changes

一个很好用的linux 下的流量监控软件

CHANGES File for IPTraf 3.0.0

Changes to IPTraf 2.7.0 and new features in IPTraf 3.0.0

	New filter behavior.  Except for TCP traffic in the IP traffic
	monitor, filters now do not automatically match reverse packets
	for TCP and UDP IPTraf-wide.  Rather, each filter entry has
	a field which tells IPTraf whether to match packets flowing
	in the direction opposite that specified.

	The filters for non-TCP, non-UDP IP traffic (ICMP, IGRP, OSPF,
	etc.) which never automatically matched packets flowing in the
	opposite direction, now have that same option field.  This way
	related packets (like ICMP echo request/echo reply) can be
	matched with a single entry.

	Because reverse-matching is no longer the default IPTraf-wide,
	the labels are now changed to read Source and Destination.

        Default value for blank address filter fields is now 0.0.0.0,
	rather than 255.255.255.255. Fields are therefore no longer
	pre-filled with 0.0.0.0.

	Miscellaneous IP filter entries feature a field for other IP
	protocols not specifically indicated in the dialog.  The user
	must enter a comma-separated list of individual protocols or a 
	range.  IP protocols are defined in the /etc/protocols file.

	The IP traffic monitor consults the /etc/protocols file for 
	miscellaneous IP packets for the protocol names.  Previously
	recognized protocols (ICMP, UDP, OSPF, etc) are still looked up 
	internally for performance reasons.

        The filter rule selection now indicates the mask in CIDR format
	(e.g. 10.1.0.0/16) for clarity and to save screen space.

        Filter selection list box is now alphabetically sorted.

	Likewise, the CIDR notation can be used when entering IP address
	data.  However the CIDR notation is translated into a mask and
	discarded.  Subsequent editing of the filter will show the 
	corresponding mask.

	Changed color coding for unknown IP packets (those looked up
	from /etc/services to bright white on blue (instead of yellow on
	red, which looked like "errors").

	Added internal recognition for L2TP, IPSec AH, and IPSec ESP
	packets.

        Changed size of the IP traffic monitor's TCP hash table to 1033
	buckets.  Prime number used to improve hash efficiency.  

	A new function tx_box() has been added to the screen support
	library as a solution to the ncurses box() function not accepting
	the color set by wattrset(), at least on Red Hat 7.3.  All calls
	to box() have been replaced with this tx_box() instead.  It takes
	exactly the same parameters.

	Added support for tun and brg (tunneling and bridging) interfaces.
	Thanks to Marcio Gomes <tecnica_at_microlink.com.br>.

	Modified logging options.  The -L parameter now works with any
	command-line invocation of a facility, even in foreground mode.

	Added -I command-line parameter to override logging interval
	configuration option.

	(Thanks to the contributors of the -I and -L patches. I lost your
 	emails when SEUL reinstalled. Please acknowledge. Thanks.
	
	Corrected promiscuous mode control code.  It ignored Token Ring 
	interfaces.

Changes to IPTraf 2.6.1 and new features in IPTraf 2.7.0

	Corrected bug wherein the detailed interface statistics
	did not filter out the packets based on the selected
	interface.  Thanks to the members of the mailing list for
	this.

	Corrected minor interface name comparison bugs in the
	general interface statistics and TCP/UDP service statistics.

	Corrected stale locks when IPTraf did not start due to an
	improper terminal size.

	Added support for additional DVB interfaces sm2*, sm3*, penta*.

	Added support for wireless LAN interfaces (wlan*, wvlan*).

	Fixed segfault that occurs when /proc/net/dev is empty or
	contains no active interfaces.  Thanks to Chris Armstrong 
	<wolfwings_at_zana.changa.nu> for actually trying it out.

	Added error box to handle the /proc/net/dev error condition
	mentioned above.

	Added error box when tx_operate_listbox is invoked on an empty
	list.
	
