1 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
2 Summary for 1.11.0 libpcap release (so far!)
4 Use C99 fixed-width integer types, rather than self-defined
5 fixed-width integer types, in rpcap code.
6 Remove an always-false pointer test from snf_read().
7 Clean up DECnet address handling.
8 struct pcap: Update buffer type from "void *" to "u_char *".
9 Make pcap_strerror() more thread-safe.
11 Add LINKTYPE_ETW/DLT_ETW.
12 Add LINKTYPE_NETANALYZER_NG/DLT_NETANALYZER_NG (pull request
14 Add LINKTYPE_ZBOSS_NCP/DLT_ZBOSS_NCP.
15 Add LINKTYPE_USB_2_0_LOW_SPEED/DLT_USB_2_0_LOW_SPEED,
16 LINKTYPE_USB_2_0_FULL_SPEED/DLT_USB_2_0_FULL_SPEED,
17 LINKTYPE_USB_2_0_HIGH_SPEED/DLT_USB_2_0_HIGH_SPEED
18 Add LINKTYPE_AUERSWALD_LOG/DLT_AUERSWALD_LOG.
19 Add LINKTYPE_ZWAVE_TAP/DLT_ZWAVE_TAP.
20 Add LINKTYPE_SILABS_DEBUG_CHANNEL/DLT_SILABS_DEBUG_CHANNEL.
21 Add LINKTYPE_FIRA_UCI/DLT_FIRA_UCI.
23 Add support for Block Ack Req and Block Ack frame types (pull
25 Deprecate pcap_compile_nopcap().
27 Reject pcap files where one of the reserved fields in the
28 "link-layer type plus other stuff" is non-zero.
30 Support user names and passwords in rpcap:// and rpcaps:// URLs.
31 Add a -t flag to rpcapd to specify the data channel port; from
32 another incorporate-remote-capture project. (issue #1120)
34 Document a standard format for writing out BPF filter programs.
35 Explain "other addresses" in pcap_findalldevs(3PCAP).
36 Add a README.hurd.md file.
37 Document pcap_lookupnet(3PCAP) a bit better.
39 Apply GNU Hurd support patch from the Debian package.
40 CI: Introduce and use LIBPCAP_CMAKE_TAINTED.
41 Remove all remaining support for AOS (4.3BSD Unix), BSD/OS, DOS,
42 HP-UX before 10.20, IRIX, {OSF/1, Digital Unix, Tru64 Unix}, SINIX,
43 SunOS 3.x, 4.x and 5.x before 5.3.2, and Ultrix.
44 Add a new test program for pcap_activate().
45 Make NetBSD build warning-free.
46 Make Sun C build warning-free.
47 Make FreeBSD, Linux and macOS builds warning-free.
48 Print MAC addresses in findalldevstest.
49 When necessary, trust the OS to implement ffs().
50 Fix HCI_CHANNEL_MONITOR detection with musl libc.
51 At build time require a proof of suitable snprintf(3) implementation in
52 libc (and document Solaris 9 and MinGW as unsupported because of that).
53 Makefile.in: Update the .c.o build rule (Remove hacks for old SunOS 4).
55 Support network capture devices too.
56 Fix a few device activation bugs.
57 Count and timestamp packets better.
58 Add kernel filtering, fix userland filtering.
60 DayOfTheWeek, Month DD, YYYY / The Tcpdump Group
61 Summary for 1.10.5 libpcap release (so far!)
63 Spell WirelessHART details properly.
64 Mark pcap_vasprintf() as printf-like.
65 Finalize moving of bpf_filter.c. (GH #1166)
66 Remove an unneeded argument from gen_mcode6().
67 Don't do some Berkeley YACC workarounds with YACC releases not
69 Use correct data types rather than int in some cases.
70 Squelch compiler warning in grammar.c.
71 Fix findalldevtest compilation if IPv6 isn't enabled.
72 Rename helper routines for pcap modules to have names beginning with
73 pcapint_, to avoid namespace collisions for code linking statically
75 Avoid casting hack for the Windows cleanup-on-exit routine.
76 Use %zu format for one case of printing a size_t.
77 Fix some Coverity errors.
78 Fix availabilities of some functions to match reality.
79 pcap: make the seconds and microseconds/nanoseconds fields unsigned.
81 Make some static variables thread-local; fixes issue #1174.
83 Improve reporting of some invalid filter expressions.
84 Return an error from pcap_compile() if the scanner fails to initialize.
85 Optimizer fix from Archit Shah to recompute dominators after
86 moving code (#976); fixes #945 (although the resulting filter
88 Optimizer fix from Archit Shah to mark value as unknown when store
89 of that value is deleted (#972); fixes #143, #434, #436, #437,
92 Properly return warnings.
93 Don't use DLT_LINUX_SLL2 for anything other than the "any" device.
94 Avoid 32-bit unsigned integer overflow in USB captures. Fixes
95 issues #1134 and #1205.
96 Fix a file descriptor leak.
97 Properly report warnings about unknown ARPHRD_ types.
98 Fix DLT_CAN_SOCKETCAN handling of CAN FD
99 Add CAN XL support to DLT_CAN_SOCKETCAN
100 Clean up the code that sets the "real" ("original") length for
101 isochronous USB transfers.
103 Handle BPF returning ESRCH for unknown devices.
104 List the "any" device if it's supported.
105 Report {non-existent zone}/{interface} errors appropriately.
106 Allow attaching to links owned by a non-global zone. (Based on
108 Fix AF_LINK handling on illumos.
110 Redid the availability macros to be closer to what Apple's doing
111 in recent SDKs, including tagging pcap-namedb.h routines.
112 Fix the install name of the installed shared library to have a
113 full path when building with CMake.
114 Fix universal builds.
116 Convert the module to C. Fixes issue #1114.
117 Address a few compiler warnings. Fixes issue #1114.
118 Fix various build problems. Fixes issue #1114.
119 Report non-existent devices correctly.
120 Fix handling of packet statistics.
121 Fix packet timestamping.
122 Fix packet filtering with low snaplen.
123 Improve connection status reporting.
124 Add support for promiscuous mode.
125 Detect DLTs and loopback capture support at run time.
126 Report IEEE 802.11 as PCAP_IF_WIRELESS.
128 Fix internal handling of "not supported" error codes from NPF.
129 Work around a bug in Npcap 1.00 in case of driver version mismatch.
131 Format an error message if we run out of memory.
133 Fix count of dropped packets.
134 Make sure we don't overflow when rounding up the TLV length.
136 Handle routines removed in at least some OpenSSL libraries.
137 Clean up sock_initaddress() and its callers to avoid double frees
139 Don't define SOCKET ourselves; instead, define PCAP_SOCKET as int
140 on UN*Xes and as SOCKET on Windows.
142 Handle DLT_/LINKTYPE_ mapping better, to handle some
143 OpenBSD-specific link types better.
144 Treat if_tsoffset as signed in pcapng files, as the spec says.
145 Don't try to fix the "real" length for isochronous USB
146 transfers if the number of USB descriptors is too large.
147 Building and testing:
148 Add a configure option to help debugging (--enable-instrument-functions)
149 Improved tests and error reporting for uses of pkg-config, and
152 With CMake, install headers in CMAKE_INSTALL_INCLUDEDIR rather
154 Build libpcap.a before building test programs.
155 Print address family numerically, as well as symbolically,
157 Fail with suggestions, rather than failing over to no capture
158 support, if no capture mechanism was found. Fixes issue #1016.
159 Don't indent comments in Make, as that may cause them not to be
160 recognized as comments.
161 Don't check for libssl if we aren't going to use it.
162 Better handle enabling and disabling of sanitizers. Fixes issue
164 CMakeLists.txt: Print "Symlinking: /some/path to ..." conditionally.
165 Evaluate CMAKE_INSTALL_PREFIX at install time.
166 cmake: Update the minimum required version to 2.8.12 (except Windows).
167 cmake: suppress CMP0042 OLD deprecated warning.
168 Makefile.in: Add the releasecheck target.
169 Cirrus CI: Add the "make releasecheck" command in the Linux task.
170 Makefile.in: Add the whitespacecheck target.
171 Cirrus CI: Run the "make whitespacecheck" command in the Linux task.
172 Autoconf: Update config.{guess,sub}, timestamps 2024-01-01
173 Autoconf: Update the install-sh script to the 2020-11-14.01 version.
174 Compile with '-Wnull-pointer-subtraction',
175 '-Wunused-but-set-parameter', and '-Wunused-but-set-variable' in
176 devel mode if supported
177 Don't ignore spaces between CMAKE_C_FLAGS and DPDK_C_FLAGS with
179 Use noreturn and __format__ with XL C 7.0 and later.
180 Check for the same -W flags in autotools and CMake.
181 Autoconf: Add autogen.sh, remove configure and config.h.in and put
182 these generated files in the release tarball.
183 Autoconf: Get the size of a time_t.
184 Fix propagation of cc_werr_cflags() output.
185 Makefile.in(s): Fix the depend target.
186 mkdep: Exit with a non-zero status if a command fails.
