$Id: ChangeLog 18259 2011-07-04 19:53:43Z rsh $

2011-07-04 Roy Hills <Roy.Hills@nta-monitor.com>

	* Makefile.am: Added pkt-custom-request-vlan-llc.dat to EXTRA_DIST.

2011-03-07 Roy Hills <Roy.Hills@nta-monitor.com>

	* configure.ac: Incremented version to 1.8.1.

2011-03-01 Roy Hills <Roy.Hills@nta-monitor.com>

	* Released arp-scan version 1.8.
	  tarball arp-scan-1.8.tar.gz, size 430221 bytes
	  md5sum be8826574ec566217eb7ca040fe472f9

	* configure.ac: Remove version number from AM_INIT_AUTOMAKE macro,
	  as this usage is obsolete now. Incremented version to 1.8.

	* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
	  IEEE website using get-oui and get-iab Perl scripts.

2011-02-26 Roy Hills <Roy.Hills@nta-monitor.com>

	* pkt-custom-request-vlan-llc.dat: New data file for check-packet
	  script containing custom ARP request with 802.1Q VLAN tag and
	  LLC/SNAP framing.

	* check-packet: Added check for custom ARP request with 802.1Q VLAN
	  tag and LLC/SNAP framing.

2011-02-25 Roy Hills <Roy.Hills@nta-monitor.com>

	* pkt-vlan-llc-response.pcap: New file containing an example of
	  an ARP reply with 802.1Q tag and LLC/SNAP framing. From a Cisco
	  2621 router.

	* pkt-trailer-response.pcap: Renamed from pkt-trailer-reply.pcap.

	* check-decode: New checks for trailer response and 802.1Q/LLC
	  responses.

	* arp-scan.c: Modified pcap filter string to capture ARP responses
	  with both 802.1Q tag and LLC/SNAP framing.

	* Makefile.am: Include pkt-trailer-response.pcap and
	  pkt-vlan-llc-response.pcap.

2011-02-21 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Modified usage() so that it can output either brief or
          detailed help output depending on a new "detailed" argument.  Now,
          detailed output, including information on the available options, is
          only displayed when arp-scan is run with the --help option.  For
          error conditions such as incorrect options, it only produces brief
          output.

	* arp-scan.c: Modify display_packet() to report responses where the
	  ARP protocol type (ar$pro) is not IP (0x0800). This allows trailer
	  negotiation responses to be distinguished from regular ARP replies.

	* pkt-trailer-reply.pcap: New file containing an example of a trailer
	  negotiation ARP response from a Quasijarus 4.3BSD system on SIMH VAX.

	* arp-fingerprint: Added fingerprint for Blackberry OS.

2011-02-19 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.h: On Apple Mac OS X systems with Xcode 2.5 and later,
	  include <net/bpf.h> before <pcap.h>.

	* configure.ac: Increment version number to 1.7.6.

2011-02-06 Roy Hills <Roy.Hills@nta-monitor.com>

	* acinclude.m4: Changed GCC_FORTIFY_SOURCE macro so the test program
	  doesn't include <features.h>, because that header file is not
	  present on all the operating systems that we support, e.g. OpenBSD.

2011-02-04 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Use pcap_get_selectable_fd() rather than pcap_fileno()
	  to get the pcap file descriptor.

	* check-host-list: Added new test to check the creation of the host
	  list.

2011-02-03 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: When using --writepkttofile we no longer open a link
	  layer socket or a pcap handle, so we don't need root privileges.

	* check-packet: Remove check for root privileges as this is no longer
	  needed.

	* check-decode: Added two new tests to improve code coverage.

	* arp-scan.c, arp-scan.h: Modify add_host_pattern() and add_host() so
	  we always use the more efficient inet_pton() rather than
	  get_host_address() for IPnet/bits, IPnet:mask and IPstart-IPend
	  patterns.

2011-02-02 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Change operation of --readpktfromfile so it reads from
	  a pcap savefile rather than from a raw file.

	* pkt-simple-response.pcap, pkt-padding-response.pcap,
	  pkt-vlan-response.pcap, pkt-llc-response.pcap: New pcap format
	  files for check-decode.

