_options *ndo, const u_char *sp, u_int length)
 			ND_PRINT(" [type=%u len=%u]", type, len);
 			break;
 		}
-		sp += (len - 3);
-		length -= (len - 3);
+		ND_TCHECK_LEN(sp, len);
+		sp += len;
+		length -= len;
 	}
 	return;
 trunc:
diff --git a/contrib/tcpdump/print-ntp.c b/contrib/tcpdump/print-ntp.c
index 30bef73172e9..9d97363f6816 100644
--- a/contrib/tcpdump/print-ntp.c
+++ b/contrib/tcpdump/print-ntp.c
@@ -64,7 +64,7 @@
  * |                                                               |
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  * |                                                               |
- * |                   Originate Timestamp (64)                    |
+ * |                     Origin Timestamp (64)                     |
  * |                                                               |
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  * |                                                               |
@@ -284,7 +284,7 @@ ntp_time_print(netdissect_options *ndo,
 	p_ntp_time(ndo, &(bp->ref_timestamp));
 
 	ND_TCHECK_SIZE(&bp->org_timestamp);
-	ND_PRINT("\n\t  Originator Timestamp: ");
+	ND_PRINT("\n\t  Origin Timestamp:     ");
 	p_ntp_time(ndo, &(bp->org_timestamp));
 
 	ND_TCHECK_SIZE(&bp->rec_timestamp);
diff --git a/contrib/tcpdump/print-otv.c b/contrib/tcpdump/print-otv.c
deleted file mode 100644
index 1303740009a0..000000000000
--- a/contrib/tcpdump/print-otv.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that: (1) source code
- * distributions retain the above copyright notice and this paragraph
- * in its entirety, and (2) distributions including binary code include
- * the above copyright notice and this paragraph in its entirety in
- * the documentation or other materials provided with the distribution.
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
- * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
- * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE.
- *
- * Original code by Francesco Fondelli (francesco dot fondelli, gmail dot com)
- */
-
-/* \summary: Overlay Transport Virtualization (OTV) printer */
-
-/* specification: draft-hasmit-otv-04 */
-
-#include <config.h>
-
-#include "netdissect-stdinc.h"
-
-#define ND_LONGJMP_FROM_TCHECK
-#include "netdissect.h"
-#include "extract.h"
-
-#define OTV_HDR_LEN 8
-
-/*
- * OTV header, draft-hasmit-otv-04
- *
- *     0                   1                   2                   3
- *     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
- *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- *     |R|R|R|R|I|R|R|R|           Overlay ID                          |
- *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- *     |          Instance ID                          | Reserved      |
- *     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- */
-
-void
-otv_print(netdissect_options *ndo, const u_char *bp, u_int len)
-{
-    uint8_t flags;
-
-    ndo->ndo_protocol = "otv";
-    ND_PRINT("OTV, ");
-    if (len < OTV_HDR_LEN) {
-        ND_PRINT("[length %u < %u]", len, OTV_HDR_LEN);
-        goto invalid;
-    }
-
-    flags = GET_U_1(bp);
-    ND_PRINT("flags [%s] (0x%02x), ", flags & 0x08 ? "I" : ".", flags);
-    bp += 1;
-
-    ND_PRINT("overlay %u, ", GET_BE_U_3(bp));
-    bp += 3;
-
-    ND_PRINT("instance %u\n", GET_BE_U_3(bp));
-    bp += 3;
-
-    /* Reserved */
-    ND_TCHECK_1(bp);
-    bp += 1;
-
-    ether_print(ndo, bp, len - OTV_HDR_LEN, ND_BYTES_AVAILABLE_AFTER(bp), NULL, NULL);
-    return;
-
-invalid:
-    nd_print_invalid(ndo);
-    ND_TCHECK_LEN(bp, len);
-}
diff --git a/contrib/tcpdump/print-pflog.c b/contrib/tcpdump/print-pflog.c
index 71bf01f07555..474f43d74db1 100644
--- a/contrib/tcpdump/print-pflog.c
+++ b/contrib/tcpdump/print-pflog.c
@@ -64,7 +64,7 @@ static const struct tok pf_actions[] = {
 	{ PF_PASS,		"pass" },
 	{ PF_DROP,		"block" },
 	{ PF_SCRUB,		"scrub" },
-	{ PF_NOSCRUB,		"scrub" },
+	{ PF_NOSCRUB,		"noscrub" },
 	{ PF_NAT,		"nat" },
 	{ PF_NONAT,		"nonat" },
 	{ PF_BINAT,		"binat" },
diff --git a/contrib/tcpdump/print-ppp.c b/contrib/tcpdump/print-ppp.c
index ccce71539790..91b3a792aaac 100644
--- a/contrib/tcpdump/print-ppp.c
+++ b/contrib/tcpdump/print-ppp.c
@@ -42,8 +42,6 @@
 #include <net/if_ppp.h>
 #endif
 
-#include <stdlib.h>
-
 #include "netdissect.h"
 #include "extract.h"
 #include "addrtoname.h"
diff --git a/contrib/tcpdump/print-ptp.c b/contrib/tcpdump/print-ptp.c
index 09180110a818..4fc0a4550ed0 100644
--- a/contrib/tcpdump/print-ptp.c
+++ b/contrib/tcpdump/print-ptp.c
@@ -292,10 +292,10 @@ static void ptp_print_2(netdissect_options *ndo, const u_char *bp, u_int len);
 static void ptp_print_timestamp(netdissect_options *ndo, const u_char *bp, u_int *len, const char *stype);
 static void ptp_print_timestamp_identity(netdissect_options *ndo, const u_char *bp, u_int *len, const char *ttype);
 static void ptp_print_announce_msg(netdissect_options *ndo, const u_char *bp, u_int *len);
-static void ptp_print_port_id(netdissect_options *ndo, const u_char *bp, u_int *len);
+static const u_char *ptp_print_port_id(netdissect_options *ndo, const u_char *bp, u_int *len);
 static void ptp_print_mgmt_msg(netdissect_options *ndo, const u_char *bp, u_int *len);
 
-static void
+static const u_char *
 print_field(netdissect_options *ndo, const char *st, uint32_t flen,
             const u_char *bp, u_int *len, uint8_t hex)
 {
@@ -344,6 +344,8 @@ print_field(netdissect_options *ndo, const char *st, uint32_t flen,
         default:
             break;
     }
+
+    return bp;
 }
 
 static void
@@ -365,47 +367,47 @@ ptp_print_2(netdissect_options *ndo, const u_char *bp, u_int length)
 
     foct = GET_U_1(bp);
     major_sdo_id = (foct & PTP_MAJOR_SDO_ID_MASK) >> 4;
-    ND_PRINT(", majorSdoId : 0x%x", major_sdo_id);
+    ND_PRINT(", majorSdoId: 0x%x", major_sdo_id);
     msg_type = foct & PTP_MSG_TYPE_MASK;
-    ND_PRINT(", msg type : %s", tok2str(ptp_msg_type, "Reserved", msg_type));
+    ND_PRINT(", msg type: %s", tok2str(ptp_msg_type, "Reserved", msg_type));
 
     /* msg length */
-    len -= 2; bp += 2; msg_len = GET_BE_U_2(bp); ND_PRINT(", length : %u", msg_len);
+    len -= 2; bp += 2; msg_len = GET_BE_U_2(bp); ND_PRINT(", length: %u", msg_len);
 
     /* domain */
-    len -= 2; bp += 2; domain_no = (GET_BE_U_2(bp) & PTP_DOMAIN_MASK) >> 8; ND_PRINT(", domain : %u", domain_no);
+    len -= 2; bp += 2; domain_no = (GET_BE_U_2(bp) & PTP_DOMAIN_MASK) >> 8; ND_PRINT(", domain: %u", domain_no);
 
     /* rsvd 1*/
     rsvd1 = GET_BE_U_2(bp) & PTP_RSVD1_MASK;
-    ND_PRINT(", reserved1 : %u", rsvd1);
+    ND_PRINT(", reserved1: %u", rsvd1);
 
     /* flags */
     len -= 2; bp += 2; flags = GET_BE_U_2(bp); ND_PRINT(", Flags [%s]", bittok2str(ptp_flag_values, "none", flags));
 
     /* correction NS (48 bits) */
-    len -= 2; bp += 2; ns_corr = GET_BE_U_6(bp); ND_PRINT(", NS correction : %"PRIu64, ns_corr);
+    len -= 2; bp += 2; ns_corr = GET_BE_U_6(bp); ND_PRINT(", NS correction: %"PRIu64, ns_corr);
 
     /* correction sub NS (16 bits) */
-    len -= 6; bp += 6; sns_corr = GET_BE_U_2(bp); ND_PRINT(", sub NS correction : %u", sns_corr);
+    len -= 6; bp += 6; sns_corr = GET_BE_U_2(bp); ND_PRINT(", sub NS correction: %u", sns_corr);
 