188 Update and fix pcap-filter man page.
189 Add a README.haiku.md file.
190 Document pcap-config better.
191 Man page formatting and prose fixes.
192 Rename doc/README.Win32.md to doc/README.windows.md.
193 Update pcap-savefile man page to match the Internet-Draft for
195 Fix CMake issues for target used by other projects.
196 Explain "any" device better in pcap_open_live(3PCAP).
198 Note in man pages that errbuf arguments must point to an error
201 Friday, April 7, 2023 / The Tcpdump Group
202 Summary for 1.10.4 libpcap release
204 Fix spaces before tabs in indentation.
206 Fix name of launchd service.
208 Document use of rpcapd with systemd, launchd, inetd, and xinetd.
209 Building and testing:
210 Require at least pkg-config 0.17.0, as we use --static.
211 Get rid of the remains of gnuc.h.
212 Require at least autoconf 2.69.
213 Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21.
215 Thursday, January 12, 2023 / The Tcpdump Group
216 Summary for 1.10.3 libpcap release
218 Sort the PUBHDR variable in Makefile.in in "ls" order.
219 Fix typo in comment in pflog.h.
220 Remove two no-longer-present files from .gitignore.
221 Update code and comments for handling failure to set promiscuous
222 mode based on new information.
223 Building and testing:
224 install: Fixed not to install the non-public pcap-util.h header.
225 pcap-config: add a --version flag.
226 Makefile.in: Add some missing files in the distclean target.
228 Saturday, December 31, 2022 / The Tcpdump Group
229 Summary for 1.10.2 libpcap release
231 Use __builtin_unreachable() in PCAP_UNREACHABLE.
232 Use AS_HELP_STRING macro instead of AC_HELP_STRING in the
233 configure scripts, to avoid deprecation warnings.
234 Change availability tags in pcap.h to make it easier to
235 arrange for it to be used in Darwin releases.
236 Use AS_HELP_STRING for --enable-remote.
237 Fix some formatting string issues found by cppcheck.
238 Various small code and comment cleanups.
239 Use PCAP_ERROR (defined as -1) rather than explicit -1 for
240 functions the documentation says return PCAP_ERROR.
241 Remove unused code from the filter compiler.
242 Use _declspec(deprecated(msg)) rather than __pragma(deprecated)
243 for Windows deprecation warnings, so the message that was
245 diag-control.h: define PCAP_DO_PRAGMA() iff we're going to use it.
246 Use "%d" to print some signed ints.
247 Use the Wayback Machine for a removed document in a comment.
248 Add some const qualifiers.
249 RDMA: Use PRIu64 to print a uint64_t.
250 "Dead" pcap_ts from pcap_open_dead() and ..._with_tstamp_precision():
251 Don't crash if pcap_breakloop() is called.
253 Fix pcap_dispatch() to return number of packets processed, rather
255 If we get an error writing the packet header, don't write the
257 Put PFLOG UID and PID values in the header into host byte order
258 when reading a LINKTYPE_PFLOG file.
259 Put CAN ID field in CAN pseudo-headers for LINUX_SLL2, as we do
261 Fix incorrectly-computed "real" length for isochronous USB
262 transfers when reading savefiles.
263 Don't crash if pcap_can_set_rfmon() is called.
264 Fix pcap_offline_read() loop.
266 Never process more than INT_MAX packets in a pcap_dispatch() call,
267 to avoid integer overflow (issue #1087).
268 Improve error messages for "no such device" and "permission
270 SITA: Fix a typo in a variable name.
272 Get PFLOG header length from the length value in the header.
273 Support all the direction, reason, and action types supported by
274 all systems that support PFLOG.
275 Don't require PFLOG support on the target machine in order to
276 support PFLOG filtering (also fixes issue #1076).
277 Expand abbreviations into "proto X" properly.
278 gencode.c: Update a comment about the VLAN TPID test.
279 Add the minimum and maximum matching DLTs to an error message.
281 Fix memory leak in capture device open (pull request #1038).
282 Fix detection of CAN/CAN FD packets in direction check (issue
284 Fix double-free crashes on errors such as running on a kernel with
285 CONFIG_PACKET_MMAP not configured (issue #1054).
286 Use DLT_CAN_SOCKETCAN for CANbus interfaces (issue #1052; includes
287 changes from pull request #1035).
288 Make sure the CANFD_FDF can be relied on to indicate whether a
289 CANbus packet is a CAN frame or a CAN FD frame
290 Improve error message for "out of memory" errors for kernel
291 filters (see issue #1089).
292 Fix pcap_findalldevs() to find usbmon devices.
293 Fix handling of VLAN tagged packets if the link-layer type is
294 changed from DLT_LINUX_SLL to DLT_LINUX_SLL2 (see issue #1105).
295 Always turn on PACKET_AUXDATA (see issue #1105).
296 We require 2.6.27 or later, so PACKET_RESERVE is available.
297 Make sure there's reserved space for a DLT_LINUX_SLL2 header
299 Correctly compute the "real" length for isochronous USB transfers.
300 Don't have an eventfd descriptor open in non-blocking mode, so as
301 not to waste descriptors.
302 netfilter: Squelch a narrowing warning (To be look at before 2038).
303 BPF capture (*BSD, macOS, AIX, Solaris 11):
304 Fix case where a device open might fail, rather than falling back
305 to a smaller buffer size, when the initial buffer size is too
307 Use an unsigned device number to iterate over BPF devices, to
308 squelch a compiler warning.
310 Fix handling of LINKTYPE_HDLC/DLT_HDLC.
312 Fix unaligned accesses in rpcapd (pull request #1037).
313 Fix code to process port number.
314 Clean up findalldevs code in rpcapd.
315 Clean up bufferizing code.
316 Fix a file descriptor/handle leak in pcap_findalldevs_ex()
317 (Coverity CID 1507240).
318 Improve error messages for host and port resolution errors.
319 Fix connect code not to fail if both IPv4 and IPv6 addresses are
321 Improve connect failure error message.
322 Provide an error message for a bad authentication reply size.
323 For link-layer types with host-endian fields in the header, fix
324 those fields if capturing from a server with a different byte
326 Suppress temporarily the warnings with "enable remote packet capture".
328 Add support for NdisMediumIP (pull request #1027).
329 Don't require applications using pcap to be built with VS 2015 or
331 Use the correct string for the DLL VersionInfo.
332 Remove unnecessary DllMain() function.
333 Correctly handle ERROR_INVALID_FUNCTION from
334 PacketGetTimestampModes() (indicate that WinPcap or an older
335 version of Npcap is probably installed).
336 Fix use-after-free in some cases when a pcap_t is closed.
337 Make sure an error is returned by pcap_create_interface() if
338 PacketOpenAdapter() fails.
339 Return an error if the driver reports 0 timestamp modes supported.
340 Close the ADAPTER handle for some errors in
341 pcap_create_interface().
342 Get rid of old unmaintained VS project files.
343 Fix deprecation warning for pcap_handle().
344 Npcap is now at npcap.com, not npcap.org.
345 Make sure "no such device" and "no permission to open device"
346 errors show up in pcap_activate(), not pcap_create() (fixes,
347 among other things, tcpdump -i <interface-number>).
348 npcap: squelch deprecation warnings for kernel dump mode.
350 Implement pcap_lib_version(), as now required.
351 Handle negative or too-large snaplen values.
352 Fix various build issues and warnings.
353 Building and testing:
354 Update configure-time universal build checks for macOS.
355 Update config.guess and config.sub.
356 If we look for an SSL library with pkg-config in configure script,
357 try pkg-config first.
358 If we have pkg-config and Homebrew, try to set pkg-config up to
359 find Homebrew packages.
360 Handle some Autoconf/make errors better.
361 Use "git archive" for the "make releasetar" process.
362 Remove the release candidate rcX targets.
363 Fix compiling on Solaris 9/SPARC and 11/AMD64.
364 Address assorted compiler warnings.
365 Fix cross-building on Linux for Windows with mingw32 for Win64
366 (pull request #1031).
367 Properly set installation directory on Windows when not compiling
369 Fix configure script checks for compiler flags.
370 Give more details if check for usable (F)Lex fails.
371 Fix compiling with GCC 4.6.4.
372 Don't use add_compile_options() with CMake, as we currently don't
373 require 2.8.12, where it first appeared.
374 Don't provide -L/usr/lib for pkg-config --libs in pkg-config.
375 Fix error message for inadequate Bison/Berkeley YACC.
376 configure: correctly do some DPDK checks.
377 Only use pkg-config when checking for DPDK.
378 Allow the path in which DPDK is installed to be specified.
379 Use pkg-config first when checking for libibverbs.
380 CMake: fix check for libibverbs with Sun's C compiler.
381 Have CMake warn if no capture mechanism can be found.
382 Don't do stuff requiring 3.19 or later on earlier CMakes.
383 Squelch some CMake warnings.
384 Fix diag-control.h to handle compiling with clang-cl (issues
386 Cleanup various leftover cruft in the configure script.
387 Fix building without protochain support. (GH #852)
388 Check for a usable YACC (or Bison) and {F}lex in CMake, as we do
390 Only check for a C++ compiler on Haiku, as that's the only
391 platform with C++ code, and make sure they generate code for
392 the same instruction set bit-width (both 32-bit or both 64-bit)
394 On Solaris, check the target bit-width and set PKG_CONFIG_PATH
395 appropriately, to handle the mess that is the D-Bus library
396 package (issue #1112).
397 Fix generation of pcap-config and libpcap.pc files (issue #1062).
398 pcap-config: don't assume the system library directory is /usr/lib.
399 pcap-config: add a --static-pcap-only flag.