	* check-decode: Modified to use new pcap format savefiles, and remove
	  check for root privileges as this is no longer needed.

2011-01-31 Roy Hills <Roy.Hills@nta-monitor.com>

	* link-dlpi.c: Fix "comparison between signed and unsigned" warning in
	  function dlpi_msg.

	* arp-fingerprint: Added fingerprint for Windows 7.

	* arp-scan.c: Changed what gets displayed for the different verbose
	  levels, and updated the --help output to reflect the new behaviour.

2011-01-30 Roy Hills <Roy.Hills@nta-monitor.com>

	* check-packet, check-decode: New checks to check packet creation and
	  packet decoding.

	* pkt-custom-request.dat, pkt-custom-request-llc.dat,
	  pkt-custom-request-padding.dat, pkt-custom-request-vlan.dat,
	  pkt-padding-response.dat, pkt-simple-request.dat,
	  pkt-simple-response.dat: Data files for check-packet and check-decode
	  scripts.

	* Makefile.am: Add new check scripts and data files.

	* arp-scan.c, arp-scan.h: Added undocumented options --writepkttofile
	  and --readpktfromfile to allow data to be written to or read from a
	  file instead of the network for testing.

	* arp-scan.c: Use "stdin" instead of fdopen(0,"r") when using
	  --filename=-, fixing a bug which was causing fd 0 to be closed.
	  Set the frame type correctly for LLC/SNAP format frames: before
	  it was always set to 0x0806.

	* configure.ac: Add headers required for --writepkttofile and
	  --readpktfromfile.  Increment version number to 1.7.5.

2011-01-09 Roy Hills <Roy.Hills@nta-monitor.com>

	* COPYING: Changed license from GPLv2 to GPLv3.

	* Modified licence statement in source files to specify GPLv3

	* Modified copyright statement in files to include up to 2011.

2010-12-22 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Change req_interval back from unsigned to int. This
	  addresses a bug in the timing code that was introduced in svn
	  r18043, which caused the packet rate to be very high irrespective
	  of the specified interval.

	* configure.ac: Enable -Wextra warnings for gcc. Increment version
	  number to 1.7.4.

2010-12-22 Roy Hills <Roy.Hills@nta-monitor.com>

	* hash.c, hash.h, obstack.c, obstack.h: Updated version of GAS hash
	  table code to the latest version from GNU binutils 2.21.  This new
	  version addresses the shadowed variable warnings that the old version
	  used to produce when compiled with -Wshadow.

	* configure.ac: define ATTRIBUTE_UNUSED macro to enable portable use
	  of attribute unused to mark possibly unused function arguments.

	* arp-scan.c: Minor changes to remove a couple of shadowed variable
	  warnings.

2010-12-07 Roy Hills <Roy.Hills@nta-monitor.com>

	* acinclude.m4: Added GCC_WEXTRA macro to determine if the C compiler
	  supports the -Wextra switch to enable extra warnings.

	* arp-scan.c, arp-scan.h, utils.c: Remove unused function parameters
	  and address signed/unsigned comparisons highlighted by -Wextra.

2010-12-03 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.1: Added warning about setting ar$spa to the destination
	  IP address. Suggested by Ed Schaller.

2010-04-25 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-fingerprint: Added 2.11BSD

2009-08-15 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c, utils.c: Improve handling of --bandwidth and
	  --interval options: Allow either upper or lowercase
	  multiplier letters and give an error if an unknown multiplier
	  character is used.  Previously an unknown multiplier character
	  or one with the wrong case was silently ignored and treated as
	  no multiplier at all.

	* wrappers.c: Change Strtoul and Strtol so they give an error
	  if the underlying function finishes at an unconvertible
	  character other than NULL or whitespace.

	* configure.ac: Added extra warning "-Wwrite-strings" for gcc.

2009-08-14 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c, arp-scan.h, configure.ac, error.c: Removed syslog
	  functionality as this is not used and has been #ifdef'ed out
	  for some time.

2009-05-06 Roy Hills <Roy.Hills@nta-monitor.com>

	* autoconf.ac: Updated to autoconf 2.61

2009-03-06 Roy Hills <Roy.Hills@nta-monitor.com>

	* acinclude.m4: Added macros to detect compiler support for
	  -fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security.