     /* Reserved 2 */
-    len -= 2; bp += 2; rsvd2 = GET_BE_U_4(bp); ND_PRINT(", reserved2 : %u", rsvd2);
+    len -= 2; bp += 2; rsvd2 = GET_BE_U_4(bp); ND_PRINT(", reserved2: %u", rsvd2);
 
     /* clock identity */
-    len -= 4; bp += 4; clk_id = GET_BE_U_8(bp); ND_PRINT(", clock identity : 0x%"PRIx64, clk_id);
+    len -= 4; bp += 4; clk_id = GET_BE_U_8(bp); ND_PRINT(", clock identity: 0x%"PRIx64, clk_id);
 
     /* port identity */
-    len -= 8; bp += 8; port_id = GET_BE_U_2(bp); ND_PRINT(", port id : %u", port_id);
+    len -= 8; bp += 8; port_id = GET_BE_U_2(bp); ND_PRINT(", port id: %u", port_id);
 
     /* sequence ID */
-    len -= 2; bp += 2; seq_id = GET_BE_U_2(bp); ND_PRINT(", seq id : %u", seq_id);
+    len -= 2; bp += 2; seq_id = GET_BE_U_2(bp); ND_PRINT(", seq id: %u", seq_id);
 
     /* control */
     len -= 2; bp += 2; control = GET_U_1(bp) ;
-    ND_PRINT(", control : %u (%s)", control, tok2str(ptp_control_field, "Reserved", control));
+    ND_PRINT(", control: %u (%s)", control, tok2str(ptp_control_field, "Reserved", control));
 
     /* log message interval */
-    lm_int = GET_BE_U_2(bp) & PTP_LOGMSG_MASK; ND_PRINT(", log message interval : %u", lm_int); len -= 2; bp += 2;
+    lm_int = GET_BE_U_2(bp) & PTP_LOGMSG_MASK; ND_PRINT(", log message interval: %u", lm_int); len -= 2; bp += 2;
 
     switch(msg_type) {
         case M_SYNC:
@@ -489,7 +491,7 @@ ptp_print_timestamp(netdissect_options *ndo, const u_char *bp, u_int *len, const
     uint64_t secs;
     uint32_t nsecs;
 
-    ND_PRINT(", %s :", stype);
+    ND_PRINT(", %s:", stype);
     /* sec time stamp 6 bytes */
     secs = GET_BE_U_6(bp);
     ND_PRINT(" %"PRIu64" seconds,", secs);
@@ -511,7 +513,7 @@ ptp_print_timestamp_identity(netdissect_options *ndo,
     uint16_t port_id;
     uint64_t port_identity;
 
-    ND_PRINT(", %s :", ttype);
+    ND_PRINT(", %s:", ttype);
     /* sec time stamp 6 bytes */
     secs = GET_BE_U_6(bp);
     ND_PRINT(" %"PRIu64" seconds,", secs);
@@ -526,13 +528,13 @@ ptp_print_timestamp_identity(netdissect_options *ndo,
 
     /* port identity*/
     port_identity = GET_BE_U_8(bp);
-    ND_PRINT(", port identity : 0x%"PRIx64, port_identity);
+    ND_PRINT(", port identity: 0x%"PRIx64, port_identity);
     *len -= 8;
     bp += 8;
 
     /* port id */
     port_id = GET_BE_U_2(bp);
-    ND_PRINT(", port id : %u", port_id);
+    ND_PRINT(", port id: %u", port_id);
     *len -= 2;
     bp += 2;
 }
@@ -545,7 +547,7 @@ ptp_print_announce_msg(netdissect_options *ndo, const u_char *bp, u_int *len)
     uint64_t secs;
     uint32_t nsecs;
 
-    ND_PRINT(", %s :", p_origin_ts);
+    ND_PRINT(", %s:", p_origin_ts);
     /* sec time stamp 6 bytes */
     secs = GET_BE_U_6(bp);
     ND_PRINT(" %"PRIu64" seconds", secs);
@@ -560,61 +562,62 @@ ptp_print_announce_msg(netdissect_options *ndo, const u_char *bp, u_int *len)
 
     /* origin cur utc */
     origin_cur_utc = GET_BE_U_2(bp);
-    ND_PRINT(", origin cur utc :%u", origin_cur_utc);
+    ND_PRINT(", origin cur utc:%u", origin_cur_utc);
     *len -= 2;
     bp += 2;
 
     /* rsvd */
     rsvd = GET_U_1(bp);
-    ND_PRINT(", rsvd : %u", rsvd);
+    ND_PRINT(", rsvd: %u", rsvd);
     *len -= 1;
     bp += 1;
 
     /* gm prio */
     gm_prio_1 = GET_U_1(bp);
-    ND_PRINT(", gm priority_1 : %u", gm_prio_1);
+    ND_PRINT(", gm priority_1: %u", gm_prio_1);
     *len -= 1;
     bp += 1;
 
     /* GM clock class */
     gm_clk_cls = GET_U_1(bp);
-    ND_PRINT(", gm clock class : %u", gm_clk_cls);
+    ND_PRINT(", gm clock class: %u", gm_clk_cls);
     *len -= 1;
     bp += 1;
     /* GM clock accuracy */
     gm_clk_acc = GET_U_1(bp);
-    ND_PRINT(", gm clock accuracy : %u", gm_clk_acc);
+    ND_PRINT(", gm clock accuracy: %u", gm_clk_acc);
     *len -= 1;
     bp += 1;
     /* GM clock variance */
     gm_clk_var = GET_BE_U_2(bp);
-    ND_PRINT(", gm clock variance : %u", gm_clk_var);
+    ND_PRINT(", gm clock variance: %u", gm_clk_var);
     *len -= 2;
     bp += 2;
     /* GM Prio 2 */
     gm_prio_2 = GET_U_1(bp);
-    ND_PRINT(", gm priority_2 : %u", gm_prio_2);
+    ND_PRINT(", gm priority_2: %u", gm_prio_2);
     *len -= 1;
     bp += 1;
 
     /* GM Clock Identity */
     gm_clock_id = GET_BE_U_8(bp);
-    ND_PRINT(", gm clock id : 0x%"PRIx64, gm_clock_id);
+    ND_PRINT(", gm clock id: 0x%"PRIx64, gm_clock_id);
     *len -= 8;
     bp += 8;
     /* steps removed */
     steps_removed = GET_BE_U_2(bp);
-    ND_PRINT(", steps removed : %u", steps_removed);
+    ND_PRINT(", steps removed: %u", steps_removed);
     *len -= 2;
     bp += 2;
     /* Time source */
     time_src = GET_U_1(bp);
-    ND_PRINT(", time source : 0x%x", time_src);
+    ND_PRINT(", time source: 0x%x", time_src);
     *len -= 1;
     bp += 1;
 
 }
-static void
+
+static const u_char *
 ptp_print_port_id(netdissect_options *ndo, const u_char *bp, u_int *len)
 {
     uint16_t port_id;
@@ -622,24 +625,25 @@ ptp_print_port_id(netdissect_options *ndo, const u_char *bp, u_int *len)
 
     /* port identity*/
     port_identity = GET_BE_U_8(bp);
-    ND_PRINT(", port identity : 0x%"PRIx64, port_identity);
+    ND_PRINT(", port identity: 0x%"PRIx64, port_identity);
     *len -= 8;
     bp += 8;
 
     /* port id */
     port_id = GET_BE_U_2(bp);
-    ND_PRINT(", port id : %u", port_id);
+    ND_PRINT(", port id: %u", port_id);
     *len -= 2;
     bp += 2;
 
+    return bp;
 }
 
 static void
 ptp_print_mgmt_msg(netdissect_options *ndo, const u_char *bp, u_int *len)
 {
-    ptp_print_port_id(ndo, bp, len);
-    print_field(ndo, ", start boundary hops ", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
-    print_field(ndo, ", boundary hops ", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
-    print_field(ndo, ", flags ", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
-    print_field(ndo, ", reserved ", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
+    bp = ptp_print_port_id(ndo, bp, len);
+    bp = print_field(ndo, "start boundary hops:", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
+    bp = print_field(ndo, "boundary hops:", PTP_UCHAR_LEN, bp, len, PTP_FALSE);
+    bp = print_field(ndo, "flags:", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
+    bp = print_field(ndo, "reserved:", PTP_UCHAR_LEN, bp, len, PTP_TRUE);
 }
diff --git a/contrib/tcpdump/print-raw.c b/contrib/tcpdump/print-raw.c
index d0edd2ece948..a40e919c2e54 100644
--- a/contrib/tcpdump/print-raw.c
+++ b/contrib/tcpdump/print-raw.c
@@ -28,7 +28,7 @@
 #include "netdissect.h"
 
