Libtrace 4.0.17

New features

• Added support for PF_RING zero-copy -- this is now the official libtrace pfring: format, and the original non-zero-copy version is now available via pfringold:.

Bug fixes

• PF_RING formats now default to promiscuous capture mode, which is consistent with other live formats.
• Fixed incorrect statistics counters for PF_RING formats.
• Fixed various libpacketdump crashes or infinite loops when presented with bogus packet content.
• Fixed bug where pfringold: was not setting the order field for packets.
• Fixed bug where writing packets to a virtual interface via ring: would cause libtrace to hang.
• Fixed bug where DPDK port stats could not be reset if using Napatech DPDK.
• Fixed race condition in the etsilive: format.
• Fixed various memory errors and leaks in the etsilive: format.
• Fixed race condition in tracertstats when processing a user interrupt.

Improvements

• Improved capture speed for pfringold:.
• ring: format now supports trace_flush_output() method.

Libtrace 4.0.16

New features

• Added support for PF_RING (via pfring).
• Allow input configuration options to be specified as part of the libtrace URI. Options are specified as comma-separated key=value strings and end with a : character, e.g coremap=[1,2]:int:eth0.
• New API function trace_hold_packet(), which allows users to safely retain a reference to a packet that has been received via a format for later use.
• Added coremap option, trace_set_coremap(), to bind per-packet threads to physical CPU cores

Bug fixes

• Fixed bug where XDP packet buffers were not released back to the fill queue properly.
• Fixed thread-safety issues with freeing XDP packets.
• Fixed bug where libtrace would unload XDP programs that were not loaded by libtrace.
• Fixed crash when sending packets via DPDK.
• Fixed crash when closing a pcap input that is NULL due to an error on initialisation.
• Fixed read of freed memory when an error occurs in trace_create_output().
• Fixed bogus bitshifting when expanding a toeplitz hash key.
• Fixed DAG transmit functionality to actually work.
• Fixed multiple issues with trace_get_outermost_vlan() and trace_get_outermost_mpls().
• Fixed various bugs when promoting or demoting pcap packets from one linktype to another.
• tracertstats should now correctly process trace files as fast as possible (but can be configured to run in "trace-time" instead).
• Fixed inconsistencies when running tracertstats against the same trace file multiple times.
• Fix concurrency bug which would cause an error result when calling trace_apply_filter() in a parallel program.
• Fix possible packet buffer leak when reading a packet via pcap:.
• Fixed packet header structures with incorrect field definitions (libtrace_8021q_t, libtrace_atm_cell_t, libtrace_atm_nni_cell_t, libtrace_atm_capture_cell_t, libtrace_atm_nni_capture_cell_t). If you use these in your code you may need to update your code to use the new field names.

Improvements

• XDP now uses the undirectional hasher by default and moves hashing to the network card
• XDP: warn users if flow director rules are found on the interface during initialisation.
• XDP: push hashing onto the NIC where possible.
• Improve receive performance for Linux native formats by ensuring internal structures are properly cache aligned.
• A single libtrace program should now be able to run against multiple concurrent DPDK inputs (requires sensible use of the coremap option).
• DPDK support now extended to Mellanox DPDK libraries.
• Improved DPDK detection, including detection of DPDK meson builds for DPDK version 20.11 and newer

Libtrace 4.0.15

Bug fixes

• Fixed bug where reading a pcapng trace file would result in an endless stream of "NULL meta pointer" error messages.
• Fixed bug where libpacketdump would truncate packets that had been captured using the Linux SLL format, such as the any interface.

Libtrace 4.0.14

New features

• Added read and write support for interfaces using AF_XDP (xdp:). You can use the built-in eBPF program or provide your own.
• Added basic API for parsing RADIUS messages: trace_get_radius(), trace_get_radius_avp() and trace_get_radius_username().
• tracediff can now write the differing packets to libtrace outputs (one output per input trace), instead of just using libpacketdump to print them on the terminal.

Bug fixes

• Fixed bug in traceends that was causing invalid byte counts to be reported.
• Fixed DPDK build issues on Fedora, Centos and FreeBSD systems.
• Fixed bug where multi-threaded programs that receive no packets on one or more threads for a long period of time would silently exit.

Improvements

• tracediff can now use a window to "look ahead" for possible packet matches, rather than directly comparing packets in the same position in their respective input traces.
• Added option to tracereplay to control the transmit batch size for replayed packets.

