summaryrefslogtreecommitdiffstats
path: root/usr.sbin/tcpdump (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix whitespace.jsing2011-09-181-11/+11
|
* Avoid potential 64-bit unaligned access on strict alignment architectures.jsing2011-09-181-2/+4
| | | | Spotted by and ok naddy@
* Make tcpdump -v print the id and seq of icmp6 echo packets.bluhm2011-09-171-4/+8
| | | | ok claudio naddy
* update pointer variable after copying misaligned packet; ok claudio@naddy2011-09-171-2/+2
|
* access a 32-bit field as u_int32_t, not as u_long; ok bluhm@naddy2011-09-171-5/+5
|
* Be more careful when looking at l2tp traffic. Do more length checks andclaudio2011-07-251-25/+51
| | | | | make sure that no unaligned access to uint16_t values happen. Tested and feedback by yasuoka@
* fix an off by one which resulted in 'no next header' packets not beingdhill2011-06-271-3/+3
| | | | | | | displayed. help from bluhm@ OK claudio@
* Call setlocale() to avoid display glitches in UTF-8 locales.stsp2011-04-031-1/+5
| | | | ok phessler nicm mikeb
* tweak previous;jmc2011-03-281-2/+2
|
* Add a couple of examples on tcpflags and icmptype filtersgiovanni2011-03-281-2/+10
| | | | ok claudio@
* Don't be to strict when checking the length of an ospf packet.claudio2011-03-221-4/+8
| | | | | | Allow for padding bytes in the IP packet (length > ntohs(op->ospf_len)) but report both length in that case. OK sthen@, deraadt@
* Between groff-1.15 and groff-1.20.1, the .Ns macro was changed to noschwarze2011-02-071-11/+9
| | | | | | | longer suppress spacing when used at the beginning of an input line, and mandoc now follows the same behaviour as new groff. Thus, sweep the tree and remove useless .Ns. Most places found by jmc@; ok jmc@ kristaps@.
* The ioctl to show states returns a pfsync_state which is in network byteclaudio2010-11-121-3/+3
| | | | | order and therefore a ntohs is needed to show the rdomain correctly. OK henning@ dlg@
* Sync with tcpdump.org to fix multicast DNS support, and get somecanacar2010-11-042-38/+73
| | | | | other updates in the process. Initial report/patch from Christiano F. Haesbaert. Ok matthew@
* Revert non-compatible and undocumented bullshit commited by 3 developersderaadt2010-10-181-82/+9
| | | | | | | | who decided to just do it on their own. henning, mcbride, jsing -- shame on you -- if you had shown this diff to just 1 other network developer, the astounding mistake in it would have been noticed. Start practicing inclusionary development instead of going alone. ok claudio
* Add quirks support to operating system fingerprinting. tcpdump partjsing2010-10-171-9/+82
| | | | | | by mcbride@. ok mcbride@ henning@
* Do not use BPF_WORDALIGN when computing pflog header length as it alignscanacar2010-10-091-2/+2
| | | | | to 8-byte boundary on 64-bit architectures. Instead explicitly round up to a 4-byte boundary. Reported and tested by sthen@
* when a packet has had addresses and/or ports rewritten, show the originalhenning2010-09-211-1/+20
| | | | addresses/ports too. ok ryan dlg
* temporary hack to raise snaplen for pflog so that pflog header, ip headerhenning2010-09-211-1/+5
| | | | | | and protocol header actually fit in the common cases. stays until canacar tells us how to do it right ;) ok dlg ryan
* fix a formatting issue for -E;jmc2010-09-071-3/+7
|
* Correctly decode and print access point names.jsing2010-08-191-21/+41
|
* Print the MTU in OSPF dd packets. Borrowed from the ospf6 printer.sthen2010-08-042-4/+5
| | | | ok claudio@ deraadt@
* Fix a usage of logical and where binary and was intended.jsg2010-08-031-2/+2
| | | | Spotted by Mike Belopuhov. ok jsing@ deraadt@
* Print MPLS label as decimal and not hex. All other places we print MPLSclaudio2010-06-301-2/+2
| | | | | labels we use decimal. OK jsg@ deraadt@
* remove support for the old pflog format, replaced in 2003henning2010-06-262-95/+2
| | | | ok ryan theo & herr reyksminister
* minimal decode support for IKEv2 exchange types and payloads.jsg2010-06-072-13/+70
| | | | ok deraadt@ sthen@
* Add support for decoding MLDv2 initially from tcpdump.org via FreeBSD,jsg2010-04-064-11/+203
| | | | | | cleaned up to be less gross after some suggestions from stsp. ok stsp@
* Print RFC3947 NAT Original Address (NAT-OA) payloads, they're a subsetsthen2010-01-201-1/+10
