An exploit for a buffer overrun in the AFS dissector was recently
released on BugTraq. Ethereal 0.8.14 fixes this and other
possibly-exploitable overruns. Also new in 0.8.14 are dissectors
for WAP, SIP, AIM/OSCAR, 802.11, GIOP v1.2, and MGCP (plugin).
Other dissectors were updated as well. Be sure to upgrade to
0.8.14 as soon as possible
Changes:
New dissectors include H.261, TPKT, and IGRP, RTP and RTCP were
re-written, and many other dissectors were updated and improved. The
wiretap library enables Ethereal to read Nokia-firewall tcpdump files,
Shomiti Surveyor 3.x files, pppd log files (pppdump format), and
NetXRay ATM files.
This version understands our PPP protocol again (PPP over serial, i.e.).
Other changes:
Ethereal now understands Kerberos 5, rsh, and Zebra, and has the
initial work done for BXXP. Ethereal (via our wiretap library) can
now read Cisco Secure IDS iplog files. Ethereal's Help menu option
finally gives help. Many other updates and fixes were made in
version 0.8.12.
Overview of changes in Ethereal 0.8.11:
* Set locale in tethereal (Guy)
* Dialog box utility routines (Guy)
* Modal window fixes (Guy)
* GUI cleanups (Guy)
* Add support for preferences (Guy)
* IPv4 DiffServ is a preference (Guy)
* Add strcasecmp.c for those systems that need it, like SINIX-M (Uwe)
* BOOTP magic cookie fix, option-dissection fix (Guy)
* SNMPv3 fix for security model values 1 and 2 (Guy)
* Make AH payload dissection placement a preference (Gilbert)
* Timestamp display fix (Guy)
* CLNP TSAP fix (Guy)
* NFS filehandle dissection for ReliantUNIX and Linux nfsd/knfsd (Uwe)
* TCP summary info in protocol tree is an option (Gilbert)
* OSPF enhancements and fixes (Michael Rozhavsky)
* inet_aton()-related build fixes (Guy)
* UDP has heuristic dissector table, and uses it for RPC (Uwe)
* Dissection of RPCSEC_GSS credentials in ONC RPC (Dug Song)
* DNSSEC additions/name changes (Jakob Schlyter)
* Error message cleanups (Guy)
* DNS support for MS's WINS and WINS-R resource records (Guy)
* tvbuff-ication of H1 dissector, and response identifier display change
(Gerrit Gehnen)
* SCTP dissector (Michael.Tuexen@icn.siemens.de)
* Capture-window titlebar fix (Gilbert)
* Support for building SVR4 binary packages (Gerald)
* proto_tree/dfilter interaction change (Gilbert)
* Fix URL for libpcap (Guy)
* Improved autogen.sh script (Bruce Korb)
* Add "debian" target to Makefile (Olivier)
* Tethereal packet-count and new-line fix (Gilbert)
* SNMP "agent address" trap PDU display fix (Guy)
* Support for many more DHCP options (Jose Pedro Oliveira)
* Compiler-warning fixes in wiretap (Guy)
* Reset "visited" flag when rescanning a file (Gilbert)
* Add RPM and SRPM build targets (Gerald)
* Another shot at the undead libpcap monster fix (i.e., extra info
in headers for ss990915 libpcap) (Guy)
* Add aclocal-flags to fix build headaches (Guy)
* In proto_tree_add_item(), access tvbuff before adding anything to
proto_tree. (Gilbert)
* Add Quake 1 dissector (Uwe)
* GIOP dissector warns about unsupported GIOP versions (Gilbert)
* dfilter2pod build fix (Gilbert)
* Re-write of NCP dissector. Adds python to build. :) (Gilbert)
* Fix Edit->Filters...->Apply (Richard)
* Add DIAMETER dissector (David Frascone)
* Display TCP RST data as text, as per RFC 1122 (Guy, with tip o' hat
to Kevin Steves)
* Support for capturing from a pipe (FIFO or STDIN). (Olivier)
* Cross-platform build fixes (Guy)
* Fix directory-checking routines (Guy)
* Display filters now work on string types (Gilbert)
* Initial templates for decoding all 4 NLM protocol versions (Uwe)
which takes entries of the format <make-definition-name>=<pkgname>. This
has not been added to MAKEFLAGS because (a) premature optimisation is the
root of all evil, and (b) because the .for loop used to implement this
shows the wrong results when multiple prefices are evaluated.
