See ​http://research.wand.net.nz/software/libtrace.php for download information

libtrace 3.0.8 (coming soon!)

New Features

• Added a new API function called trace_get_payload_length() that returns the length of the original payload content (i.e. the size of the post-transport header payload prior to any snapping) (r1661)

Bug Fixes

• Fixed bug where converting from int: to pcapfile: would result in losing four bytes of payload (r1673) - Thanks to Nevil Brownlee for reporting this bug.
• Fixed segfault that occurred when trying to read from int: inputs without permission (r1653, #279)
• Fixed segfault in tracertstats when an invalid output format is specified (r1660)
• Fixed errors in payload length calculations for v6 in v4 and truncated or corrupted TCP headers (r1662, r1663)
• Fixed bug where libtrace would attempt to write NONDATA packets, which could not be converted into an appropriate packet type for most trace formats (r1664)
• Fixed incorrect parsing of IPv6 extension headers (r1665, r1666)
• Fixed compilation error when building against DAG 2.5 drivers (r1668, #286) - Thanks to Guillaume Vu-Brugier for reporting this bug.
• Fixed linking error when building against certain versions of libpcap that install pcap-int.h (r1669, #287) - Thanks to Guillaume Vu-Brugier for reporting this bug.

Improvements

• Added IPv6 and IPv6 fragmentation header decoders to libpacketdump (r1654,r1656,r1667)
• traceanon can now read cryptopan keys from a file (r1659)

libtrace 3.0.7 (2010-08-03)

New Features

• Replaced IO subsystem with wandio abstraction (r1391,r1394,r1395,r1396,r1397,r1398,r1400)
  • IO / compression / decompression is now performed in a separate thread, resulting in improved performance
  • Modular design makes it easy to add support for new compression formats
• Added native support for reading and writing bzip files (r1391)
• Added native support for writing lzo files (r1530,r1531,r1534)
• JITing of BPF bytecode using LLVM, leading to faster BPF filtering (r1586,r1588)
• Added enums for post-IP protocols and Ethertypes (r1386,r1387,r1388,r1389)
• Write support added for DAG cards - thanks to Daniel Lawson (r1406,r1414,r1418)
• Added new trace tool: tracetop. Shows the top N flows each second (r1408,r1409,r1411,r1412,r1413,r1415,r1416,r1417)
• Added new trace tool: tracereplay. Attempts to replay trace files in trace time (r1460 to r1476)
• Added new trace tool: tracediff. Displays packets that differ between two trace files (r1494)
• Added trace_get_timespec() function (r1421)
• If the format is not specified as part of the URI, libtrace can now attempt to guess the trace format (r1401,r1403)
• Libpacketdump can now decode CHDLC and PPP/HDLC headers (r1538)
• Added all the code examples from the libtrace tutorial to the examples directory (r1502)

Bug Fixes

• Fixed bug where packets read from a DAG card that did not match the filter were causing lengthy sleep events under the event API (r1483)
• Fixed various tools that were not reporting the occurrence of a read error (r1486,#270)
• Fixed segfault caused by malformed URIs (r1393,r1399)
• Fixed bug where reading a zero-length payload from a PCAP trace would result in an EOF being incorrectly reported (r1490)
• Fixed bug where filtered packet count was not initialised to zero (r1393)
• trace_get_payload_from_ip() now returns NULL when the IP version is incorrect rather than asserting (r1402)
• Fixed segfault when writing packets to a Linux native socket, caused by byte ordering issue (r1405)
• Fixed bug where custom pcap event function was not being used (r1422)
• Fixed misplaced assertion in the pcap file reading code (r1423)
• Fixed bug where trace_event would never get a packet event under recent versions of libpcap (r1426)
• Fixed assertion failure when an unknown linktype is encountered by libpacketdump (r1459)
• Fixed error caused by LCP packets that are common in some trace sets, e.g. Leipzig (r1482)
• Increased size of RT packet buffer to fix problems caused by jumbograms (r1493)
• Fixed errors caused by 32- and 64-bit incompatibility when sending Linux Native packets using the RT protocol (r1498,r1499)
• trace_get_*_port() functions now always return 0 for ICMP packets (r1500)
• Fixed problems with decoding HDLC and CHDLC headers (r1536)
• Fixed segfault when reading PCAP packets that had no packet content (r1537)
• Fixed bug where PCAP packets would be written with a larger capture length than the wire length (r1549)
• Fixed segfault in the TCP segment report in tracereport caused by segments larger than 1500 bytes (r1539, r1540)
• Fixed bug with restarting a PCAP trace file (r1574)
• Fixed bugs relating to the size of the TSH packet records (r1577)
• Fixed bug where we were not accounting for the FCS in legacy Ethernet captures (r1581)
• Fixed bug where libpacketdump could not decode Linux SLL properly due to using an "undefined" function (r1583)
• Fixed bug where libpacketdump was not skipping IP options before attempting to decode the next header (r1600)
• Fixed bug where padding was being treated as part of a truncated header (r1602)
• Fixed assertion when converting a packet with a corrupt wire length to PCAP (r1603)
• More fixes for missing #includes (r1425)