 /*
- * The DLT_RAW packet has no header. It contains a raw IP packet.
+ * The DLT_RAW packet has no header. It contains a raw IPv4 or IPv6 packet.
  */
 
 void
diff --git a/contrib/tcpdump/print-sunrpc.c b/contrib/tcpdump/print-sunrpc.c
index 5fc6597fc287..3fab5040d0e9 100644
--- a/contrib/tcpdump/print-sunrpc.c
+++ b/contrib/tcpdump/print-sunrpc.c
@@ -91,7 +91,7 @@
  *
  *	from: @(#)pmap_prot.h 1.14 88/02/08 SMI
  *	from: @(#)pmap_prot.h	2.1 88/07/29 4.0 RPCSRC
- * $FreeBSD: projects/clang400-import/contrib/tcpdump/print-sunrpc.c 276788 2015-01-07 19:55:18Z delphij $
+ * $FreeBSD: src/include/rpc/pmap_prot.h,v 1.9.2.1 1999/08/29 14:39:05 peter Exp $
  */
 
 /*
diff --git a/contrib/tcpdump/print-tcp.c b/contrib/tcpdump/print-tcp.c
index b727dde05543..4a5bbd44dd88 100644
--- a/contrib/tcpdump/print-tcp.c
+++ b/contrib/tcpdump/print-tcp.c
@@ -302,15 +302,21 @@ tcp_print(netdissect_options *ndo,
                                                         "%s: calloc", __func__);
                                 }
                                 th->addr = tha;
-                                if (rev)
-                                        th->ack = seq, th->seq = ack - 1;
-                                else
-                                        th->seq = seq, th->ack = ack - 1;
+                                if (rev) {
+                                        th->ack = seq;
+                                        th->seq = ack - 1;
+                                } else {
+                                        th->seq = seq;
+                                        th->ack = ack - 1;
+                                }
                         } else {
-                                if (rev)
-                                        seq -= th->ack, ack -= th->seq;
-                                else
-                                        seq -= th->seq, ack -= th->ack;
+                                if (rev) {
+                                        seq -= th->ack;
+                                        ack -= th->seq;
+                                } else {
+                                        seq -= th->seq;
+                                        ack -= th->ack;
+                                }
                         }
 
                         thseq = th->seq;
@@ -360,15 +366,21 @@ tcp_print(netdissect_options *ndo,
                                                         "%s: calloc", __func__);
                                 }
                                 th->addr = tha;
-                                if (rev)
-                                        th->ack = seq, th->seq = ack - 1;
-                                else
-                                        th->seq = seq, th->ack = ack - 1;
+                                if (rev) {
+                                        th->ack = seq;
+                                        th->seq = ack - 1;
+                                } else {
+                                        th->seq = seq;
+                                        th->ack = ack - 1;
+                                }
                         } else {
-                                if (rev)
-                                        seq -= th->ack, ack -= th->seq;
-                                else
-                                        seq -= th->seq, ack -= th->ack;
+                                if (rev) {
+                                        seq -= th->ack;
+                                        ack -= th->seq;
+                                } else {
+                                        seq -= th->seq;
+                                        ack -= th->ack;
+                                }
                         }
 
                         thseq = th->seq;
@@ -425,14 +437,19 @@ tcp_print(netdissect_options *ndo,
                 }
         }
 
-        if (flags & TH_ACK) {
+        if (flags & TH_ACK)
                 ND_PRINT(", ack %u", ack);
-        }
+        else
+                if (ndo->ndo_vflag > 1 && ack != 0)
+                        ND_PRINT(", [ack %u != 0 while ACK flag not set]", ack);
 
         ND_PRINT(", win %u", win);
 
         if (flags & TH_URG)
                 ND_PRINT(", urg %u", urp);
+        else
+                if (ndo->ndo_vflag > 1 && urp != 0)
+                        ND_PRINT(", [urg %u != 0 while URG flag not set]", urp);
         /*
          * Handle any options.
          */
@@ -715,8 +732,11 @@ tcp_print(netdissect_options *ndo,
                 nd_trunc_longjmp(ndo);
         }
         bp += header_len;
-        if ((flags & TH_RST) && ndo->ndo_vflag) {
-                print_tcp_rst_data(ndo, bp, length);
+        if (flags & TH_RST) {
+                if(ndo->ndo_vflag)
+                        print_tcp_rst_data(ndo, bp, length);
+                else
+                        ND_TCHECK_LEN(bp, length);
                 return;
         }
 
diff --git a/contrib/tcpdump/print-udp.c b/contrib/tcpdump/print-udp.c
index 26371f040119..cefc0c2d0c0c 100644
--- a/contrib/tcpdump/print-udp.c
+++ b/contrib/tcpdump/print-udp.c
@@ -697,8 +697,8 @@ udp_print(netdissect_options *ndo, const u_char *bp, u_int length,
 			lwapp_data_print(ndo, cp, length);
 		else if (IS_SRC_OR_DST_PORT(SIP_PORT))
 			sip_print(ndo, cp, length);
-		else if (IS_SRC_OR_DST_PORT(OTV_PORT))
-			otv_print(ndo, cp, length);
+		else if (IS_SRC_OR_DST_PORT(VXLAN_LINUX_PORT))
+			vxlan_print(ndo, cp, length);
 		else if (IS_SRC_OR_DST_PORT(VXLAN_PORT))
 			vxlan_print(ndo, cp, length);
 		else if (dport == GENEVE_PORT)
diff --git a/contrib/tcpdump/print-zep.c b/contrib/tcpdump/print-zep.c
index c507e369d38b..20a1e2ae6ddf 100644
--- a/contrib/tcpdump/print-zep.c
+++ b/contrib/tcpdump/print-zep.c
@@ -30,6 +30,8 @@
 
 #include "extract.h"
 
+#include "ntp.h"
+
 /* From wireshark packet-zep.c:
  *
  ***********************************************************************
@@ -55,39 +57,6 @@
  *------------------------------------------------------------
  */
 
-#define     JAN_1970        2208988800U
-
-/* Print timestamp */
-static void zep_print_ts(netdissect_options *ndo, const u_char *p)
-{
-	int32_t i;
-	uint32_t uf;
-	uint32_t f;
-	float ff;
-
-	i = GET_BE_U_4(p);
-	uf = GET_BE_U_4(p + 4);
-	ff = (float) uf;
-	if (ff < 0.0)           /* some compilers are buggy */
-		ff += FMAXINT;
-	ff = (float) (ff / FMAXINT); /* shift radix point by 32 bits */
-	f = (uint32_t) (ff * 1000000000.0);  /* treat fraction as parts per
-						billion */
-	ND_PRINT("%u.%09d", i, f);
-
-	/*
-	 * print the time in human-readable format.
-	 */
-	if (i) {
-		time_t seconds = i - JAN_1970;
-		char time_buf[128];
-
-		ND_PRINT(" (%s)",
-		    nd_format_time(time_buf, sizeof (time_buf), "%Y-%m-%d %H:%M:%S",
-		      localtime(&seconds)));
-	}
-}
-
 /*
  * Main function to print packets.
  */
@@ -151,7 +120,12 @@ zep_print(netdissect_options *ndo,
 			else
 				ND_PRINT("LQI %u, ", GET_U_1(bp + 8));
 
-			zep_print_ts(ndo, bp + 9);
+			/*
+			 * XXX - why a space rather than a "T"
+			 * between the date and time?
+			 */
+			p_ntp_time_fmt(ndo, "%Y-%m-%d %H:%M:%S",
+			    (const struct l_fixedpt *)(bp + 9));
 			seq_no = GET_BE_U_4(bp + 17);
 			inner_len = GET_U_1(bp + 31);
 			ND_PRINT(", seq# = %u, inner len = %u",
diff --git a/contrib/tcpdump/rpc_auth.h b/contrib/tcpdump/rpc_auth.h
index f2d65c155305..b73e3be048d1 100644
--- a/contrib/tcpdump/rpc_auth.h
+++ b/contrib/tcpdump/rpc_auth.h
@@ -28,7 +28,7 @@
  *
  *	from: @(#)auth.h 1.17 88/02/08 SMI
  *	from: @(#)auth.h	2.3 88/08/07 4.0 RPCSRC
- * $FreeBSD: projects/clang400-import/contrib/tcpdump/rpc_auth.h 276788 2015-01-07 19:55:18Z delphij $
+ * $FreeBSD: src/include/rpc/auth.h,v 1.14.2.1 1999/08/29 14:39:02 peter Exp $
  */
 
 /*
diff --git a/contrib/tcpdump/rpc_msg.h b/contrib/tcpdump/rpc_msg.h
index 7a50445458ed..ecd24cb1a179 100644
--- a/contrib/tcpdump/rpc_msg.h
+++ b/contrib/tcpdump/rpc_msg.h
@@ -28,7 +28,7 @@
  *
  *	from: @(#)rpc_msg.h 1.7 86/07/16 SMI
  *	from: @(#)rpc_msg.h	2.1 88/07/29 4.0 RPCSRC
- * $FreeBSD: projects/clang400-import/contrib/tcpdump/rpc_msg.h 276788 2015-01-07 19:55:18Z delphij $
+ * $FreeBSD: src/include/rpc/rpc_msg.h,v 1.11.2.1 1999/08/29 14:39:07 peter Exp $
  */
 
