tcpdump

No entries match these filters. Clear filters

1. tcpdump-4.99.7 Sep 21, 2026 · issue 082

   tcpdump 4.99.7 extends MPTCPMPTCPA TCP extension (RFC 8684) that lets a single connection use multiple network paths simultaneously, increasing throughput and resilience; tools use it to keep sessions alive across interface changes. dissection, adds TCP AccECNAccECNA TCP extension that carries more precise congestion-signal counts between endpoints than classic ECN, letting senders tune their rate with finer feedback from ECN-capable networks. flag support, and warns on misused --count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch tcpdump-4.99.7 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout tcpdump-4.99.7

   • Adds an error message when --count is used without -r or -V.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dissection of the MPTCP MP_TCPRST sub-option (subtype 0x8), including U/V/W/T flags and reset reasons such as Middlebox interference.
   • Parses the data_len field in the MPTCP MP_CAPABLE option and prints all eight capability flags (A through H).
   • Adds support for decoding the TCP AE (AccECN) flag in TCP header output.
   • Adds an error message when --count is used without -r or -V.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dissection of the MPTCP MP_TCPRST sub-option (subtype 0x8), including U/V/W/T flags and reset reasons such as Middlebox interference.
   • Adds support for decoding the TCP AE (AccECN) flag in TCP header output.

   1 more in Everything

2. docs update Aug 8, 2026 · issue 039

   tcpdump adds GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. (Generic Network Virtualization Encapsulation) as a supported filter keyword.

   └──▷ TRY IT
   Capture only GENEVE-encapsulated traffic on a network interface to inspect overlay network packets.
   copy

   $ tcpdump -i eth0 geneve

3. 4.99.6 Dec 30, 2025 · release notes

   tcpdump 4.99.6 adds -g option for single-line IPv4 output and supports unit suffixes on -C file size

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.99.6 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.99.6

   • Adds the -g option to print IPv4 verbose output on a single line
   • Adds optional unit suffix support on the -C file size parameter
   • Updates VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. decoding to include UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 8472 (used by Linux) as a default known port

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removes protocol decoding support for the obsolete OTV draft-hasmit-otv-04
4. 4.99.0 Dec 30, 2020 · release notes

   tcpdump 4.99.0 adds --count and --print flags, supports ZigBee ZEP and Autosar SOME/IP, and introduces CMake build

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.99.0 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.99.0

   └──▷ USE IT
   Count packets matching a filter without decoding payload overhead in CI or monitoring scripts
   shell copy

   tcpdump --count 'host 10.0.0.5 and port 80'

   Capture to a file while simultaneously printing packets to stdout for real-time inspection
   shell copy

   tcpdump --print -w capture.pcap 'udp'

   Build tcpdump using CMake alongside autoconf configuration
   shell copy

   cmake . && make

   • Add --count to print a counter only instead of decoding packets
   • Add --print to cause packet printing even with -w output option
   • Add support for new network protocols and DLTs: Arista, Autosar SOME/IP, Broadcom LI and Ethernet switches tag, IEEE 802.15.9, IP-over-InfiniBand (IPoIB), Linux SLL2, Linux vsockmon, MACsec, Marvell Distributed Switch Architecture, OpenFlow 1.3, Precision Time Protocol (PTP), SSH, WHOIS, ZigBee Encapsulation Protocol (ZEP)
   • Add CMake as the second build system alongside autoconf
   • Flush the output packet buffer on SIGUSR2 signal

   +2 more show less

   • Add support for remote capture if libpcap supports it
   • Display the wireless flag and connection status in output

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !autoconf --with-system-libpcap is replaced with --disable-local-libpcap
   • !Compiler support for C99 is now required
5. 4.8.1 Oct 25, 2016 · release notes

   Adds protocol support for RESP, VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments.-GPE, NSH, Marvell EDSA, LISP, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. ADD-PATH.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.8.1 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.8.1

   • Add printing function for Generic Protocol Extension for VXLAN
   • Network Service Header: draft-ietf-sfc-nsh-01
   • Initial support for the REdis Serialization Protocol known as RESP.
   • Add support for the Marvell Extended Distributed Switch Architecture header
   • Support of Type 3 and Type 4 LISP packets.