Improvements

• trace_get_source_address() and trace_get_destination_address() now return link layer addresses in the absence of an IP header wherever possible (r1410)
• trace_get_<protocol> short-cut functions now return NULL if the entire header (minus options) is not present in the packet (r1491)
• Added missing set_capture_length() functionality for Linux Native (r1495)
• traceanon can now write compressed traces (r1550)
• traceanon now replaces checksums with zeroes (r1567)
• traceanon, tracesplit and tracemerge now support all libtrace compression types for output (r1568,r1570,r1571)
• tracereport no longer does the flow report by default (r1551)
• Added support for new ERF types (r1507)
• Added linktype for Experimental Ethernet (r1497)
• Added --count option to tracereport (r1427,#248)
• Added --merge-inputs option to tracertstats (r1440)
• Added support for ARPHRD_NONE (r1451)
• Added a libpacketdump decoder for ubiquity headers (r1488)
• Improved libpacketdump's method of searching for decoders (r1584)
• More efficient arrangement of internal structures (r1442,r1443)
• Tidied up exported symbols (r1454,r1456)
• General code maintenance (r1404,r1407,r1517)
• Tidied up manpages (r1492,r1569,r1572)
• Improved documentation (r1419,r1420,r1496,r1501,r1506,r1507,r1508,r1509,r1510,r1513,r1515,r1516,r1517,r1518,r1519,r1520,r1521,r1522,r1523,r1524,r1543,r1578)

libtrace 3.0.6 (2008-11-27)

• Fixed compilation errors caused by missing #includes (r1382)
• Added trace_get_payload_from_pppoe() to external API (r1383)
• autoconf now correctly detects libgdc properly for tracertstats (r1384)
• Fixed some warnings on recent versions of gcc (r1385)

libtrace 3.0.5 (2008-11-07)

• Bug fix with respect to loss counter caching (r1312)
• Major fixes to PoS traces (#261,r1371,r1378,r1379)
• Windows fixes (r1322,r1323)
• Code cleanups (r1324,r1325,r1326,r1333,r1355)
• Dag 2.5:
  • Dropped packet counter fixes (with multithread locking) (r1326,r1329)
  • Event api issues (r1327)
  • Multiple stream support (and compatibility for dag 2.4) (r1328)
  • Better detection of dag version numbers (r1343)
• New ERF types added (r1328,r1331)
• Coloured ethernet ERF type support (r1328)
• Fixes to the ERF Etherhack (r1328)
• Bug fix for unsupported configuration options for erf traces (r1330)
• Bug fix for {{set_capture_length()}} not updating the capture length cache (r1331)
• Bug fix for more capture length cache entries (r1346)
• Cleaned up the way managing packet's memory was done internally (r1332,r1335,r1336)
• Added RT type for {{bpf:}} traces (r1332)
• Bug fix for closing a {{pcapfile:}} trace file that was never trace_start()'d (r1334) (reported by Nevil Brownlee)
• Fix compile error with bpf: on OpenBSD (r1336)
• Fix compile errors with old compilers (r1337,r1339,r1340,r1341,r1345)
• libpacketdump cleanups (r1338,r1339)
  • libpacketdump constification (r1351)
• traceanon code cleanups (r1342)
• tracertstats code cleanups (r1344)
• tracertstats documentation cleanups (r1369)
• int: code cleanups (r1347,r1352)
• tracesplit documentation cleanups (r1348)
• tracesplit error handling fixes (r1364)
• Cleanup examples (r1365)
• Deal better with creating compressed files (r1349)
• Deal with raw IP capture (r1350)
• Provide API's for dealing with VLAN and MPLS headers (r1353, r1359, r1372)
• get_payload_from_X API's now return NULL if the header is incomplete with remaining == 0. If there is no payload then they return where the payload would be, and remaining == 0. (r1376)
• Fix bug with trace_get_erf_timestamp() where UINT_MAX ends up being signed (reported by yuri from isi) (r1357)
• Force 64bit for filesizes (r1358)
• Add support for PPPoE, and skip PPPoE headers in trace_get_layer3() (r1360)
• Improve support for VLANs (r1363)
• Improve tracesplit's dealing with rotations based on starttime, and better debugging output (r1366)
• assert() on bad packets that aren't caught before we return them back to the user (r1367)
• Cleanup libpacketdump GRE parser (r1368, r1370)
• Support specifying compression levels (r1373)
• Better fixes for endianness issues (r1375)
• removed traceflow, to be replaced with maji (ipfix collector) available seperately (r1377)