400 Cirrus CI: Use the same configuration as for the main branch.
401 Add four libpcap test files.
402 Update Npcap SDK to 1.13.
403 Makefile.in: Use TEST_DIST, like for tcpdump.
404 Remove awk code from mkdep.
405 Cirrus CI: Add the libssl-dev package in the Linux task.
406 Cirrus CI: Add the openssl@3 brew package in the macOS task.
407 Get "make shellcheck" to pass again.
408 CMake: Build valgrindtest only if Autoconf would.
409 CMake: use ${CMAKE_INSTALL_SBINDIR} rather than just sbin.
410 CMake: use NUL: as the null device on Windows.
411 autoconf: fix typo in test of macOS version.
412 Makefile.in: Add two missing files in EXTRA_DIST.
413 autotools, cmake: provide an rpath option if necessary.
414 configure: get rid of the attempt to auto-run PKG_PROG_PKG_CONFIG.
415 configure: use PKG_CHECK_MODULES to run pkg-config.
417 Add README.solaris.md.
418 Add SCTP to pcap-filter(7).
419 Note that = and == are the same operator in filters (issue #1044).
420 Update INSTALL.md, README.md, and README.solaris.md.
421 Update and clean up CONTRIBUTING.md.
422 Trim documentation of support for now-dead UN*Xe and older
423 versions of other UN*Xes.
424 Move the "how to allocate a LINKTYPE_/DLT_ value" documentation to
427 Move README.capture-module to the web site.
428 Improve some protocol details in pcap-filter(7).
429 Refine "relop" notes in pcap-filter(7).
430 In pcap-filter(7) "domain" is an id.
431 Discuss backward compatibility in pcap-filter(7).
432 Other improvements to pcap-filter(7).
433 Document pcap_breakloop(3PCAP) interaction with threads better.
434 Document PCAP_ERROR_NOT_ACTIVATED for more routines.
436 Wednesday, June 9, 2021:
437 Summary for 1.10.1 libpcap release:
439 Fix "type XXX subtype YYY" giving a parse error
441 Add PCAP_AVAILABLE_1_11.
442 Building and testing:
443 Rename struct bpf_aux_data to avoid NetBSD compile errors
444 Squelch some compiler warnings
445 Squelch some Bison warnings
446 Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR
447 Fix Bison detection for minor version 0.
448 Fix parallel build with FreeBSD make.
449 Get DLT_MATCHING_MAX right in gencode.c on NetBSD.
450 Define timeradd() and timersub() if necessary.
451 Fix Cygwin/MSYS target directories.
452 Fix symlinking with DESTDIR.
453 Fix generation of libpcap.pc with CMake when not building a shared
455 Check for Arm64 as well as x86-64 when looking for packet.lib on
458 Refine Markdown in README.md.
459 Improve the description of portrange in filters.
460 README.linux.md isn't Markdown, rename it just README.linux.
462 Support reading version 1.2, which some writers produce, and which
463 is the same as 1.0 (some new block types were added, but
464 that's not sufficient reason to bump the minor version number,
465 as code that understands those new block types can handle them
468 Drop support for text-mode USB captures, as we require a 2.6.27
469 or later kernel (credit to Chaoyuan Peng for noting the
470 sscanf vulnerabilities in the text-mode code that got me to
471 realize that we didn't need this code any more)
472 Bluetooth: fix non-blocking mode.
473 Don't assume that all compilers used to build for Linux support
474 the __atomic builtins
476 Add more information in "interface disappeared" error messages, in
477 the hopes of trying to figure out the cause.
478 Treat ERROR_DEVICE_REMOVED as "device was removed".
479 Indicate in the error message which "device was removed" error
481 Report the Windows error status if PacketSendPacket() fails.
482 Use %lu for ULONGs in error message formats.
483 Don't treat the inability to find airpcap.dll as an error.
484 Ignore spurious error reports by Microsoft Surface mobile
485 telephony modem driver
487 Clean up error checking and error messages for server address
490 Tuesday, December 29, 2020
491 Summary for 1.10.0 libpcap release
492 Add support for capturing on DPDK devices
493 Label most APIs by the first release in which they're available
494 Fix some memory leaks, including in pcap_compile()
495 Add pcap_datalink_val_to_description_or_dlt()
496 Handle the pcap private data in a fashion that makes fewer
497 assumptions about memory layouts (might fix GitHub issue #940
499 Fix some thread safety issues
500 pcap_findalldevs(): don't sort interfaces by unit number
501 Always return a list of supported time-stamp types, even if only
502 host time stamps are supported
503 Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP
504 Report the DLT description in error messages
505 Add pcap_init() for first-time initialization and global option
506 setting; it's not required, but may be used
507 Remove (unused) SITA support
508 Capture file reading:
509 Correctly handle pcapng captures with more than one IDB with a
510 snapshot length greater than the supported maximum
511 Capture file writing:
512 Create the file in pcap_dump_open_append() if it doesn't exist
514 Fix "unknown ether proto 'aarp'"
515 Add a new filter "ifindex" for DLT_LINUX_SLL2 files on all
516 platforms and live Linux captures
517 Add a hack to the optimizer to try to catch certain optimizer
518 loops (should prevent GitHub issue #112)
519 Show special Linux BPF offsets symbolically in bpf_image() and
521 Added support for ICMPv6 types 1-4 as tokens with names
522 Remove undocumented and rather old "ether proto" protocols
523 Catch invalid IPv4 addresses in filters
524 Don't assume ARM supports unaligned accesses
525 Security and other issues found by analysis:
526 Fix various security issues reported by Charles Smith at Tangible
528 Fix various security issues reported by Include Security
529 Fix some issues found by cppcheck.
530 Add some overflow checks in the optimizer
532 Support rpcap-over-TLS
533 Redo protocol version negotiation to avoid problems with old
534 servers (it still works with servers using the old negotiation,
535 as well as servers not supporting negotiation)
536 Error handling cleanups
537 Add some new authentication libpcap error codes for specific
539 Fix some inetd issues in rpcapd
540 Fix rpcapd core dumps with invalid configuration file
541 On UN*X, don't have rpcapd tell the client why authentication
542 failed, so a brute-force attacker can't distinguish between
543 "unknown user name" and "known user name, wrong password"
544 Allow rpcapd to rebind more rapidly (GitHub issue #765)
546 Improve man pages, including adding backward compatibility notes
547 Building and testing:
548 Require, and assume, some level of C99 support in the C compiler
549 Require Visual Studio 2015 or later if using Visual Studio
550 Fix configure script issues, including with libnl on Linux
552 Squelch complaints from Bison about "%define api.pure" being
554 Fix compilation of pcap-tc.c
556 Require PF_PACKET support, and kernel 2.6.27 or later
557 Handle systems without AF_INET or AF_UNIX socket support
558 Get rid of Wireless Extensions for turning monitor mode on
559 Proper memory sync for PACKET_MMAP (may prevent GitHub issue
561 Drop support for libnl 1 and 2.
562 Return error on interface going away, but not if it just went
563 down but is still present
564 Set socket protocol only after packet ring configured,
565 reducing bogus packet drop reports
566 Get ifdrop stats from sysfs.
567 When adjusting BPF programs, do not subtract the
568 SLL[2]_HDR_LEN if the location is negative (special metadata
569 offset), to preserve references to metadata; see
570 https://github.com/the-tcpdump-group/tcpdump/issues/480#issuecomment-486827278
571 Report a warning for unknown ARPHRD types
572 Have pcap_breakloop() forcibly break out of a sleeping
574 Add support for DSA data link types
575 For raw USB bus capture, use the snapshot length to set the
576 buffer size, and set the len field to reflect the length
577 in the URB (GitHub issue #808)