| | | | of the id payload, so using the existing id printer. ok dlg@
* add a printer for IPV6CP (IPv6 Control Protocol); ok sthen@naddy2010-01-171-1/+67
|
* * remove a nonsensical print statement left over since antiquitynaddy2010-01-171-15/+62
| | | | | | | | ok yasuoka@ * add many missing truncation checks and don't output control characters to the terminal ok sthen@
* Include the link-level header in the hex output if both the -x and -ejsing2010-01-142-14/+29
| | | | | | options are specified. ok claudio@ sthen@ deraadt@ jmc@
* revert previous and allow reading the last element of the array; ok deraadt@naddy2010-01-131-2/+2
|
* Add TCP/UDP checksum display for v6 and clean up the checksumnaddy2010-01-124-44/+97
| | | | calculation. Mostly from tcpdump.org; ok jsing@
* blank lines not allowed outside literal context;schwarze2010-01-031-5/+5
| | | | | syntax errors found by mandoc(1), also required to fix the mandoc build; ok jmc@
* Adjust pflog BPF descriptions, problem pointed out by jmc@sthen2009-12-031-8/+13
| | | | | | | | | - sync actions with PF changes (pass/block/match not just pass/block, and remove some binat/nat/rdr entries) - list all reason codes in tcpdump(8) ok henning jmc
* Print outer ipv6 addresses for encapsulated packets only if tcpdumpbluhm2009-11-271-5/+10
| | | | | is run with -v. This behavior is analog to ipv4. ok mpf@ todd@
* for packets with unknown payloads (outside the range of our knowledge) simplyderaadt2009-11-121-2/+4
| | | | | treat them the same as truncated packets ok sthen
* fix read-one-beyond-of-array errors; ok sthen jsgderaadt2009-11-123-6/+6
|
* Don't leak memory in error case.jsg2009-11-111-2/+4
| | | | Found by parfait.
* the new protocol moved insert and update.dlg2009-11-091-4/+6
|
* Add support to tcpdump for decoding the GPRS Tunnelling Protocol (GTP),jsing2009-11-045-5/+2250
| | | | | | | | | | used to carry GPRS data over IP for GSM and UMTS networks. The decoder understands GTPv0, GTPv0', GTPv1-C, GTPv1-U and GTPv1' traffic, however at this stage not all TLV fields are fully decoded. This work has been kindly sponsored by SystemNet AS (www.systemnet.no). "commit" deraadt@
* Sort port numbers and fix indentation.jsing2009-11-041-26/+26
|
* rtables are stacked on rdomains (it is possible to have multiple routingclaudio2009-11-031-6/+10
| | | | | | | | | | | | | | tables on top of a rdomain) but until now our code was a crazy mix so that it was impossible to correctly use rtables in that case. Additionally pf(4) only knows about rtables and not about rdomains. This is especially bad when tracking (possibly conflicting) states in various domains. This diff fixes all or most of these issues. It adds a lookup function to get the rdomain id based on a rtable id. Makes pf understand rdomains and allows pf to move packets between rdomains (it is similar to NAT). Because pf states now track the rdomain id as well it is necessary to modify the pfsync wire format. So old and new systems will not sync up. A lot of help by dlg@, tested by sthen@, jsg@ and probably more OK dlg@, mpf@, deraadt@
* a few leftovers from yesterday's SCCS/RCS-ID removal;schwarze2009-10-281-8/+1
| | | | | survived a full make build on i386; "sure" deraadt@
* rcsid[] and sccsid[] and copyright[] are essentially unmaintained (andderaadt2009-10-2765-388/+64
| | | | | | | unmaintainable). these days, people use source. these id's do not provide any benefit, and do hurt the small install media (the 33,000 line diff is essentially mechanical) ok with the idea millert, ok dms
* Make the BGP OPEN capability parser RFC 5492 compliant. While there addclaudio2009-09-081-49/+87
| | | | | additional checks to make sure the known capabilities are correctly encoded and not truncated. Help and OK sthen@
* Teach the printer about capabilities, new cease codes, end-of-rib marker,sthen2009-09-071-54/+324
| | | | and handle 32-bit ASN. ok claudio@
* djm accidentally changed the type of dirfilt in the prototypesjsg2009-08-251-2/+2
| | | | | | | of pcap_live and priv_pcap_live in rev 1.6 to differ from the implementations, change the type back to what it was. ok djm@
* add missing " when printing an error string. ok henning@sthen2009-07-301-2/+3
|
* don't cast lvalue, no binary change.jsg2009-07-121-3/+3
|