libtrace 3.0.4 (2008-01-02)

• Deprecate wtf:/wag: format. These traces no longer exist. (r1264)
• Cleanup bpf: capture format (r1265,r1266,1317)
• add LINUX_SLL header support to get_source_mac() (r1267)
• deprecate trace_get_link() and replace it with the newer trace_get_packet_buffer()/trace_get_layer2() (r1268,r1269,r1270,r1271,r1272)
• Bug: Don't crash when destroying an output trace that failed to initialise (r1273,r1274,#258)
• Use Linux's in kernel BPF filter if available (r1275)
• Add support for Cisco HDLC over PoS (r1276,r1277)
• Allow BPF bytecode to be used to construct a filter (r1278)
• Code cleanups (r1279,r1282,r1283,r1284,r1288,r1289,r1290,r1297,r1309,r1315)
• Fix libtrace_ip's bitfields (r1280,r1281,r1287)
• Fix pcapfile output bug (r1285)
• Documentation cleanups (r1286,r1295,r1296,r1306)
• Discard RT packets when writing pcapfile: files (r1291)
• Add a new "stats" example program (r1292,r1294)
• Build system cleanups (r1293,r1305,r1318)
• Avoid using assert() to report errors (r1298,r1299,r1300)
• RT packet issues (r1301)
• Properly deal with the packet parsing/length cache when using the event system (r1302)
• Add a new loss counter framework (r1303,r1304,r1307,r1308,r1310,r1311,r1312,r1316)
• Bug: Event framework not generating sleep events when reading traces from disk (r1313)
• Be more strict about returning NULL from trace_get_payload_from_X() functions (r1314)

libtrace 3.0.3 (2007-09-05)

• Code cleanups w.r.t warnings (r1211,r1212,r1213,r1214,r1216,r1217,r1218,r1219,r1224,r1225,r1255)
• tracesplit_dir now provides a warning of the number of packets that had an unknown direction at the end of the trace (r1215)
• Fix a segfault in tracereport with rxerrors, non ip (r1221, r1227)
• Add support for decoding 802.2 LLC/SNAP and Ethernet II in 802.11 frames (r1222,r1226)
• Documentation fixes and clarifications (r1223,r1235,r1236,r1245,r1248,r1249)
• Fix bug with trace_get_payload_from_80211() and 3 vs 4 frame formats (r1226)
• Deal correctly with uri's with parse errors causing segfaults on cleanup (r1229)
• Minor tidyups to protocol decoders (r1230,r1232)
• Add more information to libtracepktdump (r1231,r1256)
• Correctly deal with PPP captures (r1233)
• Cache trace_get_capture_length() and trace_get_l3() which are both heavily used internally (r1234)
• Build system cleanups (r1237,r1250)
• Add a GRE tracepktdump decoder (r1238)
• Add a preliminary PPPoE tracepktdump decoder (r1241)
• Add more information to tracereport (r1239,r1247)
• Fix bug in legacy decoder with wire lengths (r1239)
• Fix bug in trace_ether_ntoa (r1240)
• Add legacynzix: trace format (r1243)
• Don't assert() on bad packets (instead return BADPACKET) for erf traces (r1244)
• Add TRACE_OPTION_EVENT_REALTIME to allow the event framework to playback traces in realtime (r1246)
• Rename TRACE_META_FREQ to TRACE_OPTION_META_FREQ to follow naming convention (r1246)
• Correctly deal with errors when using trace_set_option (r1247)
• Deal better with signals when writing packets to files (#254,r1251,r1252,r1253)
• Add support for dag 3.x (r1254)
• Improved dag 2.5+ support (r1254,r1255)
• dag2.5+ supports setting the snaplen from libtrace (r1254)
• Add support for setting direction on linux int: formats (r1257,r1258)
• Consider loopback packets outgoing, not incoming (r1257)
• Fix trace_get_source_mac() for wireless frames (#253,r1259)
• Add support for interfaces_per_input to tracemerge (r1260)
• Fix tracereport direction report (r1261)
• Deprecated wag: and wtf formats (r1262,r1263)

libtrace 3.0.2 (2007-04-27)