578 With a timeout of zero, wait indefinitely
579 Clean up support for some non-GNU libc C libraries
580 Add DLT_LINUX_SLL2 for cooked-mode captures
581 Probe CONFIGURATION descriptor of connected USB devices
582 Treat EPERM on ethtool ioctls as meaning "not supported", as
583 permissions checks are done before checking whether the
584 ioctl is supported at all
586 Cope with getting EPWROFF from SIOCGIFMEDIA
587 Treat EPERM on SIOCGIFMEDIA as meaning "not supported", as
588 permissions checks are done before checking whether the
589 ioctl is supported at all
590 Treat ENXIO when reading packets as meaning "the interface
592 Report "the interface disappeared", not "the interface went
593 down", if the interface was removed during a capture
595 Treat ENXIO as meaning "the interface was removed"
596 Report "the interface disappeared", not "the interface went
597 down", if the interface was removed during a capture
599 Treat ENXIO as meaning "the interface was removed"
600 Report "the interface disappeared", not "the interface went
601 down", if the interface was removed during a capture
603 Treat EIO as meaning "the interface was removed"
604 Report "the interface disappeared", not "the interface went
605 down", if the interface was removed during a capture
607 Treat ENXIO as meaning "the interface was removed"
608 Report "the interface disappeared", not "the interface went
609 down", if the interface was removed during a capture
611 Treat ENXIO as meaning "the interface was removed"
612 Report "the interface disappeared", not "the interface went
613 down", if the interface was removed during a capture
615 Fix loading of BPF kernel extension
616 Treat ENXIO as meaning "the interface was removed"
617 Report "the interface disappeared", not "the interface went
618 down", if the interface was removed during a capture
620 Make the snapshot length work even if pcap_setfilter()
622 Fix compilation on Cygwin/MSYS
623 Add pcap_handle(), and deprecate pcap_fileno()
624 Report PCAP_ERROR_NO_SUCH_DEVICE for a nonexistent device
625 Return an appropriate error message for device removed or
626 device unusable due to a suspend/resume
627 Report a warning for unknown NdisMedium types
628 Have pcap_breakloop() forcibly break out of a sleeping
630 Clean up building DLL
631 Handle CRT mismatch for pcap_dump_fopen()
632 Map NdisMediumWirelessWan to DLT_RAW
633 Add AirPcap support in a module, rather than using
634 WinPcap/Npcap's support for it
635 Report the system error for PacketSetHwFilter() failures
636 Add support for getting and setting packet time stamp types
638 Have pcap_init() allow selecting whether the API should use
639 local code page strings or UTF-8 strings (including error
644 Sunday, July 22, 2018
645 Summary for 1.9.1 libpcap release
646 Mention pcap_get_required_select_timeout() in the main pcap man page
647 Fix pcap-usb-linux.c build on systems with musl
648 Fix assorted man page and other documentation issues
649 Plug assorted memory leaks
650 Documentation changes to use https:
651 Changes to how time stamp calculations are done
652 Lots of tweaks to make newer compilers happier and warning-free and
653 to fix instances of C undefined behavior
654 Warn if AC_PROG_CC_C99 can't enable C99 support
655 Rename pcap_set_protocol() to pcap_set_protocol_linux().
656 Align pcap_t private data on an 8-byte boundary.
657 Fix various error messages
658 Use 64-bit clean API in dag_findalldevs()
659 Fix cleaning up after some errors
660 Work around some ethtool ioctl bugs in newer Linux kernels (GitHub
662 Add backwards compatibility sections to some man pages (GitHub issue
664 Fix autotool configuration on AIX and macOS
665 Don't export bpf_filter_with_aux_data() or struct bpf_aux_data;
666 they're internal-only and subject to change
667 Fix pcapng block size checking
668 On macOS, don't build rpcapd or test programs any fatter than they
670 Fix reading of capture statistics for Linux USB
671 Fix packet size values for Linux USB packets (GitHub issue #808)
672 Check only VID in VLAN test in filters (GitHub issue #461)
673 Fix pcap_list_datalinks on 802.11 devices on macOS
674 Fix overflows with very large snapshot length in pcap file
675 Improve parsing of rpcapd configuration file (GitHub issue #767)
676 Handle systems without strlcpy() or strlcat() better
677 Fix crashes and other errors with invalid filter expressions
678 Fix use of uninitialized file descriptor in remote capture
679 Fix some CMake issues
680 Fix some divide-by-zero issues with the filter compiler
681 Work around a GNU libc bug in pcap_nametonetaddr()
682 Add support for DLT_LINUX_SLL2
683 Fix handling of the packet-count argument for Myricom SNF devices
684 Fix --disable-rdma in configure script (GitHub issue #782)
685 Fix compilation of TurboCap support (GitHub issue #764)
686 Constify first argument to pcap_findalldevs_ex()
687 Fix a number of issues when running rpcapd as an inetd-style daemon
688 Fix CMake issues with D-Bus libraries
689 In rpcapd, clean up termination of a capture session
690 Redo remote capture protocol negotiation
691 In rpcapd, report the same error for "invalid user name" and
692 "invalid password", to make brute-forcing harder
693 For remote captures, add an error code for "the server requires TLS"
694 Fix pcap_dump_fopen() on Windows to avoid clashes between
695 {Win,N}Pcap and application C runtimes
696 Fix exporting of functions from Windows DLLs (GitHub issue #810)
697 Fix building as part of Npcap
698 Allow rpcapd to rebind more rapidly
699 Fix building shared libpcap library on midipix (midipix.org)
700 Fix hack to detect UTF-16LE adapter names on Windows not to go past
701 the end of the string
702 Fix handling of "wireless WAN" (mobile phone network modems) on
703 Windows with WinPcap/Npcap (GitHub issue #824)
704 Have pcap_dump_open_append() create the dump file if it doesn't
705 exists (GitHub issue #247)
706 Fix the maximum snapshot length for DLT_USBPCAP
707 Use -fPIC when building for 64-bit SPARC on Linux (GitHub issue #837)
708 Fix CMake 64-bit library installation directory on some Linux
710 Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was
712 Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165
713 PCAPNG reader applies some sanity checks before doing malloc().
715 Sunday, June 24, 2018, by mcr@sandelman.ca
716 Summary for 1.9.0 libpcap release
717 Added testing system to libpcap, independent of tcpdump
718 Changes to how pcap_t is activated
719 Adding support for Large stream buffers on Endace DAG cards
720 Changes to BSD 3-clause license to 2-clause license
721 Additions to TCP header parsing, per RFC3168
722 Add CMake build process (extensive number of changes)
723 Assign a value for OpenBSD DLT_OPENFLOW.
724 Support setting non-blocking mode before activating.
725 Extensive build support for Windows VS2010 and MINGW (many many changes, over many months)
726 Added RPCAPD support when --enable-remote (default no)
727 Add the rpcap daemon source and build instructions.
728 Put back the greasy "save the capture filter string so we can tweak it"
729 hack, that keeps libpcap from capturing rpcap traffic.
730 Fixes for captures on MacOS, utun0
731 fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses.
732 Add a linktype for IBM SDLC frames containing SNA PDUs.
733 pcap_compile() in 1.8.0 and later is newly thread-safe.
734 bound snaplen for linux tpacket_v2 to ~64k
735 Make VLAN filter handle both metadata and inline tags
736 D-Bus captures can now be up to 128MB in size
737 Added LORATAP DLT value
738 Added DLT_VSOCK for https://qemu-project.org/Features/VirtioVsock
739 probe_devices() fixes not to overrun buffer for name of device
740 Add linux-specific pcap_set_protocol_linux() to allow specifying a specific capture protocol.
741 RDMA sniffing support for pcap
742 Add Nordic Semiconductor Bluetooth LE sniffer link-layer header type.
743 fixes for reading /etc/ethers
744 Make it possible to build on Windows without packet.dll.
745 Add tests for large file support on UN*X.
746 Solaris fixes to work with 2.8.6
747 configuration test now looks for header files, not capture devices present
748 Fix to work with Berkeley YACC.
749 fixes for DragonBSD compilation of pcap-netmap.c
750 Clean up the ether_hostton() stuff.
751 Add an option to disable Linux memory-mapped capture support.
752 Add DAG API support checks.
753 Add Septel, Myricom SNF, and Riverbed TurboCap checks.
754 Add checks for Linux USB, Linux Bluetooth, D-Bus, and RDMA sniffing support.
755 Add a check for hardware time stamping on Linux.
756 Don't bother supporting pre-2005 Visual Studio.
757 Increased minimum autoconf version requirement to 2.64
758 Add DLT value 273 for XRA-31 sniffer
759 Clean up handing of signal interrupts in pcap_read_nocb_remote().
760 Use the XPG 4.2 versions of the networking APIs in Solaris.
761 Fix, and better explain, the "IPv6 means IPv6, not IPv4" option setting.
762 Explicitly warn that negative packet buffer timeouts should not be used.
763 rpcapd: Add support inetd-likes, including xinetd.conf, and systemd units
764 Rename DLT_IEEE802_15_4 to DLT_IEEE802_15_4_WITHFCS.
765 Add DISPLAYPORT AUX link type
766 Remove the sunos4 kernel modules and all references to them.
767 Add more interface flags to pcap_findalldevs().
768 Summary for 1.9.0 libpcap release (to 2017-01-25 by guy@alum.mit.edu)
769 Man page improvements
770 Fix Linux cooked mode userspace filtering (GitHub pull request #429)
771 Fix compilation if IPv6 support not enabled
772 Fix some Linux memory-mapped capture buffer size issues
773 Don't fail if kernel filter can't be set on Linux (GitHub issue
775 Improve sorting of interfaces for pcap_findalldevs()
776 Don't list Linux usbmon devices if usbmon module isn't loaded
777 Report PCAP_ERROR_PERM_DENIED if no permission to open Linux usbmon
779 Fix DLT_ type for Solaris IPNET devices
780 Always return an error message for errors finding DAG or Myricom
782 If possible, don't require that a device be openable when
783 enumerating them for pcap_findalldevs()
784 Don't put incompletely-initialized addresses in the address list for
785 When finding Myricom devices, update description for regular
786 interfaces that are Myricom devices and handle SNF_FLAGS=0x2(port
788 Fix compilation error in DAG support
789 Fix issues with CMake configuration
790 Add support for stream buffers larger than 2GB on newer DAG cards
791 Remove support for building against DAG versions without STREAMS
792 support (before dag-3.0.0 2007)
794 Tuesday, Oct. 25, 2016 mcr@sandelman.ca
795 Summary for 1.8.1 libpcap release
796 Add a target in Makefile.in for Exuberant Ctags use: 'extags'.
797 Rename configure.in to configure.ac: autoconf 2.59
798 Clean up the name-to-DLT mapping table.
799 Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS
800 Clarify what the return values are for both success and failure.
801 Many changes to build on windows
802 Check for the "break the loop" condition in the inner loop for TPACKET_V3.
803 Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue #493.