	* configure.ac: Conditionally enable compiler flags for
	  -fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security using
	  the new acinclude.m4 autoconf macros.

	* configure.ac: Incremented version to 1.7.2.

2008-08-01 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-fingerprint get-iab get-oui: Replaced "#!/usr/bin/perl" shebang
	  with "#!/usr/bin/env perl" to increase portability.  This allows
	  these perl scripts to work on systems where perl is not installed in
	  /usr/bin, such as NetBSD.

2008-07-26 Roy Hills <Roy.Hills@nta-monitor.com>

	* configure.ac: Incremented version to 1.7.1.

	* arp-fingerprint: Added NetBSD 4.0, FreeBSD 7.0 and Vista SP1

2008-07-25 Roy Hills <Roy.Hills@nta-monitor.com>

	* Released arp-scan version 1.7.
	  tarball arp-scan-1.7.tar.gz, size 344,771 bytes
	  md5sum a9927dba2b1dbdfd1c3b3bb09615fc14

2008-07-24 Roy Hills <Roy.Hills@nta-monitor.com>

	* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
	  IEEE website using get-oui and get-iab Perl scripts.

	* configure.ac: Incremented version to 1.7.

2008-07-11 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.a: Removed reference to RMIF environment variable.
	  arp-scan now uses the value specified with --interface, or
	  if that is not specified, picks an interface with
	  pcap_lookupdev().

	* configure.ac: Incremented version to 1.6.4 for pre-release
	  testing.

	* *.c, *.h: Modified copyright statements to read 2005-2008.

2008-05-03 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Added --pcapsavefile (-W) option to allow received
	  ARP responses to be saved in the specified pcap savefile for
	  later analysis.

	* TODO: Removed plan to support libpcap 0.7 as just about every
	  system has at least libpcap 0.8, and most have 0.9.

	* arp-scan.c: changed display_packet() so it displays the source
	  address from the frame header in parens if it is different from the
	  ar$sha address.  E.g.
          192.168.1.255 ff:ff:ff:ff:ff:ff (00:03:a0:88:eb:a8)   Broadcast

2007-12-10 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Change most calls to strtol() to use the new
          wrapper function Strtol() instead, because this checks for
          errors.  Previously, a non-numeric value would be converted to
          zero without any error, meaning something like "--snap=xxx"
          would be silently accepted.  Now such invalid inputs results in
          an error.

	* arp-scan.c: Added new --vlan (-Q) option to support sending
	  ARP packets with an 802.1Q VLAN tag.  Response packets with
	  an 802.1Q tag are decoded and displayed irrespective of this
	  option.

2007-04-17 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.h: Reduced MAX_FRAME from 65536 to 2048 bytes.

	* arp-scan.c: Add the optional padding in marshal_arp_pkt(), and
	  avoid potential buffer overflow if padding is longer than the
	  remaining buffer size.

	* arp-scan.c: Changed display_packet() to take ARP structure, extra
	  data and framing type as parameters passed from callback() to avoid
	  having to call unmarshal_arp_pkt() twice.  This also means that
	  we don't need to pass the raw frame to display_packet() now as it
	  has the data in individual variables.

	* arp-scan.c: Move padding addition to marshal_arp_pkt().

2007-04-14 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.h, arp-scan.c: Changed MAXIP to MAX_FRAME and changed value
	  to 65536 bytes.  This is the maximum allowable frame size, which is
	  used to size read/write buffers.  This is much larger than any
	  layer-2 frame.

	* arp-scan.h: Changed PACKET_OVERHEAD to 18 (6+6+2 ... +4) and
	  MINIMUM_FRAME_SIZE to 46.

	* arp-scan.h: undefine SYSLOG, as we don't use this any more, and I
	  doubt that anyone else needs it.  The syslog functionality may be
	  removed in a future release.

2007-04-13 Roy Hills <Roy.Hills@nta-monitor.com>

	* arp-scan.c: Added support for RFC 1042 LLC/SNAP framing with the
	  new --llc (-L) option.

