Virgin import of unmodified tcpdump v3.2.1 distribution from LBL.vendor/tcpdump/3.2.1

Obtained from: ftp://ftp.ee.lbl.gov/tcpdump.tar.Z on 19-Aug-1996.

1 files changed, 402 insertions, 0 deletions

diff --git a/contrib/tcpdump/CHANGES b/contrib/tcpdump/CHANGES
new file mode 100644
index 000000000000..d98f03313ece
--- /dev/null
+++ b/contrib/tcpdump/CHANGES
@@ -0,0 +1,402 @@
+@(#) $Header: CHANGES,v 1.42 96/07/23 14:36:37 leres Exp $ (LBL)
+
+v3.2.1 Sun Jul 14 03:02:26 PDT 1996
+
+- Added rfc1716 icmp codes as suggested by Martin Fredriksson
+  (martin@msp.se)
+
+- Print mtu for icmp unreach need frag packets. Thanks to John
+  Hawkinson (jhawk@mit.edu)
+
+- Decode icmp router discovery messages. Thanks to Jeffrey Honig
+  (jch@bsdi.com)
+
+- Added a printer entry for DLT_IEEE802 as suggested by Tak Kushida
+  (kushida@trl.ibm.co.jp)
+
+- Check igmp checksum if possible. Thanks to John Hawkinson.
+
+- Made changes for SINIX. Thanks to Andrej Borsenkow
+  (borsenkow.msk@sni.de)
+
+- Use autoconf's idea of the top level directory in install targets.
+  Thanks to John Hawkinson.
+
+- Avoid infinite loop in tcp options printing code. Thanks to Jeffrey
+  Mogul (mogul@pa.dec.com)
+
+- Avoid using -lsocket in IRIX 5.2 and earlier since it breaks snoop.
+  Thanks to John Hawkinson.
+
+- Added some more packet truncation checks.
+
+- On systems that have it, use sigset() instead of signal() since
+  signal() has different semantics on these systems.
+
+- Fixed some more alignment problems on the alpha.
+
+- Add code to massage unprintable characters in the domain and ipx
+  printers. Thanks to John Hawkinson.
+
+- Added explicit netmask support. Thanks to Steve Nuchia
+  (steve@research.oknet.com)
+
+- Add "sca" keyword (for DEC cluster services) as suggested by Terry
+  Kennedy (terry@spcvxa.spc.edu)
+
+- Add "atalk" keyword as suggested by John Hawkinson.
+
+- Added an igrp printer. Thanks to Francis Dupont
+  (francis.dupont@inria.fr)
+
+- Print IPX net numbers in hex a la Novell Netware. Thanks to Terry
+  Kennedy (terry@spcvxa.spc.edu)
+
+- Fixed snmp extended tag field parsing bug. Thanks to Pascal Hennequin
+  (pascal.hennequin@hugo.int-evry.fr)
+
+- Added some ETHERTYPEs missing on some systems.
+
+- Added truncated packet macros and various checks.
+
+- Fixed endian problems with the DECnet printer.
+
+- Use $CC when checking gcc version. Thanks to Carl Lindberg
+  (carl_lindberg@blacksmith.com)
+
+- Fixes for AIX (although this system is not yet supported). Thanks to
+  John Hawkinson.
+
+- Fix bugs in the autoconf misaligned accesses code fragment.
+
+- Include sys/param.h to get BYTE_ORDER in a few places. Thanks to
+  Pavlin Ivanov Radoslavov (pavlin@cs.titech.ac.jp)
+
+v3.2 Sun Jun 23 02:28:10 PDT 1996
+
+- Print new icmp unreachable codes as suggested by Martin Fredriksson
+  (martin@msp.se). Also print code value when unknown for icmp redirect
+  and time exceeded.
+
+- Fix an alignment endian bug in getname(). Thanks to John Hawkinson.
+
+- Define "new" domain record types if not found in arpa/nameserv.h.
+  Resulted from a suggestion from John Hawkinson (jhawk@mit.edu). Also
+  fixed an endian bug when printing mx record and added some new record
+  types.
+
+- Added RIP V2 support. Thanks to Jeffrey Honig (jch@bsdi.com)
+
+- Added T/TCP options printing. As suggested by Richard Stevens
+  (rstevens@noao.edu)
+
+- Use autoconf to detect architectures that can't handle misaligned
+  accesses.