   +1 more show less

   • BGP: add decoding of ADD-PATH capability

   6 details in Everything

6. 4.7.0 Nov 12, 2014 · release notes

   tcpdump 4.7.0 adds GENEVEGENEVEA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. and text protocol (FTP/HTTP/SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure./RTSP) dissectors

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.7.0 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.7.0

   • Adds geneve dissector for Generic Network Virtualization Encapsulation packets
   • Adds ability to print text protocols including FTP, HTTP, SMTP, and RTSP support

   2 details in Everything

7. 4.5.0 Nov 7, 2013 · release notes

   tcpdump 4.5.0 adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments., OTV, MPTCPMPTCPA TCP extension (RFC 8684) that lets a single connection use multiple network paths simultaneously, increasing throughput and resilience; tools use it to keep sessions alive across interface changes., MSDP printers and OpenFlow 1.0 support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.5.0 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.5.0

   • Adds vxlan as a named option for -T to decode VXLAN traffic (draft-mahalingam-dutt-dcops-vxlan-03)
   • Adds new printer for OTV protocol (draft-hasmit-otv-04)
   • Adds new printer for MSDP
   • Adds new decoder for MPTCP
   • Adds support for OpenFlow 1.0 with a corresponding test case

   5 details in Everything

8. 4.4.0 Apr 6, 2013 · release notes

   tcpdump 4.4.0 adds RPKI-RTR and DNS64DNS64A DNS server mechanism that synthesizes AAAA (IPv6) records from A (IPv4) records, letting IPv6-only clients reach IPv4-only hosts without dual-stack infrastructure. Cyber tools use it to handle mixed-protocol environments transparently./NDP prefix printing, multiple file reading, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. nexthop separation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.4.0 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.4.0

   └──▷ USE IT
   Concatenate multiple capture files for a single analysis session using the new multi-file input support.
   shell copy

   tcpdump -r cap1.pcap cap2.pcap

   Decode RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. packets in a capture file by forcing the dissection parser.
   shell copy

   tcpdump -r radius.pcap -T radius

   • Supports decoding of RPKI-RTR (RFC6810) protocol on TCP port 323
   • Decodes DHCPv6 AFTR-Name option (RFC6334)
   • Adds DNSSL (RFC6106) DNS Search List support in NDP messages
   • Adds radius as an option for -T to decode RADIUS traffic
   • Separates multiple nexthops in BGP updates

   5 details in Everything

9. 4.2.1 Dec 9, 2011 · release notes

   tcpdump 4.2.1 adds CARP dissection and Hilscher link-layer support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.2.1 https://github.com/the-tcpdump-group/tcpdump.git
   # already have the repo? check out this version:
   $ git checkout 4.2.1

   • Adds -T carp flag to dissect IP protocol 112 as CARP instead of VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails.
   • Adds support for the Hilscher NetAnalyzer link-layer header format
   • Adds Babel printer support on port 6696

   3 details in Everything

10. 4.1.2 Jul 20, 2010 · release notes

    Adds -h flag to enable 802.11s mesh header recognition

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.2 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 4.1.2

11. 4.1.0 Mar 11, 2010 · release notes

    tcpdump 4.1.0 adds -b flag for BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. AS numbers and support for multiple new protocols

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.1.0 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 4.1.0

    • Adds -b flag to print the AS number in BGP packets in ASDOT notation rather than ASPLAIN notation
    • Adds DLT_ support for memory-mapped USB captures on Linux
    • Adds printer for ForCES protocol
    • Adds support for TCP User Timeout (UTO)
    • Adds support for Transparent Ethernet Bridge ethertype in GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation.

    +7 more show less

    • Adds 4 byte AS support for BGP printer
    • Adds support for the MDT SAFI 66 BG printer
    • Adds basic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support to print-olsr
    • Adds USB printer
    • Adds new TCP flags decoding
    • Adds decode of access flags in NFS access requests
    • Reports ICMPv6 RFC 5006 support

    12 details in Everything

12. 4.0.0 Oct 27, 2008 · release notes

    tcpdump 4.0.0 adds -I monitor mode flag and new protocol decoders for Bluetooth, ikev2, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.0.0 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 4.0.0

    • Adds -I CLI flag to enable monitor mode on supported interfaces
    • Updates underlying libpcap API usage to allow the -B buffer size option on all platforms

    2 details in Everything

13. 3.9.8 Sep 10, 2007 · release notes

    tcpdump 3.9.8 adds decoders for DHCP Option 121/249, Juniper .pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. TLV, and Frame-Relay ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.8 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.9.8

    • Adds decoding for DHCP Option 121 (RFC 3442 Classless Static Route)
    • Adds decoding for DHCP Option 249 (MS Classless Static Route) matching Option 121 format
    • Adds TLV support for Juniper .pcap extensions
    • Adds support for Frame-Relay ARP printer

    4 details in Everything

14. 3.9.6 Apr 25, 2007 · release notes

    tcpdump 3.9.6 adds parsing for OIF RSVP Extensions UNI 1.0, multiple STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. (802.1s), UDLD, OLSP, DCCP variable checksum, VTP, and DPTR.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.6 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.9.6