 /*
diff --git a/contrib/tcpdump/tcpdump.1.in b/contrib/tcpdump/tcpdump.1.in
index 3ed261df6fe7..bc0e393d0331 100644
--- a/contrib/tcpdump/tcpdump.1.in
+++ b/contrib/tcpdump/tcpdump.1.in
@@ -20,18 +20,19 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
-.TH TCPDUMP 1  "26 March 2024"
+.TH TCPDUMP 1  "30 June 2025"
 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS
 .na
 .B tcpdump
 [
-.B \-AbdDefhHIJKlLnNOpqStuUvxX#
+.B \-AbdDefghHIJKlLnNOpqStuUvxX#
 ] [
 .B \-B
 .I buffer_size
 ]
+.br
 .ti +8
 [
 .B \-c
@@ -44,11 +45,13 @@ tcpdump \- dump traffic on a network
 .B \-C
 .I file_size
 ]
+.br
 .ti +8
 [
 .B \-E
 .I spi@ipaddr algo:secret,...
 ]
+.br
 .ti +8
 [
 .B \-F
@@ -62,6 +65,7 @@ tcpdump \- dump traffic on a network
 .B \-i
 .I interface
 ]
+.br
 .ti +8
 [
 .B \-\-immediate\-mode
@@ -74,6 +78,7 @@ tcpdump \- dump traffic on a network
 .B \-m
 .I module
 ]
+.br
 .ti +8
 [
 .B \-M
@@ -105,7 +110,6 @@ tcpdump \- dump traffic on a network
 [
 .B \-\-version
 ]
-.ti +8
 [
 .B \-V
 .I file
@@ -118,11 +122,12 @@ tcpdump \- dump traffic on a network
 .B \-W
 .I filecount
 ]
+.br
+.ti +8
 [
 .B \-y
 .I datalinktype
 ]
-.ti +8
 [
 .B \-z
 .I postrotate-command
@@ -131,17 +136,18 @@ tcpdump \- dump traffic on a network
 .B \-Z
 .I user
 ]
+.br
 .ti +8
 [
 .BI \-\-time\-stamp\-precision= tstamp_precision
 ]
-.ti +8
 [
 .BI \-\-micro
 ]
 [
 .BI \-\-nano
 ]
+.br
 .ti +8
 [
 .I expression
@@ -150,7 +156,7 @@ tcpdump \- dump traffic on a network
 .ad
 .SH DESCRIPTION
 .LP
-\fITcpdump\fP prints out a description of the contents of packets on a
+\fItcpdump\fP prints out a description of the contents of packets on a
 network interface that match the Boolean \fIexpression\fP (see
 .BR \%pcap-filter (@MAN_MISC_INFO@)
 for the \fIexpression\fP syntax); the
@@ -170,7 +176,7 @@ only packets that match
 will be processed by
 .IR tcpdump .
 .LP
-.I Tcpdump
+.I tcpdump
 will, if not run with the
 .B \-c
 flag, continue capturing packets until it is interrupted by a SIGINT
@@ -237,6 +243,11 @@ special privileges.
 .B \-A
 Print each packet (minus its link level header) in ASCII.  Handy for
 capturing web pages.
+No effect when
+.B \-x[x]
+or
+.B \-X[X]
+options are used.
 .TP
 .B \-b
 Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
@@ -266,8 +277,12 @@ savefile and open a new one.  Savefiles after the first savefile will
 have the name specified with the
 .B \-w
 flag, with a number after it, starting at 1 and continuing upward.
-The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
+The default unit of \fIfile_size\fP is millions of bytes (1,000,000 bytes,
 not 1,048,576 bytes).
+.IP
+By adding a suffix of k/K, m/M or g/G to the value, the unit
+can be changed to 1,024 (KiB), 1,048,576 (MiB), or 1,073,741,824 (GiB)
+respectively.
 .TP
 .B \-d
 Dump the compiled packet-matching code in a human readable form to
@@ -388,15 +403,21 @@ The test for `foreign' IPv4 addresses is done using the IPv4 address and
 netmask of the interface on that capture is being done.  If that
 address or netmask are not available, either because the
 interface on that capture is being done has no address or netmask or
-because it is the "any" pseudo-interface, which is
-available in Linux and in recent versions of macOS and Solaris, and which
-can capture on more than one interface, this option will not work
-correctly.
+because it is the "any" pseudo-interface (see the
+.B \-i
+flag below), this option will not work correctly.
 .TP
 .BI \-F " file"
 Use \fIfile\fP as input for the filter expression.
 An additional expression given on the command line is ignored.
 .TP
+.B \-g
+.PD 0
+.TP
+.BI \-\-ip\-oneline
+.PD
+Do not insert a line break after the IP header in verbose mode.
+.TP
 .BI \-G " rotate_seconds"
 If specified, rotates the dump file specified with the
 .B \-w
@@ -442,10 +463,19 @@ flag is not given, \fItcpdump\fP searches the system
 interface list for the lowest numbered, configured up interface
 (excluding loopback), which may turn out to be, for example, ``eth0''.
 .IP
-On Linux systems with 2.2 or later kernels and on recent versions of macOS
+On all supported Linux systems, as well as on recent versions of macOS
 and Solaris, an
 .I interface
-argument of ``any'' can be used to capture packets from all interfaces.
+argument of ``any'' means a special pseudo-interface, which captures packets
+from all regular network interfaces of the OS.  What is considered a regular
+network interface is an implementation detail of the OS (for example, on
+Linux this includes SocketCAN devices), so packets captured on the ``any''
+pseudo-interface may represent more different network protocols than expected.
+Also all regular network interfaces are a subset of all available capture
+devices as printed by the
+.B \-D
+flag.  The latter may also include capture devices that libpcap implements by
+means other than the OS network stack: Bluetooth, DAG, D-Bus, SNF and USB.
 Note that captures on the ``any'' pseudo-interface will not be done in promiscuous
 mode.
 .IP
@@ -851,7 +881,7 @@ flag to cause packets to be written as soon as they are received.
 The MIME type \fIapplication/vnd.tcpdump.pcap\fP has been registered
 with IANA for \fIpcap\fP files. The filename extension \fI.pcap\fP
 appears to be the most commonly used along with \fI.cap\fP and
-\fI.dmp\fP. \fITcpdump\fP itself doesn't check the extension when
+\fI.dmp\fP. \fItcpdump\fP itself doesn't check the extension when
 reading capture files and doesn't add an extension when writing them
 (it uses magic numbers in the file header instead). However, many
 operating systems and applications will use the extension if it is
@@ -897,6 +927,9 @@ required padding.
 In the current implementation this flag may have the same effect as
 .B \-xx
 if the packet is truncated.
+No effect when
+.B \-X[X]
+option is used.
 .TP
 .B \-xx
 When parsing and printing,
@@ -904,6 +937,9 @@ in addition to printing the headers of each packet, print the data of
 each packet,
 .I including
 its link level header, in hex.
+No effect when
+.B \-X[X]
+option is used.
 .TP
 .B \-X
 When parsing and printing,
@@ -949,6 +985,8 @@ or
 .B \-z bzip2
 will compress each savefile using gzip or bzip2.
 .IP
+This option can only be used if fork subprocess is implemented (e.g. not on Windows systems).
+.IP
 Note that tcpdump will run the command in parallel to the capture, using
 the lowest priority so that this doesn't disturb the capture process.
 .IP
diff --git a/contrib/tcpdump/tcpdump.c b/contrib/tcpdump/tcpdump.c
index 6cf7a066ab5c..0c07899a2f58 100644
--- a/contrib/tcpdump/tcpdump.c
+++ b/contrib/tcpdump/tcpdump.c
@@ -34,6 +34,9 @@
  */
 
 #include <config.h>
+#ifndef TCPDUMP_CONFIG_H_
+#error "The included config.h header is not from the tcpdump build."
+#endif
 
 /*
  * Some older versions of Mac OS X ship pcap.h from libpcap 0.6 with a
@@ -149,7 +152,6 @@ The Regents of the University of California.  All rights reserved.\n";
 #include <sys/sysctl.h>
 #endif /* __FreeBSD__ */
 