Modify all the package Makefiles to use EVAL_PREFIX, thereby simplifying
them considerably.
ALso simplify the logic to calculate the prefix as well.
package's prefix would not work as part of the environment specification
via MAKE_ENV (as it would not be executed in the correct directory).
Fix this by invoking pkg_info(1) directly, not via an intermediate make(1)
step - this is not as clean, but more effective (i.e. it works).
a bit more user-friendly.
Introduce a show-{gtk+,imlib,kdebase,qt1,qt2,xpm}-prefix target in
bsd.pkg.mk, and use "${MAKE} show-*-prefix" in package Makefiles.
xpkgwedge once, before any other packages have been installed, and
never to delete it. This change finds the prefix of the installed
pre-req package using pkg_info(1), and allows packages to be found in
${X11BASE} and ${LOCALBASE}, not just ${X11PREFIX} - from mail from
Dave Sainty <dave@dtsp.co.nz>, munged slightly by myself.
in preference to X11BASE when trying to find the installed location of
X11 libraries, programs and headers (which will change if xpkgwedge is
installed).
[X11BASE reflects the location of the X11 libs, headers and programs.
X11PREFIX reflects the installed location of X11 packages.]
Overview of changes in Ethereal 0.8.9:
* Timestamps in RTP summary column (Jason Lango)
* Fix build warnings (Ron Flory)
* Make our GtkCList sortable (Graham Bloice)
* Use F<> instead of B<> for files in man pages (Guy)
* Fix a type IP packet counter (Gerald)
* Build fixes (Gilbert, Guy)
* Rename "private" to "dump", to avoid C++ reserved word (Guy)
* Add tvbuff class and exceptions module (Gilbert, Guy)
* Convert dissectors to use tvbuffs (Gilbert, Olivier, Guy)
* Support ISAKMP Configuration Method (Yaniv Kaul)
* Fix tethereal/wiretap error-reporting bug (Gilbert)
* Add sample Makefile for regression testing (Gilbert)
* Dissect substring filters in packet-ldap.c (Guy)
* Fix wtap.h typo (Alan Harrison)
* Change usage of 'fd' in file.c (Ben Fowler)
* Fix endian bug in ngsniffer.c (Guy)
* Fix smb-pipe NetServEnum (Guy)
* Fix VTP to correctly add ipv4 address to proto_tree (Guy)
* cf->current_frame fix for correctly displaying GtkCList (Guy)
* SMUX and SNMPv3 support (Jochen Friedrich)
* Fix snmp-less build (Guy)
* Show Ethernet trailer (Gilbert)
* Old-style fixes for bounds checking (Guy, Gilbert)
* Make proto_tree_is_visible false more of the time (Guy)
* Support for GRE over IPX (Paul Ionescu)
* Move psuedo_header out of frame_data structure to save memory. Required
changes in wiretap, too. (Guy)
* Doco fixes (Guy)
* Mark DCHP packets as DHCP, using bootp.dhcp flag. (Paul Ionescu)
* Fix randpkt.c for new wtap_dump() (Gilbert)
* Correctly handle 0-length FT_BYTES (Gilbert)
* Header file fixes (Guy, Gilbert)
* SMUX-related fix (Guy)
* More wiretap zlib fixes (Guy)
* Detect Cisco and Novell type IPX packets (Paul Ionescu)
* Close the capture file descriptor (Mark Burton, Guy)
* More ISAKMP additions (Yaniv Kaul, Guy)
* Support for EIGRP over Appletalk and IPX (Paul Ionescu)
* Fix display of IP fragment (Scott Howard)
* Fix for Linux ISDN ippp devices (Gilbert)
* Change handling of capture_ppp() (Gilbert)
* SMB fixes (Mark Burton)
* Support for reading compressed Sniffer fils (Tim Farley, Joerg, Guy)
* GTK dialogue fixes (Guy)
* Incorporate gtkclist.c from GTK+ 1.2.8 (Guy)
* Initial SCTP support (Michael Tuexen)