804 Filter out duplicate looped back CAN frames.
805 Fix the handling of loopback filters for IPv6 packets.
806 Add a link-layer header type for RDS (IEC 62106) groups.
807 Use different intermediate folders for x86 and x64 builds on Windows.
808 On Linux, handle all CAN captures with pcap-linux.c, in cooked mode.
809 Removes the need for the "host-endian" link-layer header type.
810 Compile with '-Wused-but-marked-unused' in devel mode if supported
811 Have separate DLTs for big-endian and host-endian SocketCAN headers.
812 Reflect version.h being renamed to pcap_version.h.
813 Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)!
814 Properly check for sock_recv() errors.
815 Re-impose some of Winsock's limitations on sock_recv().
816 Replace sprintf() with pcap_snprintf().
817 Fix signature of pcap_stats_ex_remote().
818 Initial cmake support for remote packet capture.
819 Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag.
820 Clean up {DAG, Septel, Myricom SNF}-only builds.
821 Do UTF-16-to-ASCII conversion into the right place.
822 pcap_create_interface() needs the interface name on Linux.
823 Clean up hardware time stamp support: the "any" device does not support any time stamp types.
824 Add support for capturing on FreeBSD usbusN interfaces.
825 Add a LINKTYPE/DLT_ value for FreeBSD USB.
826 Go back to using PCAP_API on Windows.
828 Add TurboCap support from WinPcap.
829 Recognize 802.1ad nested VLAN tag in vlan filter.
831 Thursday Sep. 3, 2015 guy@alum.mit.edu
832 Summary for 1.7.5 libpcap release
834 Add some allocation failure checks.
835 Fix a number of Linux/ucLinux configure/build issues.
836 Fix some memory leaks.
837 Recognize 802.1ad nested VLAN tag in vlan filter.
838 Fix building Bluetooth Linux Monitor support with BlueZ 5.1+
840 Saturday Jun. 27, 2015 mcr@sandelman.ca
841 Summary for 1.7.4 libpcap release
842 Include fix for GitHub issue #424 -- out of tree builds.
844 Friday Apr. 10, 2015 guy@alum.mit.edu
845 Summary for 1.7.3 libpcap release
846 Work around a Linux bonding driver bug.
848 Thursday Feb. 12, 2015 guy@alum.mit.edu/mcr@sandelman.ca
849 Summary for 1.7.2 libpcap release
850 Support for filtering Geneve encapsulated packets.
851 Generalize encapsulation handling, fixing some bugs.
852 Don't add null addresses to address lists.
853 Add pcap_dump_open_append() to open for appending.
854 Fix the swapping of isochronous descriptors in Linux USB.
855 Attempt to handle TPACKET_V1 with 32-bit userland and 64-bit kernel.
857 Wednesday Nov. 12, 2014 guy@alum.mit.edu/mcr@sandelman.ca
858 Summary for 1.7.0 libpcap release
859 Fix handling of zones for BPF on Solaris
861 clarifications for read timeouts.
862 Use BPF extensions in compiled filters, fixing VLAN filters
863 some fixes to compilation without stdint.h
864 EBUSY can now be returned by SNFv3 code.
865 Fix the range checks in BPF loads
869 Monday Aug. 12, 2014 guy@alum.mit.edu
870 Summary for 1.6.2 libpcap release
871 Don't crash on filters testing a nonexistent link-layer type
873 Fix sending in non-blocking mode on Linux with memory-mapped
875 Fix timestamps when reading pcap-ng files on big-endian
878 Saturday Jul. 19, 2014 mcr@sandelman.ca
879 Summary for 1.6.1 libpcap release
880 some fixes for the any device
881 changes for how --enable-XXX (--enable-sniffing, --enable-can) works
883 Wednesday Jul. 2, 2014 mcr@sandelman.ca
884 Summary for 1.6.0 libpcap release
885 Don't support D-Bus sniffing on OS X
886 fixes for byte order issues with NFLOG captures
887 Handle using cooked mode for DLT_NETLINK in activate_new().
888 on platforms where you can not capture on down interfaces, do not list them
889 but: do list interfaces which are down, if you can capture on them!
891 Wednesday December 18, 2013 guy@alum.mit.edu
892 Summary for 1.5.3 libpcap release
893 Don't let packets that don't match the current filter get to the
894 application when TPACKET_V3 is used. (GitHub issue #331)
895 Fix handling of pcap_loop()/pcap_dispatch() with a packet count
896 of 0 on some platforms (including Linux with TPACKET_V3).
898 Work around TPACKET_V3 deficiency that causes packets to be lost
899 when a timeout of 0 is specified. (GitHub issue #335)
900 Man page formatting fixes.
902 Wednesday December 4, 2013 guy@alum.mit.edu
903 Summary for 1.5.2 libpcap release
904 Fix libpcap to work when compiled with TPACKET_V3 support and
905 running on a kernel without TPACKET_V3 support. (GitHub
908 Wednesday November 20, 2013 guy@alum.mit.edu
909 Summary for 1.5.1 libpcap release
910 Report an error, rather than crashing, if an IPv6 address is
911 used for link-layer filtering. (Wireshark bug 9376)
913 Wednesday October 30, 2013 guy@alum.mit.edu
914 Summary for 1.5.0 libpcap release
915 TPACKET_V3 support added for Linux
916 Point users to the the-tcpdump-group repository on GitHub rather
917 than the mcr repository
918 Checks added for malloc()/realloc()/etc. failures
919 Fixed build on Solaris 11
920 Support filtering E1 SS7 traffic on MTP2 layer Annex A
921 Use "ln -s" to link man pages by default
922 Add support for getting nanosecond-resolution time stamps when
923 capturing and reading capture files
924 Many changes to autoconf to deal better with non-GCC compilers
925 added many new DLT types
927 Saturday April 6, 2013 guy@alum.mit.edu
928 Summary for 1.4.0 libpcap release
929 Add netfilter/nfqueue interface.
930 If we don't have support for IPv6 address resolution, support,
931 in filter expressions, what IPv6 stuff we can.
932 Fix pcap-config to include -lpthread if canusb support is
934 Try to fix "pcap_parse not defined" problems when --without-flex
935 and --without-bison are used when you have Flex and Bison
936 Fix some issues with the pcap_loop man page.
937 Fix pcap_getnonblock() and pcap_setnonblock() to fill in the
938 supplied error message buffer
939 Fix typo that, it appeared, would cause pcap-libdlpi.c not to
940 compile (perhaps systems with libdlpi also have BPF and use
942 Catch attempts to call pcap_compile() on a non-activated pcap_t
943 Fix crash on Linux with CAN-USB support without usbfs
944 Fix addition of VLAN tags for Linux cooked captures
945 Check for both EOPNOTSUPP and EINVAL after SIOCETHTOOL ioctl, so
946 that the driver can report either one if it doesn't support
948 Add DLT_INFINIBAND and DLT_SCTP
949 Describe "proto XXX" and "protochain XXX" in the pcap-filter man
951 Handle either directories, or symlinks to directories, that
952 correspond to interfaces in /sys/class/net
953 Fix handling of VLAN tag insertion to check, on Linux 3.x
954 kernels, for VLAN tag valid flag
955 Clean up some man pages
956 Support libnl3 as well as libnl1 and libnl2 on Linux
957 Fix handling of Bluetooth devices on 3.x Linux kernels
959 Friday March 30, 2012. mcr@sandelman.ca
960 Summary for 1.3.0 libpcap release
961 Handle DLT_PFSYNC in {FreeBSD, other *BSD+Mac OS X, other}.
962 Linux: Don't fail if netfilter isn't enabled in the kernel.
963 Add new link-layer type for NFC Forum LLCP.
964 Put the CANUSB stuff into EXTRA_DIST, so it shows up in the release tarball.
965 Add LINKTYPE_NG40/DLT_NG40.
966 Add DLT_MPEG_2_TS/LINKTYPE_MPEG_2_TS for MPEG-2 transport streams.
967 [PATCH] Fix AIX-3.5 crash with read failure during stress
969 Introduce --disable-shared configure option.
970 Added initial support for canusb devices.
971 Include the pcap(3PCAP) additions as 1.2.1 changes.
972 many updates to documentation: pcap.3pcap.in
973 Improve 'inbound'/'outbound' capture filters under Linux.
974 Note the cleanup of handling of new DLT_/LINKTYPE_ values.
975 On Lion, don't build for PPC.
976 For mac80211 devices we need to clean up monitor mode on exit.
978 Friday December 9, 2011. guy@alum.mit.edu.
979 Summary for 1.2.1 libpcap release
981 Fix typos in README.linux file.
982 Clean up some compiler warnings.
983 Fix Linux compile problems and tests for ethtool.h.
984 Treat Debian/kFreeBSD and GNU/Hurd as systems with GNU
986 Support 802.1 QinQ as a form of VLAN in filters.
987 Treat "carp" as equivalent to "vrrp" in filters.
988 Fix code generated for "ip6 protochain".
989 Add some new link-layer header types.
990 Support capturing NetFilter log messages on Linux.
991 Clean up some error messages.
992 Turn off monitor mode on exit for mac80211 interfaces on Linux.
993 Fix problems turning monitor mode on for non-mac80211 interfaces
995 Properly fail if /sys/class/net or /proc/net/dev exist but can't
997 Fail if pcap_activate() is called on an already-activated
998 pcap_t, and add a test program for that.