-#include "netdissect-stdinc.h"
 #include "netdissect.h"
 #include "interface.h"
 #include "addrtoname.h"
@@ -226,7 +228,9 @@ static int Uflag;			/* "unbuffered" output of dump files */
 #endif
 static int Wflag;			/* recycle output files after this number of files */
 static int WflagChars;
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
 static char *zflag = NULL;		/* compress each savefile using a specified command (like gzip or bzip2) */
+#endif
 static int timeout = 1000;		/* default timeout = 1000 ms = 1 s */
 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
 static int immediate_mode;
@@ -250,7 +254,9 @@ static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
 static NORETURN void exit_tcpdump(int);
 static void (*setsignal (int sig, void (*func)(int)))(int);
 static void cleanup(int);
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
 static void child_cleanup(int);
+#endif
 static void print_version(FILE *);
 static void print_usage(FILE *);
 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
@@ -597,14 +603,11 @@ show_remote_devices_and_exit(void)
 /*
  * Short options.
  *
- * Note that there we use all letters for short options except for g, k,
+ * Note that there we use all letters for short options except for k,
  * o, and P, and those are used by other versions of tcpdump, and we should
  * only use them for the same purposes that the other versions of tcpdump
  * use them:
  *
- * macOS tcpdump uses -g to force non--v output for IP to be on one
- * line, making it more "g"repable;
- *
  * macOS tcpdump uses -k to specify that packet comments in pcapng files
  * should be printed;
  *
@@ -676,7 +679,27 @@ show_remote_devices_and_exit(void)
 #define U_FLAG
 #endif
 
-#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
+#define z_FLAG		"z:"
+#define z_FLAG_USAGE    "[ -z postrotate-command ] "
+#else
+#define z_FLAG
+#define z_FLAG_USAGE
+#endif
+
+#ifdef HAVE_LIBCRYPTO
+#define E_FLAG		"E:"
+#define E_FLAG_USAGE    "[ -E algo:secret ] "
+#define M_FLAG		"M:"
+#define M_FLAG_USAGE	"[ -M secret ] "
+#else
+#define E_FLAG
+#define E_FLAG_USAGE
+#define M_FLAG
+#define M_FLAG_USAGE
+#endif
+
+#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "e" E_FLAG "fF:gG:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:" M_FLAG "nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Y" z_FLAG "Z:#"
 
 /*
  * Long options.
@@ -707,6 +730,7 @@ show_remote_devices_and_exit(void)
 #define OPTION_TSTAMP_NANO		134
 #define OPTION_FP_TYPE			135
 #define OPTION_COUNT			136
+#define OPTION_TIME_T_SIZE		139
 
 static const struct option longopts[] = {
 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
@@ -754,6 +778,8 @@ static const struct option longopts[] = {
 	{ "fp-type", no_argument, NULL, OPTION_FP_TYPE },
 	{ "number", no_argument, NULL, '#' },
 	{ "print", no_argument, NULL, OPTION_PRINT },
+	{ "time-t-size", no_argument, NULL, OPTION_TIME_T_SIZE },
+	{ "ip-oneline", no_argument, NULL, 'g' },
 	{ "version", no_argument, NULL, OPTION_VERSION },
 	{ NULL, 0, NULL, 0 }
 };
@@ -791,7 +817,7 @@ droproot(const char *username, const char *chroot_dir)
 		{
 			int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
 			if (ret < 0)
-				error("capng_change_id(): return %d\n", ret);
+				error("capng_change_id(): return %d", ret);
 			else
 				fprintf(stderr, "dropped privs to %s\n", username);
 		}
@@ -997,7 +1023,7 @@ tstamp_precision_to_string(int precision)
  * that requires that it be able to do an F_GETFL fcntl() to read
  * the O_ flags.
  *
- * Tcpdump uses ftell() to determine how much data has been written
+ * tcpdump uses ftell() to determine how much data has been written
  * to a file in order to, when used with -C, determine when it's time
  * to rotate capture files.  ftell() therefore needs to do an lseek()
  * to find out the file offset and must, thanks to the aforementioned
@@ -1237,6 +1263,8 @@ _U_
 	status = pcap_findalldevs(&devlist, ebuf);
 	if (status < 0)
 		error("%s", ebuf);
+	if (devlist == NULL)
+		error("no interfaces available for capture");
 	/*
 	 * Look for the devnum-th entry in the list of devices (1-based).
 	 */
@@ -1245,8 +1273,8 @@ _U_
 		;
 	if (dev == NULL) {
 		pcap_freealldevs(devlist);
-		error("Invalid adapter index %ld: only %ld interfaces found",
-		    devnum, i);
+		error("Invalid adapter index %ld: only %ld interface%s found",
+		    devnum, i, (i == 1) ? "" : "s");
 	}
 	device = strdup(dev->name);
 	pcap_freealldevs(devlist);
@@ -1393,7 +1421,7 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
 		 */
 		cp = pcap_geterr(pc);
 		if (status == PCAP_ERROR)
-			error("%s", cp);
+			error("%s: %s", device, cp);
 		else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
 			/*
 			 * Return an error for our caller to handle.
@@ -1403,6 +1431,11 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
 		} else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
 			error("%s: %s\n(%s)", device,
 			    pcap_statustostr(status), cp);
+#ifdef PCAP_ERROR_CAPTURE_NOTSUP
+		else if (status == PCAP_ERROR_CAPTURE_NOTSUP && *cp != '\0')
+			error("%s: %s\n(%s)", device,
+			    pcap_statustostr(status), cp);
+#endif
 #ifdef __FreeBSD__
 		else if (status == PCAP_ERROR_RFMON_NOTSUP &&
 		    strncmp(device, "wlan", 4) == 0) {
@@ -1420,7 +1453,7 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
 			 * specific case would be an error message that looks a bit odd.
 			 */
 			newdev[strlen(newdev)-1]++;
-			error("%s is not a monitor mode VAP\n"
+			error("%s is not a monitor mode VAP"
 			    "To create a new monitor mode VAP use:\n"
 			    "  ifconfig %s create wlandev %s wlanmode monitor\n"
 			    "and use %s as the tcpdump interface",
@@ -1521,10 +1554,162 @@ main(int argc, char **argv)
 	int yflag_dlt = -1;
 	const char *yflag_dlt_name = NULL;
 	int print = 0;
+	long Cflagmult;
 
 	netdissect_options Ndo;
 	netdissect_options *ndo = &Ndo;
 