* Support for Mobile IP dissection (Stefan Raab, Gilbert, Guy)
* Fix for X.25 dbit (Gilbert)
* Enable more dissector handoff tables (Guy)
* Win32 build enhancements (Graham Bloice)
* X.25 LCN display fix (Olivier)
* C/C++ typedef fixes (Guy, Andreas Sikkema)
* Change proto_tree_add_*() calls to find more errors at compile time (Guy)
* Fix plugin function pointer table (Gilbert)
* Add "Enable name resolution" check box to File Open dialogue (Gilbert)
* Fix RSVP for Resv Tear Confirm message (Gilbert)
* Show ICMP sequence number as two bytes instead of integer of unknown-endiannes
s (Gilbert)
* Add gtk_set_locale() to main (Kaoru Kusunoki)
* Make dissect_ah() use dissector handoff tables (Gilbert)
* Fix L2TP dissector to call dissect_ppp() (Gilbert)
* Support for COPS (Heikki)
Various protocol dissectors were updated in Ethereal 0.8.8, including
DHIS/DDTP, OSI CLNP, CLTP, and ISIS, PPP, RTSP, IPv6, LPD, RTSP,
DNS, FTP, ISAKMP, and SINEC H1. Ethereal now has dissectors for
OSI ESIS, RTCP, RTP, and the MS Proxy Protocol. The GUI behavior
has been tweaked, the Win32 version now has a program icon, and
some internals (for those of you who are interested in hacking on
Ethereal) have changed.
Overview of changes in Ethereal 0.8.7:
* Small memleak in "Find Frame" plugged (Guy)
* Correct behavior for stopping frame search (Guy)
* RPM spec file fix (Patrick Higgins <phiggins@transzap.com>)
* Disable "Update list of packets in real time" and
"Automatic scrolling in live capture" for Win32 (Gilbert)
* Avoid using zero-length arrays in packet-rsvp.c (Guy)
* Add wtap_read() func to wtap.c (Richard, Guy)
* Update to SMB Browse (Richard)
* Rlogin dissector (Jeff Foster)
* Re-arrange dissector_add() calls and make some dissectors static
for dissectors under TCP and UDP (Guy)
* Remove unused value_string in packet-llc.c (Guy)
* Add DOCSIS BPDU (Johannes Hennecke <Johannes.Hennecke@elsa.de>)
* Separate variables for "File|Open" and "File|Save [As]" (Guy)
* BGP confederations support (Greg Hankins)
* Correct display of FT_BOOLEANs inside bitfields (Gilbert)
* Catch loops in DNS names. Avoids zlip DNS DoS exploit (Guy)
* Compile tethereal and editcap for Win32 (Gilbert)
* Support CIFS-over-TCP w/o NBSS (Mark Muhlestein)
* .cvsignore updates (Ben Fowler)
* Add SOCKS[45] dissector, plus changes to conversation.c (Jeff Foster)
* Fix int size for I and S LLC frames. (Guy)
* Update packet-osi.c [CLNP] (Guy)
* Update packet-isis.c (Guy)
* Fix typo in packet-h1.c (Guy)
* Update Win32 doco (Guy)
* Fix null filter string display in summary dialogue (Guy)
Overview of changes in Ethereal 0.8.4:
* Listen for exception on GDK_INPUT_EXCEPTION on sync pipe (Gilbert)
* Correct timestamp bug in dissect_ipopt_timestamp() (Paul Ionescu, Olivier)
* Win32 fixes (Ed Meaney)
* Fix PLUGIN_DIR scanning (Olivier)
* Support for Cisco Group Management Protocol (Guy)
* Allow filtering on 24-bit integral fields (Guy)
* Support for Cisco's Virtual Trunking Protocol (guy)
* Enable plugins on Win32 (Gilbert)
* Debian packaging changes (Olivier)
* Win32 build fix (Gilbert)
* Fix bug in tftp (Dietmar Petras)
* Support for Time Protocol (Dietmar)
* Support for win32 libpcap (Ed Meaney)
* Typo in Makefile.am (Sean Walmsley <sean.p.walmsley@Hydro.ON.CA>)
* Build fix, plus suport for setuid ethereal [DANGEROUS!]