+
+v3.1 Thu Jun 13 20:59:32 PDT 1996
+
+- Changed u_int32/int32 to u_int32_t/int32_t to be consistent with bsd
+  and bind (as suggested by Charles Hannum).
+
+- Port to GNU autoconf.
+
+- Add support for printing DVMRP and PIM traffic thanks to
+  Havard Eidnes (Havard.Eidnes@runit.sintef.no).
+
+- Fix AppleTalk, IPX and DECnet byte order problems due to wrong endian
+  define being referenced. Reported by Terry Kennedy.
+
+- Minor fixes to the man page thanks to Mark Andrews.
+
+- Endian fixes to RTP and vat packet dumpers, thanks to Bruce Mah
+  (bmah@cs.berkeley.edu).
+
+- Added support for new dns types, thanks to Rainer Orth.
+
+- Fixed tftp_print() to print the block number for ACKs.
+
+- Document -dd and -ddd. Resulted from a bug report from Charlie Slater
+  (cslater@imatek.com).
+
+- Check return status from malloc/calloc/etc.
+
+- Check return status from pcap_loop() so we can print an error and
+  exit with a bad status if there were problems.
+
+- Bail if ip option length is <= 0. Resulted from a bug report from
+  Darren Reed (darrenr@vitruvius.arbld.unimelb.edu.au).
+
+- Print out a little more information for sun rpc packets.
+
+- Add suport for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).
+
+- Fixed the Fix EXTRACT_SHORT() and EXTRACT_LONG() macros (which were
+  wrong on little endian machines).
+
+- Fixed alignment bug in ipx_decode(). Thanks to Matt Crawford
+  (crawdad@fnal.gov).
+
+- Fix ntp_print() to not print garbage when the stratum is
+  "unspecified." Thanks to Deus Ex Machina (root@belle.bork.com).
+
+- Rewrote tcp options printer code to check for truncation. Added
+  selective acknowledgment case.
+
+- Fixed an endian bug in the ospf printer. Thanks to Jeffrey C Honig
+  (jch@bsdi.com)
+
+- Fix rip printer to handle 4.4 BSD sockaddr struct which only uses one
+  octet for the sa_family member. Thanks to Yoshitaka Tokugawa
+  (toku@dit.co.jp)
+
+- Don't checksum ip header if we don't have all of it. Thanks to John
+  Hawkinson (jhawk@mit.edu).
+ 
+- Print out hostnames if possible in egp printer. Thanks to Jeffrey
+  Honig (jhc@bsdi.com)
+
+
+v3.1a1 Wed May  3 19:21:11 PDT 1995
+
+- Include time.h when SVR4 is defined to avoid problems under Solaris
+  2.3.
+
+- Fix etheraddr_string() in the ETHER_SERVICE to return the saved
+  strings, not the local buffer. Thanks to Stefan Petri
+  (petri@ibr.cs.tu-bs.de).
+
+- Detect when pcap raises the snaplen (e.g. with snit). Print a warning
+  that the selected value was not used. Thanks to Pascal Hennequin
+  (Pascal.Hennequin@hugo.int-evry.fr).
+
+- Add a truncated packet test to print-nfs.c. Thanks to Pascal Hennequin.
+
+- BYTEORDER -> BYTE_ORDER Thanks to Terry Kennedy (terry@spcvxa.spc.edu).
+
+v3.0.3 Sun Oct  1 18:35:00 GMT 1995
+
+- Although there never was a 3.0.3 release, the linux boys cleverly
+  "released" one in late 1995.
+
+v3.0.2 Thu Apr 20 21:28:16 PDT 1995
+
+- Change configuration to not use gcc v2 flags with gcc v1.
+
+- Redo gmt2local() so that it works under BSDI (which seems to return
+  an empty timezone struct from gettimeofday()). Based on report from
+  Terry Kennedy (terry@spcvxa.spc.edu).
+
+- Change configure to recognize IP[0-9]* as "mips" SGI hardware. Based
+  on report from Mark Andrews (mandrews@alias.com).
+
+- Don't pass cc flags to gcc. Resulted from a bug report from Rainer
+  Orth (ro@techfak.uni-bielefeld.de).
+
+- Fixed printout of connection id for uncompressed tcp slip packets.