• Fixed make install for libpacketdump (#246,r1173,r1186)
• Add support for tsh: and rf+ tracefiles. (r1174,r1175,r1176,r1180,r1181,r1194)
• Update support for radiotap (r1177)
• Add a new tool traceflow(1) (r1178),r1196,r1197)
• More correctly deal with pcap LINKTYPE's vs DLT's (r1179,r1182,r1183)
• Major cleanups of tracereport (#247,r1184), new reports (#236,r1191), Make sure reports write to files (r1202,r1203,r1204)
• libpacketdump Decoder cleanups (r1185,r1187)
• trace_event() memory leak fixes (r1188,r1189)
• Fix segfaults with bad arguments in tracesplit(1) (#244,r1190)
  • Don't suffix a number if we are only generating one file (r1198)
  • Support snapping packets (r1199)
• Minor bugs in libtrace error handling (r1192,r1193)
• Misc cleanups and bug fixes (r1206,r1207,r1208)

libtrace 3.0.1 (2007-03-26)

• Added missing manpages to release tarball (r1141,r1148)
• Update manpages (r1153)
• Fixed TCP option length calculation in libpacketdump (r1142)
• tracereport has had a massive tidy up (r1143,r1144,r1146,r1147,r1149,r1150,r1151,r1152)
  • getopt support for disabling/enabling reports. (r1145)
• Documentation cleanups (r1154)
• Fix 0 byte gzwrite(3)'s were causing the compressed file checksum to fail (r1155)
• RT closing issues (r1156)
• Metadata available (r1157,r1158,r1159,r1160,r1167)
• tracedump renamed tracepktdump due to naming conflict in debian (r1161,r1162)
• Implement better PoS decoding in libtrace for erf, legacypos. (r1163,1164,r1168)
• Build fixes for MacOS (r1171, r1172)

libtrace 3.0.0 final release! (2007-02-12)

• Add and update man pages (r1081,r1082,r1108)
• Don't start traces that are in the error state (r1084)
• initialise variables used by trace_event() (r1089)
• General code cleanups (warnings etc) (r1090,r1116,r1120,r1121,r1122,r1123,r1124,r1125,r1126,r1127,r1128,r1131,r1135)
• export RT types to allow symbolic debugging (r1091,r1092,r1093,r1094,r1095)
• memory leak in trace_construct_packet (r1102)
• trace_event free()ing returned packet buffer (r1119,#238)
• trace_config() error handling (r1130,r1132)
• error handling when opening files for write (r1136,r1137,r1138)
• build fixes (r1131)
• Format modules:
  • pcap (r1117)
  • Legacypos (r1085,r1087, r1088)
  • legacyatm (r1083,r1085,r1087, r1088)
  • legacyeth (r1087,r1085,r1088)
  • dag 2.4 (r1098,r1114,r1115)
  • dag 2.5 (r1107,r1110,r1111,r1112,r1113,r1114,r1115)
• libpacketdump
  • legacy trace decodes (r1086)
  • 802.11 (r1099,r1134)
  • arp (r1103,r1109)
  • ICMP Echo sequence numbers (r1105)
• protocols
  • radio tap (r1100)
  • get_payload_from_80211 (r1104)
  • sit (r1118,#237)
• tools
  • tracesplit
    • cleanup on ^C (r1101)
    • maximum number of files (r1129)
  • tracestats
    • Deal with invalid filters more elegantly (r1133)
  • tracesummary
    • Use correct filters by default (r1133)
• windows portability issues (r1130)

libtrace 3.0.0 beta 7 (2006-11-07)

• Display ToS bits in libpacketdump as DSCP/ECN (r1071)
• Fix bug where the final packets were not being flushed out in some of the tools (r1072)
• Fix bug where DLT_NULL was being used instead of DLT_RAW for raw IP packets (r1073)
• Fix compile warnings (r1074, r1076, r1077)
• Fix bug with tracesplit segfaulting if given more than 2 options. (r1075)
• Fix bug with legacyatm: not signalling end of file correctly (r1078)
• More tests (r1079)

libtrace 3.0.0 beta 6 (2006-10-26)