999 Fix filtering in pcap-ng files.
1000 Don't build for PowerPC on Mac OS X Lion.
1001 Simplify handling of new DLT_/LINKTYPE_ values.
1002 Expand pcap(3PCAP) man page.
1004 Sunday July 24, 2011. mcr@sandelman.ca.
1005 Summary for 1.2 libpcap release
1006 All of the changes listed below for 1.1.1 and 1.1.2.
1007 Changes to error handling for pcap_findalldevs().
1008 Fix the calculation of the frame size in memory-mapped captures.
1009 Add a link-layer header type for STANAG 5066 D_PDUs.
1010 Add a link-layer type for a variant of 3GPP TS 27.010.
1011 Noted real nature of LINKTYPE_ARCNET.
1012 Add a link-layer type for DVB-CI.
1013 Fix configure-script discovery of VLAN acceleration support.
1014 see https://netoptimizer.blogspot.com/2010/09/tcpdump-vs-vlan-tags.html
1015 Linux, HP-UX, AIX, NetBSD and OpenBSD compilation/conflict fixes.
1016 Protect against including AIX 5.x's <net/bpf.h> having been included.
1017 Add DLT_DBUS, for raw D-Bus messages.
1018 Treat either EPERM or EACCES as "no soup for you".
1019 Changes to permissions on DLPI systems.
1020 Add DLT_IEEE802_15_4_NOFCS for 802.15.4 interfaces.
1022 Fri. August 6, 2010. guy@alum.mit.edu.
1023 Summary for 1.1.2 libpcap release
1024 Return DLT_ values, not raw LINKTYPE_ values from
1025 pcap_datalink() when reading pcap-ng files
1026 Add support for "wlan ra" and "wlan ta", to check the RA and TA
1027 of WLAN frames that have them
1028 Don't crash if "wlan addr{1,2,3,4}" are used without 802.11
1030 Do filtering on USB and Bluetooth capturing
1031 On FreeBSD/SPARC64, use -fPIC - it's apparently necessary
1032 Check for valid port numbers (fit in a 16-bit unsigned field) in
1034 Reject attempts to put savefiles into non-blocking mode
1035 Check for "no such device" for the "get the media types" ioctl
1037 Improve error messages from bpf_open(), and let it do the error
1039 Return more specific errors from pcap_can_set_rfmon(); fix
1041 Update description fetching code for FreeBSD, fix code for
1043 Ignore /sys/net/dev files if we get ENODEV for them, not just
1044 ENXIO; fixes handling of bonding devices on Linux
1045 Fix check for a constant 0 argument to BPF_DIV
1046 Use the right version of ar when cross-building
1047 Free any filter set on a savefile when the savefile is closed
1048 Include the CFLAGS setting when configure was run in the
1050 Add support for 802.15.4 interfaces on Linux
1052 Thu. April 1, 2010. guy@alum.mit.edu.
1053 Summary for 1.1.1 libpcap release
1054 Update CHANGES to reflect more of the changes in 1.1.0.
1056 Fix shared library build on AIX.
1058 Thu. March 11, 2010. ken@netfunctional.ca/guy@alum.mit.edu.
1059 Summary for 1.1.0 libpcap release
1060 Add SocketCAN capture support
1061 Add Myricom SNF API support
1062 Update Endace DAG and ERF support
1063 Add support for shared libraries on Solaris, HP-UX, and AIX
1064 Build, install, and un-install shared libraries by default;
1065 don't build/install shared libraries on platforms we don't support
1066 Fix building from a directory other than the source directory
1067 Fix compiler warnings and builds on some platforms
1068 Update config.guess and config.sub
1069 Support monitor mode on mac80211 devices on Linux
1070 Fix USB memory-mapped capturing on Linux; it requires a new DLT_
1072 On Linux, scan /sys/class/net for devices if we have it; scan
1073 it, or /proc/net/dev if we don't have /sys/class/net, even if
1074 we have getifaddrs(), as it'll find interfaces with no
1076 Add limited support for reading pcap-ng files
1077 Fix BPF driver-loading error handling on AIX
1078 Support getting the full-length interface description on FreeBSD
1079 In the lexical analyzer, free up any addrinfo structure we got back
1081 Add support for BPF and libdlpi in OpenSolaris (and SXCE)
1082 Hyphenate "link-layer" everywhere
1083 Add /sys/kernel/debug/usb/usbmon to the list of usbmon locations
1084 In pcap_read_linux_mmap(), if there are no frames available, call
1085 poll() even if we're in non-blocking mode, so we pick up
1086 errors, and check for the errors in question.
1087 Note that poll() works on BPF devices is Snow Leopard
1088 If an ENXIO or ENETDOWN is received, it may mean the device has
1089 gone away. Deal with it.
1090 For BPF, raise the default capture buffer size to from 32k to 512k
1091 Support ps_ifdrop on Linux
1092 Added a bunch of #ifdef directives to make wpcap.dll (WinPcap) compile
1094 Changes to Linux mmapped captures.
1095 Fix bug where create_ring would fail for particular snaplen and
1096 buffer size combinations
1097 Update pcap-config so that it handles libpcap requiring
1098 additional libraries
1099 Add workaround for threadsafeness on Windows
1100 Add missing mapping for DLT_ENC <-> LINKTYPE_ENC
1101 DLT: Add DLT_CAN_SOCKETCAN
1102 DLT: Add Solaris ipnet
1103 Don't check for DLT_IPNET if it's not defined
1104 Add link-layer types for Fibre Channel FC-2
1105 Add link-layer types for Wireless HART
1106 Add link-layer types for AOS
1107 Add link-layer types for DECT
1108 Autoconf fixes (AIX, HP-UX, OSF/1, Tru64 cleanups)
1109 Install headers unconditionally, and include vlan.h/bluetooth.h if
1111 Autoconf fixes+cleanup
1112 Support enabling/disabling bluetooth (--{en,dis}able-bluetooth)
1113 Support disabling SITA support (--without-sita)
1114 Return -1 on failure to create packet ring (if supported but
1116 Fix handling of 'any' device, so that it can be opened, and no longer
1117 attempt to open it in Monitor mode
1118 Add support for snapshot length for USB Memory-Mapped Interface
1119 Fix configure and build on recent Linux kernels
1120 Fix memory-mapped Linux capture to support pcap_next() and
1122 Fixes for Linux USB capture
1123 DLT: Add DLT_LINUX_EVDEV
1124 DLT: Add DLT_GSMTAP_UM
1125 DLT: Add DLT_GSMTAP_ABIS
1127 Mon. October 27, 2008. ken@netfunctional.ca. Summary for 1.0.0 libpcap release
1128 Compile with IPv6 support by default
1129 Compile with large file support on by default
1130 Add pcap-config script, which deals with -I/-L flags for compiling
1133 DLT: Add AX25 (AX.25 w/KISS header)
1136 Variable length 802.11 header support
1137 X2E data type support
1138 SITA ACN Interface support - see README.sita
1139 Support for memory-mapped capture on Linux
1140 Support for zerocopy BPF on platforms that support it
1141 Support for setting buffer size when opening devices
1142 Support for setting monitor mode when opening 802.11 devices
1143 Better support for dealing with VLAN tagging/stripping on Linux
1144 Fix dynamic library support on OSX
1145 Return PCAP_ERROR_IFACE_NOT_UP if the interface isn't 'UP', so applications
1146 can print better diagnostic information
1147 Return PCAP_ERROR_PERM_DENIED if we don't have permission to open a device, so
1148 applications can tell the user they need to go play with permissions
1149 On Linux, ignore ENETDOWN so we can continue to capture packets if the
1150 interface goes down and comes back up again.
1151 On Linux, support new tpacket frame headers (2.6.27+)
1152 On Mac OS X, add scripts for changing permissions on /dev/bpf* and launchd plist
1153 On Solaris, support 'passive mode' on systems that support it
1154 Fixes to autoconf and general build environment
1155 Man page reorganization + cleanup
1156 Autogenerate VERSION numbers better
1158 Mon. September 10, 2007. ken@xelerance.com. Summary for 0.9.8 libpcap release
1159 Change build process to put public libpcap headers into pcap subdir
1160 DLT: Add value for IPMI IPMB packets
1161 DLT: Add value for u10 Networks boards
1162 Require <net/pfvar.h> for pf definitions - allows reading of pflog formatted
1163 libpcap files on an OS other than where the file was generated
1165 Wed. April 25, 2007. ken@xelerance.com. Summary for 0.9.6 libpcap release
1167 Put the public libpcap headers into a pcap subdirectory in both the
1168 source directory and the target include directory, and have include
1169 files at the top-level directory to include those headers, for
1170 backwards compatibility.
1171 Add Bluetooth support
1172 Add USB capturing support on Linux
1173 Add support for the binary USB sniffing interface in Linux
1174 Add support for new FreeBSD BIOCSDIRECTION ioctl
1175 Add additional filter operations for 802.11 frame types
1176 Add support for filtering on MTP2 frame types
1177 Propagate some changes from the main branch, so the x.9 branch has
1178 all the DLT_ and LINKTYPE_ values that the main branch does
1179 Reserved a DLT_ and SAVEFILE_ value for PPI (Per Packet Info)
1180 encapsulated packets
1181 Add LINKTYPE_ for IEEE 802.15.4, with address fields padded as done
1183 Add LINKTYPE_ value corresponding to DLT_IEEE802_16_MAC_CPS.
1184 Add DLT for IEEE 802.16 (WiMAX) MAC Common Part Sublayer
1185 Add DLT for Bluetooth HCI UART transport layer
1186 When building a shared library, build with "-fPIC" on Linux to support x86_64
1187 Link with "$(CC) -shared" rather than "ld -shared" when building a
1188 ".so" shared library
1189 Add support for autoconf 2.60
1190 Fixes to discard unread packets when changing filters
1191 Changes to handle name changes in the DAG library resulting from
1192 switching to libtool.