+  Resulted from a bug report from Richard Stevens (rstevens@noao.edu).
+
+- Hack around deficiency in Ultrix's make.
+
+- Add ETHERTYPE_TRAIL define which is missing from irix5.
+
+v3.0.1 Wed Aug 31 22:42:26 PDT 1994
+
+- Fix problems with gcc2 vs. malloc() and read() prototypes under SunOS 4.
+
+v3.0 Mon Jun 20 19:23:27 PDT 1994
+
+- Added support for printing tcp option timestamps thanks to
+  Mark Andrews (mandrews@alias.com).
+
+- Reorganize protocol dumpers to take const pointers to packets so they
+  never change the contents (i.e., they used to do endian conversions
+  in place).  Previously, whenever more than one pass was taken over
+  the packet, the packet contents would be dumped incorrectly (i.e.,
+  the output form -x would be wrong on little endian machines because
+  the protocol dumpers would modify the data).  Thanks to Charles Hannum
+  (mycroft@gnu.ai.mit.edu) for reporting this problem.
+
+- Added support for decnet protocol dumping thanks to Jeff Mogul
+  (mogul@pa.dec.com).
+
+- Fix bug that caused length of packet to be incorrectly printed
+  (off by ether header size) for unknown ethernet types thanks
+  to Greg Miller (gmiller@kayak.mitre.org).
+
+- Added support for IPX protocol dumping thanks to Brad Parker
+  (brad@fcr.com).
+
+- Added check to verify IP header checksum under -v thanks to
+  Brad Parker (brad@fcr.com).
+
+- Move packet capture code to new libpcap library (which is
+  packaged separately).
+
+- Prototype everything and assume an ansi compiler.
+
+- print-arp.c: Print hardware ethernet addresses if they're not
+  what we expect.
+
+- print-bootp.c: Decode the cmu vendor field. Add RFC1497 tags.
+  Many helpful suggestions from Gordon Ross (gwr@jericho.mc.com).
+
+- print-fddi.c: Improvements. Thanks to Jeffrey Mogul
+  (mogul@pa.dec.com).
+
+- print-icmp.c: Byte swap netmask before printing. Thanks to
+  Richard Stevens (rstevens@noao.edu). Print icmp type when unknown.
+
+- print-ip.c: Print the inner ip datagram of ip-in-ip encapsulated packets.
+  By default, only the inner packet is dumped, appended with the token
+  "(encap)".  Under -v, both the inner and output packets are dumped
+  (on the same line).  Note that the filter applies to the original packet,
+  not the encapsulated packet.  So if you run tcpdump on a net with an
+  IP Multicast tunnel, you cannot filter out the datagrams using the
+  conventional syntax.  (You can filter away all the ip-in-ip traffic
+  with "not ip proto 4".)
+
+- print-nfs.c: Keep pending rpc's in circular table. Add generic
+  nfs header and remove os dependences. Thanks to Jeffrey Mogul.
+
+- print-ospf.c: Improvements. Thanks to Jeffrey Mogul.
+
+- tcpdump.c: Add -T flag allows interpretation of "vat", "wb", "rpc"
+  (sunrpc) and rtp packets. Added "inbound" and "outbound" keywords
+  Add && and || operators
+
+v2.2.1 Tue Jun 6 17:57:22 PDT 1992
+
+- Fix bug with -c flag.
+
+v2.2 Fri May 22 17:19:41 PDT 1992
+
+- savefile.c: Remove hack that shouldn't have been exported. Add
+  truncate checks.
+
+- Added the 'icmp' keyword.  For example, 'icmp[0] != 8 and icmp[0] != 0'
+  matches non-echo/reply ICMP packets.
+
+- Many improvements to filter code optimizer.
+
+- Added 'multicast' keyword and extended the 'broadcast' keyword can now be
+  so that protocol qualifications are allowed. For example, "ip broadcast"
+  and "ether multicast" are valid filters.
+
+- Added support for monitoring the loopback interface (i.e. 'tcpdump -i lo').
+  Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) contributed the kernel
+  patches to netinet/if_loop.c.
+
+- Added support for the Ungermann-Bass Ethernet on IBM/PC-RTs running AOS.
+  Contact Jeffrey Honig (jch@MITCHELL.CIT.CORNELL.EDU) for the diffs.
+
+- Added EGP and OSPF printers, thanks to Jeffrey Honig.