    • Add support for OIF RSVP Extensions UNI 1.0 Rev. 2 and additional RSVP objects
    • Add support for Multiple-STP as per 802.1s
    • Add support for rapid-SPT as per 802.1w
    • Add support for unidirectional link detection as per https://tools.ietf.org/id/draft-foschiano-udld-02.txt
    • Add support for the olsr protocol as per RFC 3626 plus the LQ extensions from olsr.org

    +3 more show less

    • Add support for variable-length checksum in DCCP, as per section 9 of RFC 4340.
    • Add support for the cisco proprietary 'dynamic trunking protocol'
    • Add support for the cisco proprietary VTP protocol

    8 details in Everything

15. 3.9.4 Sep 19, 2005 · release notes

    tcpdump 3.9.4 adds DCCP support and Juniper/Frame Relay decoders

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.4 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.9.4

    • Adds DCCP decoding capability for Datagram Congestion Control Protocol traffic
    • Adds support for more Juniper link-layer types to expand captured network compatibility
    • Adds FRF.16 support for Frame Relay with bug fixes in existing Frame Relay handling
    • Adds RSVP integrity object support and updates fast-reroute object printer to latest spec

    4 details in Everything

16. 3.9.3 Jul 5, 2005 · release notes

    tcpdump 3.9.3 adds packet sending (-s), chroot support, and dozens of new decoders

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.9.3 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.9.3

    └──▷ TRY IT
    Send crafted packets from a file to a target interface for testing network resilience.
    copy

    $ tcpdump --chroot /var/lib/chroot -w send.pcap

    • Adds support for sending packets via send() syscall (requires root/CAP_NET_RAW)
    • Adds --chroot option to change root directory before dropping privileges
    • AES ESP decoder added for esp-aes link layer type
    • Juniper ATM, FRF.15, FRF.16, PPPoE, ML-FR, ML-PIC, ML-PPP, PL-PPP, LS-PIC, GGSN, ES, MONITOR, SERVICES decoders added
    • L2VPN decoder added

    +19 more show less

    • Axent Raptor/Symantec Firewall decoder added
    • TCP-MD5 (RFC 2385) decoder added for tcp-mouse link layer type
    • ESP-in-UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. (RFC 3948) decoder added for esp-in-udp link layer type
    • ATM OAM decoder added
    • LMP, LMP Service Discovery decoders added
    • IP over FC decoder added
    • IP over IEEE 1394 decoder added
    • BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. MS/TP decoder added
    • SS7 decoder added
    • LDP over TCP decoder added
    • LACP, MARKER (802.3ad) decoders added
    • PGM (RFC 3208) decoder added for pgm link layer type
    • LSPLSPLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code.-PING decoder added
    • G.7041/Y.1303 Generic Framing Procedure decoder added
    • EIGRP-IP, EIGRP-IPX decoders added
    • ICMP6 decoder added for icmp6 link layer type
    • Radio via radiotap decoder added
    • DHCPv6 decoder added
    • HDLC over PPP decoder added

    24 details in Everything

17. 3.8 Nov 12, 2003 · release notes

    tcpdump 3.8 adds -A/-U flags, IS-IS/Cisco HDLC, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing./BFD decoders and RFC 2625/2684 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.8

    • Adds -A flag to print only ASCII payload data.
    • Adds -U flag to flush stdout after every packet.
    • Adds decoding for IS-IS inside Cisco HDLC frames.
    • Adds mDNS decoder for multicast DNS resolution.
    • Adds new BFD (BFD) decoder for Bidirectional Forwarding Detection traffic.

    +4 more show less

    • Adds support for RFC 3561 AODV (Ad-hoc On-demand Distance Vector) routing protocol.
    • Adds support for RFC 2625 IP-over-Fibre Channel encapsulation.
    • Adds support for RFC 2684 bridging of Ethernet, Token Ring, and FDDI over ATM.
    • BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. output now splits into multiple lines for readability.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The syntax of the -E argument has changed to allow multiple Security Associations (SAs) to be decrypted.
18. 3.7 Jan 21, 2002 · release notes

    tcpdump 3.7 adds SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking., MPLS, VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails., and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. ND support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.7

    └──▷ TRY IT
    Rotate capture files automatically when they reach a specific size limit.
    copy

    $ tcpdump -C 10 -w capture.pcap host 192.168.1.1

    • -C option to rotate save file every optarg * 1,000,000 bytes
    • SCTP protocol dissector
    • MPLS encapsulation decoding per RFC3032
    • VRRP name support