1193 Add support for new DAG ERF types.
1194 Add an explicit "-ldag" when building the shared library, so the DAG
1195 library dependency is explicit.
1196 Mac OSX fixes for dealing with "wlt" devices
1197 Fixes in add_or_find_if() & pcap_findalldevs() to optimize generating
1199 Fixed a bug in pcap_open_live(). The return value of PacketSetHwFilter
1202 Tue. September 19, 2006. ken@xelerance.com. Summary for 0.9.5 libpcap release
1204 Support for LAPD frames with vISDN
1205 Support for ERF on channelized T1/E1 cards via DAG API
1206 Fix capitalization that caused issues crossc compiling on Linux
1207 Better failure detection on PacketGetAdapterNames()
1208 Fixes for MPLS packet generation (link layer)
1209 OP_PACKET now matches the beginning of the packet, instead of
1210 beginning+link-layer
1211 Add DLT/LINKTYPE for carrying FRF.16 Multi-link Frame Relay
1212 Fix allocation of buffer for list of link-layer types
1213 Added a new DLT and LINKTYPE value for ARINC 653 Interpartition Communication Messages
1214 Fixed a typo in a DLT value: it should start with DLT_ and not LINKTYPE_
1215 Redefined DLT_CAN20B and LINKTYPE_CAN20B as #190 (as this is the right value for CAN).
1216 Added definition for DLT_A429 and LINKTYPE_A429 as #184.
1217 Added a new DLT and LINKTYPE value for CAN v2.0B frames.
1218 Add support for DLT_JUNIPER_VP.
1219 Don't double-count received packets on Linux systems that
1220 support the PACKET_STATISTICS getsockopt() argument on
1222 Add support for DLT_IEEE802_11 and DLT_IEEE802_11_RADIO link
1224 Add support to build libpcap.lib and wpcap.dll under Cygnus and
1227 Mon. September 5, 2005. ken@xelerance.com. Summary for 0.9.4 libpcap release
1229 Support for radiotap on Linux (Mike Kershaw)
1231 Support for additional Juniper link-layer types
1232 Fixes for filters on MPLS-encapsulated packets
1234 "pppoed" and "pppoes" filters added; the latter modifies later
1235 parts of the filter expression to look at the PPP headers and
1236 headers in the PPP payload
1238 Tue. July 5, 2005. ken@xelerance.com. Summary for 0.9.3 libpcap release
1240 Fixes for compiling on nearly every platform,
1241 including improved 64bit support
1243 Add support for sending packets
1244 OpenBSD pf format support
1245 IrDA capture (Linux only)
1247 Tue. March 30, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.3 release
1249 Fixed minor problem in gencode.c that would appear on 64-bit
1251 Version number is now sane.
1253 Mon. March 29, 2004. mcr@sandelman.ottawa.on.ca. Summary for 3.8.2 release
1255 updates for autoconf 2.5
1256 fixes for ppp interfaces for freebsd 4.1
1257 pcap gencode can generate code for 802.11, IEEE1394, and pflog.
1259 Wed. November 12, 2003. mcr@sandelman.ottawa.on.ca. Summary for 0.8 release
1261 added pcap_findalldevs()
1262 Win32 patches from NetGroup, Politecnico di Torino (Italy)
1263 OpenBSD pf, DLT_PFLOG added
1264 Many changes to ATM support.
1265 lookup pcap_lookupnet()
1266 Added DLT_ARCNET_LINUX, DLT_ENC, DLT_IEEE802_11_RADIO, DLT_SUNATM,
1267 DLT_IP_OVER_FC, DLT_FRELAY, others.
1268 Sigh. More AIX wonderfulness.
1270 Changes to API: pcap_next_ex(), pcap_breakloop(), pcap_dump_flush(),
1271 pcap_list_datalinks(), pcap_set_datalink(),
1272 pcap_lib_version(), pcap_datalink_val_to_name(),
1273 pcap_datalink_name_to_val(), new error returns.
1275 Tuesday, February 25, 2003. fenner@research.att.com. 0.7.2 release
1277 Support link types that use 802.2 always, never, and sometimes.
1278 Don't decrease the size of the BPF buffer from the default.
1279 Support frame relay.
1280 Handle 32-bit timestamps in DLPI, and pass the right buffer size.
1281 Handle Linux systems with modern kernel but without
1282 SOL_PACKET in the userland headers.
1283 Linux support for ARPHRD_RAWHDLC.
1284 Handle 32-bit timestamps in snoop.
1285 Support eg (Octane/O2xxx/O3xxx Gigabit) devices.
1286 Add new reserved DLT types.
1288 Monday October 23, 2001. mcr@sandelman.ottawa.on.ca. Summary for 0.7 release
1290 Added pcap_findalldevs() call to get list of interfaces in a MI way.
1292 pcap_stats() has been documented as to what its counters mean on
1295 Tuesday January 9, 2001. guy@alum.mit.edu. Summary for 0.6 release
1297 New Linux libpcap implementation, which, in 2.2 and later
1298 kernels, uses PF_PACKET sockets and supports kernel packet
1299 filtering (if compiled into the kernel), and supports the "any"
1300 device for capturing on all interfaces. Cleans up promiscuous
1301 mode better on pre-2.2 kernels, and has various other fixes
1302 (handles 2.4 ARPHRD_IEEE802_TR, handles ISDN devices better,
1303 doesn't show duplicate packets on loopback interface, etc.).
1305 Fixed HP-UX libpcap implementation to correctly get the PPA for
1306 an interface, to allow interfaces to be opened by interface name.
1308 libpcap savefiles have system-independent link-layer type values
1309 in the header, rather than sometimes platform-dependent DLT_
1310 values, to make it easier to exchange capture files between
1313 Non-standard capture files produced by some Linux tcpdumps, e.g.
1314 the one from Red Hat Linux 6.2 and later, can now be read.
1316 Updated autoconf stock files.
1318 Filter expressions can filter on VLAN IDs and various OSI
1319 protocols, and work on Token Ring (with non-source-routed
1322 "pcap_open_dead()" added to allow compiling filter expressions
1323 to pcap code without opening a capture device or capture file.
1325 Header files fixed to allow use in C++ programs.
1327 Removed dependency on native headers for packet layout.
1328 Removed Linux specific headers that were shipped.
1330 Security fixes: Strcpy replaced with strlcpy, sprintf replaced
1333 Fixed bug that could cause subsequent "pcap_compile()"s to fail
1334 erroneously after one compile failed.
1336 Assorted other bug fixes.
1338 README.aix and README.linux files added to describe
1339 platform-specific issues.
1341 "getifaddrs()" rather than SIOCGIFCONF used, if available.
1343 v0.5 Sat Jun 10 11:09:15 PDT 2000
1346 - Brought in KAME IPv6/IPsec bpf compiler.
1348 - Support added for OpenBSD DLT_LOOP and BSD/OS DLT_C_HDLC (Cisco HDLC),
1349 and changes to work around different BSDs having different DLT_ types
1350 with the same numeric value.
1352 Assar Westerlund <assar@sics.se>
1353 - Building outside the source code tree fixed.
1354 - Changed to write out time stamps with 32-bit seconds and microseconds
1355 fields, regardless of whether those fields are 32 bits or 64 bits in
1356 the OS's native "struct timeval".
1357 - Changed "pcap_lookupdev()" to dynamically grow the buffer into which
1358 the list of interfaces is read as necessary in order to hold the
1361 Greg Troxel <gdt@ir.bbn.com>
1362 - Added a new "pcap_compile_nopcap()", which lets you compile a filter
1363 expression into a BPF program without having an open live capture or
1366 v0.4 Sat Jul 25 12:40:09 PDT 1998
1368 - Fix endian problem with DLT_NULL devices. From FreeBSD via Bill
1369 Fenner (fenner@parc.xerox.com)
1371 - Fix alignment problem with FDDI under DLPI. This was causing core
1372 dumps under Solaris.
1374 - Added configure options to disable flex and bison. Resulted from a
1375 bug report by barnett@grymoire.crd.ge.com (Bruce Barnett). Also added
1376 options to disable gcc and to force a particular packet capture type.
1378 - Added support for Fore ATM interfaces (qaa and fa) under IRIX. Thanks
1379 to John Hawkinson (jhawk@mit.edu)
1381 - Change Linux PPP and SLIP to use DLT_RAW since the kernel does not
1382 supply any "link layer" data.
1384 - Change Linux to use SIOCGIFHWADDR ioctl to determine link layer type.
1385 Thanks to Thomas Sailer (sailer@ife.ee.ethz.ch)
1387 - Change IRIX PPP to use DLT_RAW since the kernel does not supply any
1390 - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header
1393 - Added some new SGI snoop interface types. Thanks to Steve Alexander
1394 (sca@refugee.engr.sgi.com)
1396 - Fixes for HP-UX 10.20 (which is similar to HP-UX 9). Thanks to
1397 Richard Allen (ra@hp.is) and Steinar Haug (sthaug@nethelp.no)
1399 - Fddi supports broadcast as reported by Jeff Macdonald
1400 (jeff@iacnet.com). Also correct ieee802 and arcnet.