+#ifdef _WIN32
+	/*
+	 * We need to look for wpcap.dll in \Windows\System32\Npcap first,
+	 * as either:
+	 *
+	 *  1) WinPcap isn't installed and Npcap isn't installed in "WinPcap
+	 *     API-compatible Mode", so there's no wpcap.dll in
+	 *     \Windows\System32, only in \Windows\System32\Npcap;
+	 *
+	 *  2) WinPcap is installed and Npcap isn't installed in "WinPcap
+	 *     API-compatible Mode", so the wpcap.dll in \Windows\System32
+	 *     is a WinPcap DLL, but we'd prefer an Npcap DLL (we should
+	 *     work with either one if we're configured against WinPcap,
+	 *     and we'll probably require Npcap if we're configured against
+	 *     it), and that's in \Windows\System32\Npcap;
+	 *
+	 *  3) Npcap is installed in "WinPcap API-compatible Mode", so both
+	 *     \Windows\System32 and \Windows\System32\Npcap have an Npcap
+	 *     wpcap.dll.
+	 *
+	 * Unfortunately, Windows has no notion of an rpath, so we can't
+	 * set the rpath to include \Windows\System32\Npcap at link time;
+	 * what we need to do is to link wpcap as a delay-load DLL and
+	 * add \Windows\System32\Npcap to the DLL search path early in
+	 * main() with a call to SetDllDirectory().
+	 *
+	 * The same applies to packet.dll.
+	 *
+	 * We add \Windows\System32\Npcap here.
+	 *
+	 * See https://npcap.com/guide/npcap-devguide.html#npcap-feature-native-dll-implicitly
+	 */
+	WCHAR *dll_directory = NULL;
+	size_t dll_directory_buf_len = 0;	/* units of bytes */
+	UINT system_directory_buf_len = 0;	/* units of WCHARs */
+	UINT system_directory_len;		/* units of WCHARs */
+	static const WCHAR npcap[] = L"\\Npcap";
+
+	/*
+	 * Get the system directory path, in UTF-16, into a buffer that's
+	 * large enough for that directory path plus "\Npcap".
+	 *
+	 * String manipulation in C, plus fetching a variable-length
+	 * string into a buffer whose size is fixed at the time of
+	 * the call, with an oddball return value (see below), is just
+	 * a huge bag of fun.
+	 *
+	 * And it's even more fun when dealing with UTF-16, so that the
+	 * buffer sizes used in GetSystemDirectoryW() are in different
+	 * units from the buffer sizes used in realloc()!   We maintain
+	 * all sizes/length in units of bytes, not WCHARs, so that our
+	 * heads don't explode.
+	 */
+	for (;;) {
+		/*
+		 * Try to fetch the system directory.
+		 *
+		 * GetSystemDirectoryW() expects a buffer size in units
+		 * of WCHARs, not bytes, and returns a directory path
+		 * length in units of WCHARs, not bytes.
+		 *
+		 * For extra fun, if GetSystemDirectoryW() succeeds,
+		 * the return value is the length of the directory
+		 * path in units of WCHARs, *not* including the
+		 * terminating '\0', but if it fails because the
+		 * path string wouldn't fit, the return value is
+		 * the length of the directory path in units of WCHARs,
+		 * *including* the terminating '\0'.
+		 */
+		system_directory_len = GetSystemDirectoryW(dll_directory,
+		    system_directory_buf_len);
+		if (system_directory_len == 0)
+			error("GetSystemDirectoryW() failed");
+
+		/*
+		 * Did the directory path fit in the buffer?
+		 *
+		 * As per the above, this means that the return value
+		 * *plus 1*, so that the terminating '\0' is counted,
+		 * is <= the buffer size.
+		 *
+		 * (If the directory path, complete with the terminating
+		 * '\0', fits *exactly*, the return value would be the
+		 * size of the buffer minus 1, as it doesn't count the
+		 * terminating '\0', so the test below would succeed.
+		 *
+		 * If everything *but* the terminating '\0' fits,
+		 * the return value would be the size of the buffer + 1,
+		 * i.e., the size that the string in question would
+		 * have required.
+		 *
+		 * The astute reader will note that returning the
+		 * size of the buffer is not one of the two cases
+		 * above, and should never happen.)
+		 */
+		if ((system_directory_len + 1) <= system_directory_buf_len) {
+			/*
+			 * No.  We have a buffer that's large enough
+			 * for our purposes.
+			 */
+			break;
+		}
+
+		/*
+		 * Yes.  Grow the buffer.
+		 *
+		 * The space we'll need in the buffer for the system
+		 * directory, in units of WCHARs, is system_directory_len,
+		 * as that's the length of the system directory path
+		 * including the terminating '\0'.
+		 */
+		system_directory_buf_len = system_directory_len;
+
+		/*
+		 * The size of the DLL directory buffer, in *bytes*, must
+		 * be the number of WCHARs taken by the system directory,
+		 * *minus* the terminating '\0' (as we'll overwrite that
+		 * with the "\" of the "\Npcap" string), multiplied by
+		 * sizeof(WCHAR) to convert it to the number of bytes,
+		 * plus the size of the "\Npcap" string, in bytes (which
+		 * will include the terminating '\0', as that will become
+		 * the DLL path's terminating '\0').
+		 */
+		dll_directory_buf_len =
+		    ((system_directory_len - 1)*sizeof(WCHAR)) + sizeof npcap;
+		dll_directory = realloc(dll_directory, dll_directory_buf_len);
+		if (dll_directory == NULL)
+			error("Can't allocate string for Npcap directory");
+	}
+
+	/*
+	 * OK, that worked.
+	 *
+	 * Now append \Npcap.  We add the length of the system directory path,
+	 * in WCHARs, *not* including the terminating '\0' (which, since
+	 * GetSystemDirectoryW() succeeded, is the return value of
+	 * GetSystemDirectoryW(), as per the above), to the pointer to the
+	 * beginning of the path, to go past the end of the system directory
+	 * to point to the terminating '\0'.
+	 */
+	memcpy(dll_directory + system_directory_len, npcap, sizeof npcap);
+
+	/*
+	 * Now add that as a system DLL directory.
+	 */
+	if (!SetDllDirectoryW(dll_directory))
+		error("SetDllDirectory failed");
+
+	free(dll_directory);
+#endif
+
 	/*
 	 * Initialize the netdissect code.
 	 */
@@ -1609,19 +1794,77 @@ main(int argc, char **argv)
 #else
 			Cflag = strtol(optarg, &endp, 10);
 #endif
-			if (endp == optarg || *endp != '\0' || errno != 0
-			    || Cflag <= 0)
+			if (endp == optarg || errno != 0 || Cflag <= 0)
 				error("invalid file size %s", optarg);
+
+			if (*endp == '\0') {
+				/*
+				 * There's nothing after the file size,
+				 * so the size is in units of 1 MB
+				 * (1,000,000 bytes).
+				 */
+				Cflagmult = 1000000;
+			} else {
+				/*
+				 * There's something after the file
+				 * size.
+				 *
+				 * If it's a single letter, then:
+				 *
+				 *   if the letter is k or K, the size
+				 *   is in units of 1 KiB (1024 bytes);
+				 *
+				 *   if the letter is m or M, the size
+				 *   is in units of 1 MiB (1,048,576 bytes);
+				 *
+				 *   if the letter is g or G, the size
+				 *   is in units of 1 GiB (1,073,741,824 bytes).
+				 *
+				 * Otherwise, it's an error.
+				 */
+				switch (*endp) {
+
+				case 'k':
+				case 'K':
+					Cflagmult = 1024;
+					break;
+
+				case 'm':
+				case 'M':
+					Cflagmult = 1024*1024;
+					break;
+
+				case 'g':
+				case 'G':
+					Cflagmult = 1024*1024*1024;
+					break;
+
+				default:
+					error("invalid file size %s", optarg);
+				}
+
+				/*
+				 * OK, there was a letter that we treat
+				 * as a units indication; was there
+				 * anything after it?
+				 */
+				endp++;
+				if (*endp != '\0') {
+					/* Yes - error */
+					error("invalid file size %s", optarg);
+				}
+			}
+
 			/*
-			 * Will multiplying it by 1000000 overflow?
+			 * Will multiplying it by multiplier overflow?
 			 */
 #ifdef HAVE_PCAP_DUMP_FTELL64
-			if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000)
+			if (Cflag > INT64_MAX / Cflagmult)
 #else
-			if (Cflag > LONG_MAX / 1000000)
+			if (Cflag > LONG_MAX / Cflagmult)
 #endif
 				error("file size %s is too large", optarg);
-			Cflag *= 1000000;
+			Cflag *= Cflagmult;
 			break;
 
 		case 'd':
@@ -1648,12 +1891,11 @@ main(int argc, char **argv)
 			++ndo->ndo_eflag;
 			break;
 
+#ifdef HAVE_LIBCRYPTO
 		case 'E':
-#ifndef HAVE_LIBCRYPTO
-			warning("crypto code not compiled in");
-#endif
 			ndo->ndo_espsecret = optarg;
 			break;
+#endif
 
 		case 'f':
 			++ndo->ndo_fflag;
@@ -1663,6 +1905,10 @@ main(int argc, char **argv)
 			infile = optarg;
 			break;
 
+		case 'g':
+			++ndo->ndo_gflag;
+			break;
+
 		case 'G':
 			Gflag = atoi(optarg);
 			if (Gflag < 0)
@@ -1746,13 +1992,12 @@ main(int argc, char **argv)
 			}
 			break;
 
+#ifdef HAVE_LIBCRYPTO
 		case 'M':
 			/* TCP-MD5 shared secret */
-#ifndef HAVE_LIBCRYPTO
-			warning("crypto code not compiled in");
-#endif
 			ndo->ndo_sigsecret = optarg;
 			break;
+#endif
 
 		case 'n':
 			++ndo->ndo_nflag;
@@ -1908,9 +2153,12 @@ main(int argc, char **argv)
 			}
 			break;
 #endif
+
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
 		case 'z':
 			zflag = optarg;
 			break;
+#endif
 
 		case 'Z':
 			username = optarg;
@@ -1920,6 +2168,10 @@ main(int argc, char **argv)
 			ndo->ndo_packet_number = 1;
 			break;
 
+		case OPTION_TIME_T_SIZE:
+			printf("%zu\n", sizeof(time_t) * 8);
+			return 0;
+
 		case OPTION_VERSION:
 			print_version(stdout);
 			exit_tcpdump(S_SUCCESS);
@@ -1974,6 +2226,21 @@ main(int argc, char **argv)
 			/* NOTREACHED */
 		}
 
+	if (ndo->ndo_Aflag && ndo->ndo_xflag)
+		error("-A and -x[x] are mutually exclusive.");
+	if (ndo->ndo_Aflag && ndo->ndo_Xflag)
+		error("-A and -X[X] are mutually exclusive.");
+	if (ndo->ndo_xflag && ndo->ndo_Xflag)
+		error("-x[x] and -X[X] are mutually exclusive.");
+	if (Cflag != 0 && WFileName == NULL)
+		error("-C cannot be used without -w.");
+	if (Gflag != 0 && WFileName == NULL)
+		error("-G cannot be used without -w.");
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
+	if (zflag != NULL && (WFileName == NULL || (Cflag == 0 && Gflag == 0)))
+		error("-z cannot be used without -w and (-C or -G).");
+#endif
+
 #ifdef HAVE_PCAP_FINDALLDEVS
 	if (Dflag)
 		show_devices_and_exit();
@@ -1999,7 +2266,7 @@ main(int argc, char **argv)
 	}
 
 	if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))
-		error("-f can not be used with -V or -r");
+		error("-f cannot be used with -V or -r.");
 
 	if (VFileName != NULL && RFileName != NULL)
 		error("-V and -r are mutually exclusive.");
@@ -2067,11 +2334,11 @@ main(int argc, char **argv)
 				VFile = fopen(VFileName, "r");
 
 			if (VFile == NULL)
-				error("Unable to open file: %s\n", pcap_strerror(errno));
+				error("Unable to open file: %s", pcap_strerror(errno));
 
 			ret = get_next_file(VFile, VFileLine);
 			if (!ret)
-				error("Nothing in %s\n", VFileName);
+				error("Nothing in %s", VFileName);
 			RFileName = VFileLine;
 		}
 