Libtrace 4.0.13

New features

• Added support for DPDK vdevs as a libtrace input and output format.

Bug fixes

• Fix segfault in libpacketdump when the next header is incorrectly inferred to be a meta-data header.
• Fix misleading display of Netacq-Edge polygon IDs in libpacketdump.
• DPDK: separate snap length calculation from buffer size calculation.
• DPDK: resolve issues with feature detection in cases where the device fails to initialise; also only enable features if they are supported by the underlying device.
• DPDK: fix linking problems when using a system version of DPDK.
• Fix bugs that occur when a dedicated hasher thread is used with a parallel input format.
• Fix bug where tracesplit would attempt to gather statistics from a destroyed trace object.
• DPDK: Fix issue where the initial packets were not being transmitted when using dpdk as an output format.
• DPDK: Make sure shared memory and huge pages are properly removed once libtrace stops.

Improvements

• tracereplay can now replay raw IP traces onto Ethernet links (by substituting in a fake Ethernet header).
• Updated DPDK support to work with DPDK 19.11 and 20.02.
• DPDK: improve error messaging so that libtrace errors are distinct from internal DPDK error messages.

Libtrace 4.0.12

New features

• Added new tool for multicasting captured packets from a single capture source to multiple clients: tracemcast.
• Updated libtrace and libpacketdump to be able to parse tagged packets produced by the corsarotagger software.

Bug fixes

• Fix packet truncation bug when a packet has a larger capture length than wire length due to the addition of post-capture meta-data.

Improvements

• Minor performance improvement when calling trace_get_wire_length() on a packet multiple times.

Libtrace 4.0.11

This release contains a collection of bug fixes; no new features or APIs this time around.

Bugs that have been fixed:

• Fix bug where trace_apply_filter() would not work correctly with a parallel trace input.
• Fix bug where non-parallel ETSI programs would fail to halt nicely.
• Fix libpacketdump being unable to decode Ethernet within MPLS properly.
• Fix libtrace (trace_get_layer3()) being unable to decode Ethernet within MPLS properly.
• tracereplay now strips VLAN and MPLS headers before trying to replay a packet from a trace file.
• Fix bug where the simple circular buffer would leak shared memory files.
• Fix segfault when using trace_apply_filter() on a packet which came from an input trace that is now "closed".
• Fix bug where libtrace could try to flush a NULL pcap file handle.

Libtrace 4.0.10

• Fixed SIOCGSTAMP undeclared error when building against newer Linux kernels.
• Fixed corruption bug when running multiple etsilive: input processes concurrently.
• Added new API function (trace_get_errstr()) that provides printable error message strings for a given libtrace error number.
• Increased TTL for nDAG multicast join messages from 1 to 4.

Libtrace 4.0.9

This release fixes a number of bugs in libtrace 4.0.8

• Fixed traceanon build error on systems that did not have libcrypto installed.
• Fixed DPDK detection in configure when the DPDK package was installed on either Debian buster and Ubuntu disco.
• Updated DPDK code to compile against more recent DPDK releases, such as 18.11.
• Fixed segmentation fault when failing to open a DAG device.
• Fixed issue where a pcapng packet that does not match any of our known data types ends up having an uninitialised data type.
• Fix some compilation errors when using DPDK on FreeBSD (may still be linking problems if you have built DPDK using the ports tree, though).
• Fix infinite decoding loop if libpacketdump sees an SCTP option with a length of zero.

Libtrace 4.0.8

New features

• traceanon is now capable of anonymising RADIUS traffic within packet traces. The anonymisation will obfuscate the data within AVPs that can be considered 'sensitive', including user names, IP addresses and password hashes. Counter fields such as byte and packet counters are by default untouched, but traceanon can be configured to anonymise those as well if required.
• traceanon can now be configured using a YAML configuration file, instead of CLI arguments. This change is due to the increased number of configuration options introduced by the RADIUS anonymisation feature. Instructions on how to write a configuration file can be found on the traceanon manpage, as well as on the traceanon wiki page.

Bug fixes

• Fixed bug where ndag multicast sockets would bind to all addresses on an interface, rather than just the address of the multicast group.
• Fixed segfault that can occur when pausing a trace input that has not been able to create its per packet processing threads for some reason.