(Peter Kjellerstedt <peter.kjellerstedt@axis.com>)
* Typo fix in OSPF (Nick Amato)
* Code movement (Guy)
* NetBSD zlib build fix (Itojun, Guy)
* Misc. code fixes (Guy)
* Win32 fixes (Guy)
* Support for SMB Mailslot and Netlogin (Jeff Foster)
* BOOTP fix (Dietmar Petras)
* "A header file for every dissector" (Gilbert)
* Fix NetBIOS name types (Richard)
* Allow for non-"struct timeval" in tethereal (Gilbert)
* Upgrade gtkclist.c to GTK+-1.2.7 (Gilbert)
* Support raw IP nettl captures (Olivier)
* Fix X.25 data structure initialization (Olivier, Guy)
* New WTAP error code: WTAP_ERR_UNSUPPORTED_ENCAP (Guy)
* LanMan fix (Richard)
* Doco updates (Guy)
* Fix for UCD SNMP 4.1.x
* "Resolve Name" item in proto tree popup (Laurent)
* Buffer fix (Guy)
* SMB Logon fix (Richard, Jeff Foster)
* Tethereal fix for multi-arg filters on command line (Guy)
* Fix HTTP request and response (Laurent)
* Support for Dynamic Host Information Services (Olivier)
* Add TCP segment length to TCP packet summary (Fred Reimer)
* Pop up single packet's proto tree in new window (Jeff Foster, Guy)
* Developer's README, finally! (James Coe, Guy, Jeff Foster, Gilbert)
* Support for HP-UX 11 nettl files (Olivier)
* Make scrollbar placement option ubiquitous (Guy)
* Support for Sinec H1 protocol (Gerrit Gehnen)
* Show version number resource in COTP (Gerrit Gehnen)
Overview of changes in Ethereal 0.8.1:
* Fix mulitiple-selection bug in packet list (Gilbert)
* Check for libtool and libtool version (Guy)
* Toshiba file reader handles relative dates (Gilbert)
* File|Open dialogue box directory hack (Gilbert)
* Modify appearance of lines and expanders in GUI proto tree (Gilbert)
* Make code ANSI-C compliant and other build fixes (Guy)
* Fix side effects of using GtkCTree and GTK_SELECTION_BROWSE (Guy)
* Abstract out some of the menu code from the GUI routines (Guy)
* Re-arrange some GUI code (Guy)
* "Default" button for resetting plugin filter string (Olivier)
* Plugin status save/restore (Olivier)
* Add notes about sniffing VMware connections (Gilbert)
* Add focus for "Find Frame" and "Go to Frame" (Guy)
* Reconcile differences in integer size used for ports
in conversation code and packet_info code (Gilbert)
* Empty string capture filters for libpcap craziness (Gerald, Guy)
* Manpage updates (Guy)
* Print packets as multiple pages of PostScript (Guy)
* Fix "Follow TCP Stream" print function (Guy)
* Avoid segfault in SMB reported by
Aaron Bush <abush@microcenter.com> (Gilbert)
* L2TP support (John Thomes)
* Allow printing during capturing
Overview of changes in Ethereal 0.8.0:
* RPC and NFS updates, complete NFSv2 support (Uwe, Gilbert)
* Initial TNS support (Nathan)
* Documenatation and distribution updates (Gilbert, Guy, Itojun, Gerald)
* SMB fixes (Gilbert, Richard, Olivier, Greg Kilfoyle)
* Color preference fixes and updates (Guy)
* NetBIOS fixes (Guy)
* IPX fixes and updates (Guy, Nathan)
* Capture/file save facility updates (Guy)
* Add IPX stats to capture window (Gilbert)
* Appropriately enable/disable the "follow" menu item (Florian)
* ICQ fixes from Guy and Kojak (Guy)
* Add Christopher McAvaney's format_text() fix (Guy)
* Stream window color prefs (Gerald)
* Myriad GUI fixes and enhancements (Gilbert, Guy)
* RADIUS fixes thanks to Arni Raghu <arni@caip.rutgers.edu> (Gilbert)
* VLAN updates (Nathan)
* Byte view fixes (Nathan)