@@ -2333,7 +2600,7 @@ DIAG_ON_WARN_UNUSED_RESULT
 	 * devices, and can't just give users that permission,
 	 * you'd make tcpdump set-UID or set-GID).
 	 *
-	 * Tcpdump doesn't necessarily write only to one savefile;
+	 * tcpdump doesn't necessarily write only to one savefile;
 	 * the general only way to allow a -Z instance to write to
 	 * savefiles as the user under whose UID it's run, rather
 	 * than as the user specified with -Z, would thus be to switch
@@ -2649,6 +2916,7 @@ DIAG_ON_ASSIGN_ENUM
 			info(1);
 		}
 		pcap_close(pd);
+		pd = NULL;
 		if (VFileName != NULL) {
 			ret = get_next_file(VFile, VFileLine);
 			if (ret) {
@@ -2797,7 +3065,8 @@ cleanup(int signo _U_)
 	 * to do anything with standard I/O streams in a signal handler -
 	 * the ANSI C standard doesn't say it is).
 	 */
-	pcap_breakloop(pd);
+	if (pd)
+		pcap_breakloop(pd);
 #else
 	/*
 	 * We don't have "pcap_breakloop()"; this isn't safe, but
@@ -2890,8 +3159,8 @@ compress_savefile(const char *filename)
 	child = fork_subprocess();
 	if (child == -1) {
 		fprintf(stderr,
-			"compress_savefile: fork failed: %s\n",
-			pcap_strerror(errno));
+			"%s: fork failed: %s\n",
+			__func__, pcap_strerror(errno));
 		return;
 	}
 	if (child != 0) {
@@ -2910,24 +3179,15 @@ compress_savefile(const char *filename)
 #endif
 	if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
 		fprintf(stderr,
-			"compress_savefile: execlp(%s, %s) failed: %s\n",
-			zflag,
-			filename,
-			pcap_strerror(errno));
+			"%s: execlp(%s, %s) failed: %s\n",
+			__func__, zflag, filename, pcap_strerror(errno));
 #ifdef HAVE_FORK
 	exit(S_ERR_HOST_PROGRAM);
 #else
 	_exit(S_ERR_HOST_PROGRAM);
 #endif
 }
-#else  /* HAVE_FORK && HAVE_VFORK */
-static void
-compress_savefile(const char *filename)
-{
-	fprintf(stderr,
-		"compress_savefile failed. Functionality not implemented under your system\n");
-}
-#endif /* HAVE_FORK && HAVE_VFORK */
+#endif /* HAVE_FORK || HAVE_VFORK */
 
 static void
 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
@@ -2975,11 +3235,13 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 			 */
 			pcap_dump_close(dump_info->pdd);
 
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
 			/*
 			 * Compress the file we just closed, if the user asked for it
 			 */
 			if (zflag != NULL)
 				compress_savefile(dump_info->CurrentFileName);
+#endif
 
 			/*
 			 * Check to see if we've exceeded the Wflag (when
@@ -3080,12 +3342,14 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 			 */
 			pcap_dump_close(dump_info->pdd);
 
+#if defined(HAVE_FORK) || defined(HAVE_VFORK)
 			/*
 			 * Compress the file we just closed, if the user
 			 * asked for it.
 			 */
 			if (zflag != NULL)
 				compress_savefile(dump_info->CurrentFileName);
+#endif
 
 			Cflag_count++;
 			if (Wflag > 0) {
@@ -3279,9 +3543,9 @@ print_usage(FILE *f)
 {
 	print_version(f);
 	(void)fprintf(f,
-"Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
+"Usage: %s [-Abd" D_FLAG "efghH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
 	(void)fprintf(f,
-"\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
+"\t\t[ -C file_size ] " E_FLAG_USAGE "[ -F file ] [ -G seconds ]\n");
 	(void)fprintf(f,
 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
 #ifdef HAVE_PCAP_FINDALLDEVS_EX
@@ -3293,7 +3557,7 @@ print_usage(FILE *f)
 "\t\t" m_FLAG_USAGE "\n");
 #endif
 	(void)fprintf(f,
-"\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
+"\t\t" M_FLAG_USAGE "[ --number ] [ --print ]" Q_FLAG_USAGE "\n");
 	(void)fprintf(f,
 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
 	(void)fprintf(f,
@@ -3303,5 +3567,5 @@ print_usage(FILE *f)
 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
 #endif
 	(void)fprintf(f,
-"\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
+"\t\t" z_FLAG_USAGE "[ -Z user ] [ expression ]\n");
 }
diff --git a/contrib/tcpdump/timeval-operations.h b/contrib/tcpdump/timeval-operations.h
index 177027db031d..65a9b144e07c 100644
--- a/contrib/tcpdump/timeval-operations.h
+++ b/contrib/tcpdump/timeval-operations.h
@@ -32,6 +32,8 @@
 
 #define ND_MICRO_PER_SEC 1000000
 #define ND_NANO_PER_SEC 1000000000
+#define ND_INVALID_MICRO_SEC_STR "(invalid us)"
+#define ND_INVALID_NANO_SEC_STR "(invalid ns)"
 
 #define netdissect_timevalclear(tvp) ((tvp)->tv_sec = (tvp)->tv_usec = 0)
 
diff --git a/contrib/tcpdump/udp.h b/contrib/tcpdump/udp.h
index 1eec850268e4..a8dba1f72510 100644
--- a/contrib/tcpdump/udp.h
+++ b/contrib/tcpdump/udp.h
@@ -227,8 +227,8 @@ struct udphdr {
 #ifndef HNCP_PORT
 #define HNCP_PORT			8231	/* RFC 7788 */
 #endif
-#ifndef OTV_PORT
-#define OTV_PORT			8472	/* draft-hasmit-otv-04 */
+#ifndef VXLAN_LINUX_PORT
+#define VXLAN_LINUX_PORT		8472	/* Linux, drivers/net/vxlan/vxlan_core.c */
 #endif
 #ifndef ISAKMP_PORT_USER2
 #define ISAKMP_PORT_USER2		8500	/*XXX - nonstandard*/
diff --git a/contrib/tcpdump/util-print.c b/contrib/tcpdump/util-print.c
index 85ec24a33ed2..a1269a523edd 100644
--- a/contrib/tcpdump/util-print.c
+++ b/contrib/tcpdump/util-print.c
@@ -216,10 +216,14 @@ ts_frac_print(netdissect_options *ndo, const struct timeval *tv)
 
 	case PCAP_TSTAMP_PRECISION_MICRO:
 		ND_PRINT(".%06u", (unsigned)tv->tv_usec);
+		if ((unsigned)tv->tv_usec > ND_MICRO_PER_SEC - 1)
+			ND_PRINT(" " ND_INVALID_MICRO_SEC_STR);
 		break;
 
 	case PCAP_TSTAMP_PRECISION_NANO:
 		ND_PRINT(".%09u", (unsigned)tv->tv_usec);
+		if ((unsigned)tv->tv_usec > ND_NANO_PER_SEC - 1)
+			ND_PRINT(" " ND_INVALID_NANO_SEC_STR);
 		break;
 
 	default:
@@ -228,6 +232,8 @@ ts_frac_print(netdissect_options *ndo, const struct timeval *tv)
 	}
 #else
 	ND_PRINT(".%06u", (unsigned)tv->tv_usec);
+	if ((unsigned)tv->tv_usec > ND_MICRO_PER_SEC - 1)
+		ND_PRINT(" " ND_INVALID_MICRO_SEC_STR);
 #endif
 }
 
@@ -243,16 +249,32 @@ ts_date_hmsfrac_print(netdissect_options *ndo, const struct timeval *tv,
 	struct tm *tm;
 	char timebuf[32];
 	const char *timestr;
+#ifdef _WIN32
+	time_t sec;
+#endif
 
 	if (tv->tv_sec < 0) {
-		ND_PRINT("[timestamp < 1970-01-01 00:00:00 UTC]");
+		ND_PRINT("[timestamp overflow]");
 		return;
 	}
 
+#ifdef _WIN32
+	/* on Windows tv->tv_sec is a long not a 64-bit time_t. */
+	sec = tv->tv_sec;
+#endif
+
 	if (time_flag == LOCAL_TIME)
+#ifdef _WIN32
+		tm = localtime(&sec);
+#else
 		tm = localtime(&tv->tv_sec);
+#endif
 	else
+#ifdef _WIN32
+		tm = gmtime(&sec);
+#else
 		tm = gmtime(&tv->tv_sec);
+#endif
 
 	if (date_flag == WITH_DATE) {
 		timestr = nd_format_time(timebuf, sizeof(timebuf),
@@ -273,11 +295,11 @@ static void
 ts_unix_print(netdissect_options *ndo, const struct timeval *tv)
 {
 	if (tv->tv_sec < 0) {
-		ND_PRINT("[timestamp < 1970-01-01 00:00:00 UTC]");
+		ND_PRINT("[timestamp overflow]");
 		return;
 	}
 