• int: ignored overridden promisc flags (r1058)
• Build fixes (r1059,r1060,r1068,r1069,r1070)
• Add proper decode support for ATM cells (r1061)
• pcap:/pcapfile:/trace_filter_apply() now will "demote" a packet, stripping off any header that pcap doesn't understand. (r1062,r1063,r1064,r1067)

libtrace 3.0.0 beta 5 (2006-10-16)

• rejiggered the build system:
  • libpacketdump (r965,r966,r967,r968,r969,r972,r978,r979,r981,r986,r993,r1044,r1046)
  • main (r973,r975,r976,r980,r1002,r1012,r1019,r1022,r1032)
  • swig (r974)
  • libtrace (r977,r1035)
  • tests (r1049,r1054)
• Clarification of errors: (r970,r971,r1055)
• new wireless metadata API support for libtrace (r982,r983,r984,r985,r987,r988,r994,r995,r1003,r1004,r1007,r1008,r1009,r1015,r1027,r1028,r1029.r1030,r1042)
• Capture methods:
  • rtclient: protocol fixup/removal (r989,r1032)
  • pcapfile: protocol write support (r990,r992,r1047,r1048)
  • bpf: capture support for the BSD's (r997)
  • rt: cleanups (r1002,r1016)
• Fix bug with trace_perror_output (r991)
• Cleanup warnings (r996,r998,r999,r1000,r1001,r1021,r1043,r1045,r1050,r1051,r1052,r1053)
• Cleanup and distribute the sample code (r1005,r1006)
• Documentation/Comments? fixed (r1010,r1039)
• Protocol decoders:
  • Added MPLS decoding support (r1011,r1020,r1036)
  • Fixed LINUX_SLL decoding (r1014,r1017,r1037,r1038)
• Export new functions:
  • trace_get_payload_from_ip6 (r1013)
• trace_create_dead() should call trace_init() (Closes #228) (r1018)
• removed packet->size due to it's value being underspecified. (r1023,r1026)
• libpacketdump decoders: (r1040,r1041)
  • IP tidyups (r1024)
  • 802.11 (r1024,r1034)
  • 802.1x (r1031)

libtrace 3.0.0 beta 4 (2006-08-30)

• tracesplit tidyups to deal better with old NLANR traces (r950)
• pcap: uris should deal with packets that are corrupt/missing a linklayer (r951)
• Code cleanups/build system cleanups (r952, r953, r956, r958, r963)
  • when linking against libpacketdump, you need to provide -lfl (r959)
• libpacketdump should deal with packets that are corrupt/missing a linklayer (r954)
• Tom Young's linux int: performance improvements (r955, r960)
• if libpacketdump can't decode a linklayer itself, it should ask libtrace to decode it (r957)

libtrace 3.0.0 beta 3 (2006-08-22)

Most of this release was bug fixes for MacOS portability, mostly dealing with endianness issues

• Alpha version of python bindings (r917)
• Cosmetic changes to help (r904)
• Wag length (r908)
• Coping with Dag rx errors (r909)
• Bugs in promote packet (direction tagging pcap files) (r910,r926,r927,r929)
• Bugs in erf/demote packet (converting from direction tagged pcap files) (r924,r925,r928,r941)
• Changed the build system for libpacketdump, removed C++ dependancies where unneeded, and general code tidy ups (r911,r913,r914,r916,r919,r936,r947)
• Portability fixes for MacOS (r916,r918,r921,r922,r931,r933,r942,r944)
• General code cleanups (r930,r932,r935)
• More error checking on protocol decode (r934)
• Better test cases, disable broken test (r937,r938,r939)
• General Build system fixes (r940,r943,r945,r946,r948)

libtrace 3.0.0 beta 2 (2006-06-27)

• Added better error handling for pcap/duck/rt formats (r875,r880,r885,r886)
• Fixed problems with TRACE_TYPE enum (some values had been shuffled around) (r876)
• Fixed protocol decodes for 802.11 and LLC/Snap (r879)
• Added better unit tests for protocol decoding, writing files, and did some general cleanups (r882,r883,r884,r899)
• Massive build system overhaul (r887,r892,r893,r896)
• Update documentation (r888,r891)
• Minor cleanups (r889,r894,r895,r900,r901)
• trace_get_{source,destination}_address() now include the port number in the sin{,6}_port field. (r897)

See ​http://research.wand.net.nz/software/libtrace2-changelog.php for details of changes that occurred prior to libtrace 3