1402 - Determine Linux pcap buffer size at run time or else it might not be
1403 big enough for some interface types (e.g. FDDI). Thanks to Jes
1404 Sorensen (Jes.Sorensen@cern.ch)
1406 - Fix some linux alignment problems.
1408 - Document promisc argument to pcap_open_live(). Reported by Ian Marsh
1411 - Support Metricom radio packets under Linux. Thanks to Kevin Lai
1412 (laik@gunpowder.stanford.edu)
1414 - Bind to interface name under Linux to avoid packets from multiple
1415 interfaces on multi-homed hosts. Thanks to Kevin Lai
1416 (laik@gunpowder.stanford.edu)
1418 - Change L_SET to SEEK_SET for HP-UX. Thanks to Roland Roberts
1419 (rroberts@muller.com)
1421 - Fixed an uninitialized memory reference found by Kent Vander Velden
1422 (graphix@iastate.edu)
1424 - Fixed lex pattern for IDs to allow leading digits. As reported by
1425 Theo de Raadt (deraadt@cvs.openbsd.org)
1427 - Fixed Linux include file problems when using GNU libc.
1429 - Ifdef ARPHRD_FDDI since not all versions of the Linux kernel have it.
1430 Reported reported by Eric Jacksch (jacksch@tenebris.ca)
1432 - Fixed bug in pcap_dispatch() that kept it from returning on packet
1435 - Changed ISLOOPBACK() macro when IFF_LOOPBACK isn't available to check
1436 for "lo" followed by an eos or digit (newer versions of Linux
1437 apparently call the loopback "lo" instead of "lo0").
1439 - Fixed Linux networking include files to use ints instead of longs to
1440 avoid problems with 64 bit longs on the alpha. Thanks to Cristian
1441 Gafton (gafton@redhat.com)
1443 v0.3 Sat Nov 30 20:56:27 PST 1996
1445 - Added Linux support.
1447 - Fixed savefile bugs.
1449 - Solaris x86 fix from Tim Rylance (t.rylance@elsevier.nl)
1451 - Add support for bpf kernel port filters.
1453 - Remove duplicate atalk protocol table entry. Thanks to Christian
1454 Hopps (chopps@water.emich.edu)
1456 - Fixed pcap_lookupdev() to ignore nonexistent devices. This was
1457 reported to happen under BSD/OS by David Vincenzetti
1458 (vince@cryptonet.it)
1460 - Avoid solaris compiler warnings. Thanks to Bruce Barnett
1461 (barnett@grymoire.crd.ge.com)
1463 v0.2.1 Sun Jul 14 03:02:26 PDT 1996
1465 - Fixes for HP-UX 10. Thanks in part to Thomas Wolfram
1466 (wolf@prz.tu-berlin.de) and Rick Jones (raj@hpisrdq.cup.hp.com)
1468 - Added support for SINIX. Thanks to Andrej Borsenkow
1469 (borsenkow.msk@sni.de)
1471 - Fixes for AIX (although this system is not yet supported). Thanks to
1472 John Hawkinson (jhawk@mit.edu)
1474 - Use autoconf's idea of the top level directory in install targets.
1475 Thanks to John Hawkinson.
1477 - Add missing autoconf packet capture result message. Thanks to Bill
1478 Fenner (fenner@parc.xerox.com)
1480 - Fixed padding problems in the pf module.
1482 - Fixed some more alignment problems on the alpha.
1484 - Added explicit netmask support. Thanks to Steve Nuchia
1485 (steve@research.oknet.com)
1487 - Fixed to handle raw ip addresses such as 0.0.0.1 without "left
1490 - Add "sca" keyword (for DEC cluster services) as suggested by Terry
1491 Kennedy (terry@spcvxa.spc.edu)
1493 - Add "atalk" keyword as suggested by John Hawkinson.
1495 - Add "igrp" keyword.
1497 - Fixed HID definition in grammar.y to be a string, not a value.
1499 - Use $CC when checking gcc version. Thanks to Carl Lindberg
1500 (carl_lindberg@blacksmith.com)
1502 - Removed obsolete reference to pcap_immediate() from the man page.
1503 Michael Stolarchuk (mts@terminator.rs.itd.umich.edu)
1505 - DLT_NULL has a 4 byte family header. Thanks to Jeffrey Honig
1508 v0.2 Sun Jun 23 02:28:42 PDT 1996
1510 - Add support for HP-UX. Resulted from code contributed by Tom Murray
1511 (tmurray@hpindck.cup.hp.com) and Philippe-Andri Prindeville
1512 (philipp@res.enst.fr)
1514 - Update INSTALL with a reminder to install include files. Thanks to
1515 Mark Andrews (mandrews@aw.sgi.com)
1517 - Fix bpf compiler alignment bug on the alpha.
1519 - Use autoconf to detect architectures that can't handle misaligned
1522 - Added loopback support for snoop. Resulted from report Steve
1523 Alexander (sca@engr.sgi.com)
1525 v0.1 Fri Apr 28 18:11:03 PDT 1995
1527 - Fixed compiler and optimizer bugs. The BPF filter engine uses unsigned
1528 comparison operators, while the code generator and optimizer assumed
1529 signed semantics in several places. Thanks to Charlie Slater
1530 (cslater@imatek.com) for pointing this out.
1532 - Removed FDDI ifdef's, they aren't really needed. Resulted from report
1533 by Gary Veum (veum@boa.gsfc.nasa.gov).
1535 - Add pcap-null.c which allows offline use of libpcap on systems that
1536 don't support live package capture. This feature resulting from a
1537 request from Jan van Oorschot (j.p.m.voorschot@et.tudelft.nl).
1539 - Make bpf_compile() reentrant. Fix thanks to Pascal Hennequin
1540 (Pascal.Hennequin@hugo.int-evry.fr).
1542 - Port to GNU autoconf.
1544 - Fix pcap-dlpi.c to work with isdn. Resulted from report by Flemming
1545 Johansen (fsj@csd.cri.dk).
1547 - Handle multi-digit interface unit numbers (aka ppa's) under dlpi.
1548 Resulted from report by Daniel Ehrlich (ehrlich@cse.psu.edu).
1550 - Fix pcap-dlpi.c to work in non-promiscuous mode. Resulted from report
1551 by Jeff Murphy (jcmurphy@acsu.buffalo.edu).
1553 - Add support for "long jumps". Thanks to Jeffrey Mogul
1556 - Fix minor problems when compiling with BDEBUG as noticed by Scott
1557 Bertilson (scott@unet.umn.edu).
1559 - Declare sys_errlist "const char *const" to avoid problems under
1560 FreeBSD. Resulted from report by jher@eden.com.
1562 v0.0.6 Fri Apr 28 04:07:13 PDT 1995
1564 - Add missing variable declaration missing from 0.0.6
1566 v0.0.5 Fri Apr 28 00:22:21 PDT 1995
1568 - Workaround for problems when pcap_read() returns 0 due to the timeout
1571 v0.0.4 Thu Apr 20 20:41:48 PDT 1995
1573 - Change configuration to not use gcc v2 flags with gcc v1.
1575 - Fixed a bug in pcap_next(); if pcap_dispatch() returns 0, pcap_next()
1576 should also return 0. Thanks to Richard Stevens (rstevens@noao.edu).
1578 - Fixed configure to test for snoop before dlpi to avoid problems under
1579 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com).
1581 - Hack around deficiency in Ultrix's make.
1583 - Fix two bugs related to the Solaris pre-5.3.2 bufmod bug; handle
1584 savefiles that have more than snapshot bytes of data in them (so we
1585 can read old savefiles) and avoid writing such files.
1587 - Added checkioctl which is used with gcc to check that the
1588 "fixincludes" script has been run.
1590 v0.0.3 Tue Oct 18 18:13:46 PDT 1994
1592 - Fixed configure to test for snoop before dlpi to avoid problems under
1593 IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com).
1595 v0.0.2 Wed Oct 12 20:56:37 PDT 1994
1597 - Implement timeout in the dlpi pcap_open_live(). Thanks to Richard
1600 - Determine pcap link type from dlpi media type. Resulted from report
1601 by Mahesh Jethanandani (mahesh@npix.com).
1603 v0.0.1 Fri Jun 24 14:50:57 PDT 1994
1605 - Fixed bug in nit_setflags() in pcap-snit.c. The streams ioctl timeout
1606 wasn't being initialized sometimes resulting in an "NIOCSFLAGS:
1607 Invalid argument" error under OSF/1. Reported by Matt Day
1608 (mday@artisoft.com) and Danny Mitzel (dmitzel@whitney.hitc.com).
1610 - Turn on FDDI support by default.
1612 v0.0 Mon Jun 20 19:20:16 PDT 1994
1616 - Fixed bug with greater/less keywords, reported by Mark Andrews
1617 (mandrews@alias.com).
1619 - Fix bug where '|' was defined as BPF_AND instead of BPF_OR, reported
1620 by Elan Amir (elan@leeb.cs.berkeley.edu).
1622 - Machines with little-endian byte ordering are supported thanks to
1625 - Add hack for version 2.3 savefiles which don't have caplen and len
1626 swapped thanks to Vern Paxson.
1628 - Added "&&" and "||" aliases for "and" and "or" thanks to Vern Paxson.
1630 - Added length, inbound and outbound keywords.
projects / libpcap / blob