-	ND_PRINT("%u", (unsigned)tv->tv_sec);
+	ND_PRINT("%" PRId64, (int64_t)tv->tv_sec);
 	ts_frac_print(ndo, tv);
 }
 
@@ -467,19 +489,14 @@ void nd_print_invalid(netdissect_options *ndo)
 
 int
 print_unknown_data(netdissect_options *ndo, const u_char *cp,
-                   const char *ident, u_int len)
+                   const char *indent, u_int len)
 {
-	u_int len_to_print;
-
-	len_to_print = len;
 	if (!ND_TTEST_LEN(cp, 0)) {
-		ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
-		    ident);
+		ND_PRINT("%sDissector error: %s() called with pointer past end of packet",
+		    indent, __func__);
 		return(0);
 	}
-	if (ND_BYTES_AVAILABLE_AFTER(cp) < len_to_print)
-		len_to_print = ND_BYTES_AVAILABLE_AFTER(cp);
-	hex_print(ndo, ident, cp, len_to_print);
+	hex_print(ndo, indent, cp, ND_MIN(len, ND_BYTES_AVAILABLE_AFTER(cp)));
 	return(1); /* everything is ok */
 }
 
@@ -488,7 +505,7 @@ print_unknown_data(netdissect_options *ndo, const u_char *cp,
  */
 static const char *
 tok2strbuf(const struct tok *lp, const char *fmt,
-	   u_int v, char *buf, size_t bufsize)
+	   const u_int v, char *buf, const size_t bufsize)
 {
 	if (lp != NULL) {
 		while (lp->s != NULL) {
@@ -510,8 +527,7 @@ tok2strbuf(const struct tok *lp, const char *fmt,
  * in round-robin fashion.
  */
 const char *
-tok2str(const struct tok *lp, const char *fmt,
-	u_int v)
+tok2str(const struct tok *lp, const char *fmt, const u_int v)
 {
 	static char buf[4][TOKBUFSIZE];
 	static int idx = 0;
@@ -532,7 +548,7 @@ tok2str(const struct tok *lp, const char *fmt,
  */
 static char *
 bittok2str_internal(const struct tok *lp, const char *fmt,
-	   u_int v, const char *sep)
+		    const u_int v, const char *sep)
 {
         static char buf[1024+1]; /* our string buffer */
         char *bufp = buf;
@@ -572,8 +588,7 @@ bittok2str_internal(const struct tok *lp, const char *fmt,
  * this is useful for parsing bitfields, the output strings are not separated.
  */
 char *
-bittok2str_nosep(const struct tok *lp, const char *fmt,
-	   u_int v)
+bittok2str_nosep(const struct tok *lp, const char *fmt, const u_int v)
 {
     return (bittok2str_internal(lp, fmt, v, ""));
 }
@@ -583,8 +598,7 @@ bittok2str_nosep(const struct tok *lp, const char *fmt,
  * this is useful for parsing bitfields, the output strings are comma separated.
  */
 char *
-bittok2str(const struct tok *lp, const char *fmt,
-	   u_int v)
+bittok2str(const struct tok *lp, const char *fmt, const u_int v)
 {
     return (bittok2str_internal(lp, fmt, v, ", "));
 }
@@ -596,8 +610,7 @@ bittok2str(const struct tok *lp, const char *fmt,
  * correct for bounds-checking.
  */
 const char *
-tok2strary_internal(const char **lp, int n, const char *fmt,
-	int v)
+tok2strary_internal(const char **lp, int n, const char *fmt, const int v)
 {
 	static char buf[TOKBUFSIZE];
 
@@ -630,7 +643,7 @@ uint2tokary_internal(const struct uint_tokary dict[], const size_t size,
  */
 
 int
-mask2plen(uint32_t mask)
+mask2plen(const uint32_t mask)
 {
 	const uint32_t bitmasks[33] = {
 		0x00000000,
@@ -696,9 +709,9 @@ mask62plen(const u_char *mask)
  * either a space character at the beginning of the line (this
  * includes a blank line) or no more tokens remaining on the line.
  */
-static int
+static u_int
 fetch_token(netdissect_options *ndo, const u_char *pptr, u_int idx, u_int len,
-    u_char *tbuf, size_t tbuflen)
+	    u_char *tbuf, size_t tbuflen)
 {
 	size_t toklen = 0;
 	u_char c;
diff --git a/usr.sbin/tcpdump/tcpdump/Makefile b/usr.sbin/tcpdump/tcpdump/Makefile
index 21c5f9ac7fdf..27270cd34dfb 100644
--- a/usr.sbin/tcpdump/tcpdump/Makefile
+++ b/usr.sbin/tcpdump/tcpdump/Makefile
@@ -116,7 +116,6 @@ SRCS=	addrtoname.c \
 	print-openflow-1.0.c \
 	print-ospf.c \
 	print-ospf6.c \
-	print-otv.c \
 	print-pgm.c \
 	print-pim.c \
 	print-pktap.c \
diff --git a/usr.sbin/tcpdump/tcpdump/config.h b/usr.sbin/tcpdump/tcpdump/config.h
index 5e343d5ed0c3..1ccdbaf7647b 100644
--- a/usr.sbin/tcpdump/tcpdump/config.h
+++ b/usr.sbin/tcpdump/tcpdump/config.h
@@ -3,9 +3,17 @@
 /* config.h.  Generated from config.h.in by configure.  */
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+
+#ifndef TCPDUMP_CONFIG_H_
+#define TCPDUMP_CONFIG_H_
+
+
 /* Define to 1 if arpa/inet.h declares `ether_ntohost' */
 /* #undef ARPA_INET_H_DECLARES_ETHER_NTOHOST */
 
+/* define if you want to build the instrument functions code */
+/* #undef ENABLE_INSTRUMENT_FUNCTIONS */
+
 /* define if you want to build the possibly-buggy SMB printer */
 #define ENABLE_SMB 1
 
@@ -43,9 +51,6 @@
 /* Define to 1 if you have the `EVP_DecryptInit_ex' function. */
 #define HAVE_EVP_DECRYPTINIT_EX 1
 
-/* Define to 1 if you have the <fcntl.h> header file. */
-#define HAVE_FCNTL_H 1
-
 /* Define to 1 if you have the `fork' function. */
 #define HAVE_FORK 1
 
@@ -64,32 +69,23 @@
 /* Define to 1 if you have the `cap-ng' library (-lcap-ng). */
 /* #undef HAVE_LIBCAP_NG */
 
-/* Define to 1 if you have the `crypto' library (-lcrypto). */
+/* Define to 1 if you have a usable `crypto' library (-lcrypto). */
 /* See Makefile */
 /* #undef HAVE_LIBCRYPTO */
 
 /* Define to 1 if you have the `rpc' library (-lrpc). */
 /* #undef HAVE_LIBRPC */
 
-/* Define to 1 if you have the <memory.h> header file. */
-#define HAVE_MEMORY_H 1
-
 /* Define to 1 if you have the <net/if.h> header file. */
 #define HAVE_NET_IF_H 1
 
-/* Define to 1 if printf(3) does not support the z length modifier. */
-/* #undef HAVE_NO_PRINTF_Z */
-
 /* Define to 1 if you have the `openat' function. */
 #define HAVE_OPENAT 1
 
-/* Define to 1 if you have the <openssl/evp.h> header file. */
-#define HAVE_OPENSSL_EVP_H 1
-
 /* define if the OS provides AF_INET6 and struct in6_addr */
 #define HAVE_OS_IPV6_SUPPORT 1
 
-/* if there's an os_proto.h for this platform, to use additional prototypes */
+/* if there's an os-proto.h for this platform, to use additional prototypes */
 /* #undef HAVE_OS_PROTO_H */
 
 /* Define to 1 if you have the `pcap_breakloop' function. */
@@ -179,6 +175,9 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #define HAVE_STDINT_H 1
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#define HAVE_STDIO_H 1
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1
 
@@ -237,7 +236,7 @@
 #define PACKAGE_NAME "tcpdump"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "tcpdump 4.99.5"
+#define PACKAGE_STRING "tcpdump 4.99.6"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "tcpdump"
@@ -246,12 +245,11 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "4.99.5"
-
-/* The size of `void *', as computed by sizeof. */
-/* #undef SIZEOF_VOID_P */
+#define PACKAGE_VERSION "4.99.6"
 
-/* Define to 1 if you have the ANSI C header files. */
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
+   required in a freestanding environment). This macro is provided for
+   backward compatibility; new code need not use it. */
 #define STDC_HEADERS 1
 
 /* Define to 1 if sys/ethernet.h declares `ether_ntohost' */
@@ -293,3 +291,7 @@
 /* Define to the type of an unsigned integer type wide enough to hold a
    pointer, if such a type exists, and if the system does not define it. */
 /* #undef uintptr_t */
+
+
+#endif // TCPDUMP_CONFIG_H_
+