+
+v2.1 Tue Jan 28 11:00:14 PST 1992
+
+- Internal release (never publically exported).
+
+v2.0.1 Sun Jan 26 21:10:10 PDT
+
+- Various byte ordering fixes.
+
+- Add truncation checks.
+
+- inet.c: Support BSD style SIOCGIFCONF.
+
+- nametoaddr.c: Handle multi addresses for single host.
+
+- optimize.c: Rewritten.
+
+- pcap-bpf.c: don't choke when we get ptraced. only set promiscuous
+  for broadcast nets.
+
+- print-atal.c: Fix an alignment bug (thanks to
+  stanonik@nprdc.navy.mil) Add missing printf() argument.
+
+- print-bootp.c: First attempt at decoding the vendor buffer.
+
+- print-domain.c: Fix truncation checks.
+
+- print-icmp.c: Calculate length of packets from the ip header.
+
+- print-ip.c: Print frag id in decimal (so it's easier to match up
+  with non-frags). Add support for ospf, egp and igmp.
+
+- print-nfs.c: Lots of changes.
+
+- print-ntp.c: Make some verbose output depend on -v.
+
+- print-snmp.c: New version from John LoVerso.
+
+- print-tcp.c: Print rfc1072 tcp options.
+
+- tcpdump.c: Print "0x" prefix for %x formats. Always print 6 digits
+  (microseconds) worth of precision. Fix uid bugs.
+
+- A packet dumper has been added (thanks to Jeff Mogul of DECWRL).
+  With this option, you can create an architecture independent binary
+  trace file in real time, without the overhead of the packet printer.
+  At a later time, the packets can be filtered (again) and printed.
+
+- BSD is supported.  You must have BPF in your kernel.
+  Since the filtering is now done in the kernel, fewer packets are
+  dropped.  In fact, with BPF and the packet dumper option, a measly
+  Sun 3/50 can keep up with a busy network.
+
+- Compressed SLIP packets can now be dumped, provided you use our
+  SLIP software and BPF.  These packets are dumped as any other IP
+  packet; the compressed headers are dumped with the '-e' option.
+
+- Machines with little-endian byte ordering are supported (thanks to
+  Jeff Mogul).
+
+- Ultrix 4.0 is supported (also thanks to Jeff Mogul).
+
+- IBM RT and Stanford Enetfilter support has been added by
+  Rayan Zachariassen <rayan@canet.ca>.  Tcpdump has been tested under
+  both the vanilla Enetfilter interface, and the extended interface
+  (#ifdef'd by IBMRTPC) present in the MERIT version of the Enetfilter.
+
+- TFTP packets are now printed (requests only).
+
+- BOOTP packets are now printed.
+
+- SNMP packets are now printed. (thanks to John LoVerso of Xylogics).
+
+- Sparc architectures, including the Sparcstation-1, are now
+  supported thanks to Steve McCanne and Craig Leres.
+
+- SunOS 4 is now supported thanks to Micky Liu of Columbia
+  University (micky@cunixc.cc.columbia.edu).
+
+- IP options are now printed.
+
+- RIP packets are now printed.
+
+- There's a -v flag that prints out more information than the
+  default (e.g., it will enable printing of IP ttl, tos and id)
+  and -q flag that prints out less (e.g., it will disable
+  interpretation of AppleTalk-in-UDP).
+
+- The grammar has undergone substantial changes (if you have an
+  earlier version of tcpdump, you should re-read the manual
+  entry).
+
+  The most useful change is the addition of an expression
+  syntax that lets you filter on arbitrary fields or values in the
+  packet.  E.g., "ip[0] > 0x45" would print only packets with IP
+  options, "tcp[13] & 3 != 0" would print only TCP SYN and FIN
+  packets.
+
+  The most painful change is that concatenation no longer means
+  "and" -- e.g., you have to say "host foo and port bar" instead
+  of "host foo port bar".  The up side to this down is that
+  repeated qualifiers can be omitted, making most filter
+  expressions shorter.  E.g., you can now say "ip host foo and
+  (bar or baz)" to look at ip traffic between hosts foo and bar or
+  between hosts foo and baz.  [The old way of saying this was "ip
+  host foo and (ip host bar or ip host baz)".]
+
+v2.0 Sun Jan 13 12:20:40 PST 1991
+
+- Initial public release.