    4 details in Everything

19. 3.6 Jan 9, 2001 · release notes

    tcpdump 3.6 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. DHCP/mobile-IP/OSPF6 dissector support, VLAN/ISIS filtering, and an any capture device for Linux.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.6

    • Added "any" as a valid interface name on Linux to capture on all interfaces simultaneously
    • Added dissector support for IPv6 Mobile IP and OSPFv6 protocols
    • Added dissector support for ISOCLNS, Token Ring, IGMPv3, bxxp, timed, vrrp, radius, chdlc, cnfp, cdp, IEEE802.1d, and raw-AppleTalk
    • Added filtering support for VLANs, ESIS, and ISIS

    4 details in Everything

20. 3.5 Jan 28, 2000 · release notes

    tcpdump v3.5 adds auto-rP parser, -X ascii dump, SNMPv3, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. decoding, and AFS packet parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.5

    • Adds Cisco Auto-RP parser alongside existing PIMv1, PIMv2, DVMRP, and IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. parsers.
    • Implements -X flag for ASCII hex dump output (from NetBSD).
    • Supports SNMPv3 packet printing in addition to SNMPv1/v2.
    • Adds NFSv3 packet parsing support.
    • Adds AFS3 (Andrew File System) packet parsing.

    +1 more show less

    • Adds SMB (Server Message Block) printing support.

    6 details in Everything

21. 3.4 Jul 25, 1998 · release notes

    tcpdump v3.4 adds -a flag and raw packet printer

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.4

    • -a flag enables translation of network and broadcast addresses to names.
    • Adds a raw packet printer.

    2 details in Everything

22. 3.3 Nov 30, 1996 · release notes

    tcpdump v3.3 adds Linux support, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. printer, DVMRP probe, and improved TCP/SACK handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.3

    • Added GRE (Generic Routing Encapsulation) packet printer
    • Added DVMRP probe printer
    • Improved TCP SACK code to correctly print all blocks instead of repeating the first block

    3 details in Everything

23. 3.2.1 Jul 14, 1996 · release notes

    v3.2.1 adds atalk and sca keywords, DLT_IEEE802 support, and IGRP decoder

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.1 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.2.1

    • Add atalk keyword to select AppleTalk protocol packets
    • Add sca keyword to select DEC cluster services (SAP) packets
    • Added a printer entry for DLT_IEEE802 link-layer type
    • Added an IGRP printer to decode Interior Gateway Routing Protocol messages

    4 details in Everything

24. 3.2 Jun 23, 1996 · release notes

    tcpdump v3.2 adds RIP V2 support and T/TCP options printing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.2

    • Added RIP V2 support for decoding Routing Information Protocol version 2 packets
    • Adds T/TCP options printing.

    2 details in Everything

25. 3.1 Jun 13, 1996 · release notes

    Adds parsing for DVMRP/PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic. traffic, new DNS types, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. 4 support and RTP/vat endian fixes in v3.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.1

    • Add support for printing DVMRP and PIM traffic thanks to Havard Eidnes (Havard.Eidnes@runit.sintef.no).
    • Add support for new dns types, thanks to Rainer Orth.
    • Add support for Kerberos 4 thanks to John Hawkinson (jhawk@mit.edu).

    3 details in Everything

26. 3.0 Jun 20, 1994 · release notes

    tcpdump v3.0 adds decnet/IPX support, -v IP checksum verification, libpcap move, and new print protocols via -T

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 3.0

    • Adds decnet protocol dumping support.
    • Adds ipx protocol dumping support.
    • Adds vat, wb, rpc (sunrpc), and rtp packet interpretation via the -T flag, including new inbound and outbound filter keywords.
    • Adds IP header checksum verification under the -v flag.
    • Moves packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. code to a separate libpcap library.

    5 details in Everything

27. 2.2 May 22, 1992 · release notes

    v2.2 adds icmp/multicast keywords, loopback interface support, EGP/OSPF printers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2 https://github.com/the-tcpdump-group/tcpdump.git
    # already have the repo? check out this version:
    $ git checkout 2.2

    └──▷ USE IT
    Capture only non-echo ICMP packets (e.g. destination unreachable) on the local loopback interface.
    shell copy

    tcpdump -i lo 'icmp[0] != 8 and icmp[0] != 0'

    • Adds icmp keyword to filters for matching ICMP packet types, e.g., 'icmp[0] != 8 and icmp[0] != 0'
    • Adds multicast keyword and extends broadcast to support protocol qualifications like ether multicast
    • Adds support for monitoring the loopback interface via -i lo flag
    • Adds EGP and OSPF packet printers

    4 details in Everything