* Initial TACACS+/XTACACS support (Nathan)
* Multiple file format capability in wiretap and Ethereal (including Snoop,
Netmon 1.x, Sniffer, Netxray, and various flavors of libpcap)
(Guy, Olivier, Nathan)
* Added editcap to the distribution (Richard)
* Enhancements to wiretap's file output capabilities (Guy)
* Add our own SNMP PDU dissector; other SNMP fixes and updates (Guy)
* ASN.1 code added; used by SNMP dissector, and available for other use
by other dissectors (Guy)
* LLC/SNAP fixes and updates (Guy, Nathan)
* NTP fixes (Guy, Gerald)
* ISAKMP updates from Dave Chapeskie (Guy)
* Reduced dependency on "global.h" (Gilbert, Guy)
* HTTP updates from Jerry Talkington (Guy)
* Added IRC dissector (Nathan)
* DNS updates (Nathan)
* Added James Coe's patch(es) to add SRVLOC and NCP-over-IP support (Guy)
* CLI fixes and enhancements (Guy)
* ARP improvements (Nathan)
* Capture length fixes for IRIX (Guy)
* BGP updates from Greg Hankins, and other BGP fixes (Itojun)
* Added Philip Gladstone <philip@raptor.com>'s patch to check IP header
checksum (Gilbert)
* GRE updates, merged code from Jerry Talkington (Guy)
* AppleTalk updates, including NBP and RTMP dissectors (Nathan, Guy)
* Initial LDAP support (Nathan)
* X.25 updates (Olivier)
* Plugin support (Olivier)
* Fixes for packet-ip.c (Guy, Gilbert)
* Jerry Talkington's patch to move filter prefs to their own dialog (Guy)
* Fixes for RedHat's modified version of libpcap (Guy)
* WCCP dissector from Jerry Talkington (Guy)
* rwho/rwhod/ruptime support added (Gilbert)
* Added Bert Driehuis <driehuis@playbeing.org>'s I4B wiretap module
and V.120 decoder (Gilbert, Guy)
* RSVP fixes (Gilbert)
* NCP fixes and updates, other fixes from James Coe (Nathan, Guy)
* Q.931 updates from Bert Driehuis (Guy)
* ISDN4BSD updates (Guy)
* Support for ISIS thanks to Stuart Stanley (Guy)
* Support for Dearborn Group Technology's Gryphon as a plugin (Gilbert)
* Win32 port updates (Guy)
* LPD segfault fixes reported by Gregor Glomm (Gilbert)
* GUI page added to preferences (Gilbert)
* Libtool integrated with the distribution (Gerald, Guy, Itojun)
* OUI updates (Guy)
* Summary-dialog-on-empty-capture segfault bug squished (Guy)
Overview of changes in Ethereal 0.7.9:
* Compilation warning fix (Guy)
* Updates to Q.931 (Guy)
* Updates to Q.2931 (Guy)
* Display filter widget uses GtkCombo (Gerald)
* Added SNMP over Ethernet (Gilbert)
* Small changes to display filters from tcp follow and match selected (Gilbert)
* Fix problem and update SMB (Richard)
* Update portmap (Uwe)
* Update NFS (Uwe)
* Support for iptrace 1.0 files (Gilbert; thanks to
Florian Lohoff <flo@rfc822.org> for sample trace files)
* Update support for netmon 2.0 files (Guy)
* Updates to ATM (Guy)
* Updates to ARP (Guy)
* Updates to DNS (Guy)
* Support for both PPP and LAPB as WAN links in NG Sniffer files (Guy)
* Colorize TCP streams (Gerald)
* Make autoconf check for correct contents of libz library (Guy)
* Updates to About box (Guy, Gilbert)
Version 0.7.2 fixes another memory leak, and gets rid of a bottleneck
in file loading. Loading files, especially large files, is much much
faster now. NetBEUI decode support was added. Timeout handling with
the -S option was fixed, as was a bug in the token-ring decoder. A new
-R option was added to give Ethereal a load-time filter capability (as
opposed to capture or display filters).