Changes to IPTraf 2.6.0

	Corrected a segfault in the IP traffic monitor and TCP/UDP service
	breakdown when a sort is attempted on an empty screen.  Thanks
	to <lord_at_elreyforce.org> for the report.

	Corrected segfaults in the TCP/UDP service monitor when
	scrolling using PgUp and PgDn (or space and '-').  Thanks
	to Ross Gibson <windows_at_prefixservice.com>.

	Corrected post-sorting PgUp problem in TCP/UDP monitor.

	Corrected inaccuracies in the IP traffic monitor's TCP byte
	counts and flow rates.  *** THE BUG ADDRESSED BY THIS CORRECTION
	DEFERS IPTRAF 2.6.0. ***

	Adjusted black-and-white color scheme.

	Minor adjustments to the printlargenumber() function.

	Minor cosmetic adjustments.

New features in IPTraf 2.6.0 and changes to IPTraf 2.5.0

	Added support for Token Ring interfaces.  Thanks to many people
	for help with patches and testing, including J. Kahn Koontz
	<csjmk_at_eiu.edu>, Dan Seto <mail_at_seto.org>, and Tomas Dvorak
	<avatar_at_kanal.ucw.cz>.

        Added support for sbni long-range modem interfaces (Dmitry
        Sergienko <trooper_at_dolphin.unity.net>).

	Added support for Free s/WAN IPSec logical interfaces (Doug Nazar
        <nazard_at_dragoninc.on.ca>).

	Code cleanup.  Got rid of an ugly goto in itrafmon.c.  I hate
	goto no matter what.

	Moved write_timeout_log.c to tcptable.c.

	Recoded the PgUp/PgDn routines in the IP traffic monitor,
	TCP/UDP service monitor, and LAN station monitor.  These
	routines now directly manipulate the table pointers instead
	of merely calling the single-line scrolling routines repeatedly.
	Faster.  More efficient.

	Added a highlight bar to the IP traffic monitor, allowing better
	readability, especially on long-line screens (> 80 characters),
        and individual flow rate computation.

	Added flow rates for the highlighted TCP flows (IP traffic
	monitor) and TCP/UDP ports (TCP/UDP statistical breakdown) I
	believe this is the best way to allow viewing of data rates
	without excessively sacrificing CPU time for packet capture.

        Filters now apply to all facilities except the packet size
	breakdown and LAN station monitor.  You can now view the loads
	and protocol breakdowns on selected packets only using the
	filters.

	No more byte counters in the IP traffic monitor.  This line now
	just contains a simple packet counter at one end, and the TCP
	flow rate information at the other.

	Moved menu, selection listbox, and dialog box functions to a
	separate support/ directory.  These routines are first compiled
	into a library and later on linked into iptraf.

        Added a confirmation box to the main menu's Exit command.  This
	is as much for me as it is for a lot of people.  I accidentaly
	exit too.

	Added broadcast packet and byte counts to the detailed interface
	statistics log.

	Some cosmetic adjustment.

	Added 5-minute timeout for rvnamed child processes.

New features in IPTraf 2.5.0 and changes to IPTraf 2.4.0

	Now includes a more specific dialog for non-TCP and non-UDP
	filters.  Allows specification of packets by source and
	destination IP addresses.

	Better organized the filter management and manipulation
	functions in fltedit.c, fltselect.c, othipflt.c, and utfilter.c.
	
	othfilter.c renamed to fltselect.c, same thing with the .h.

	All filters are now unified in a single data structure allowing
	handling of TCP, UDP, misc IP, and non-IP toggles with one set
	of functions.

	Separate TCP and non-TCP filter menus abolished, everything
	is now grouped under a Filters... submenu under the main menu.

	Corrected wrong placement of timer in the packet size breakdown.

	Corrected scanning code for timed out entries in the IP traffic
	monitor sort function.  Wrong computation for elapsed time
	resulted in active connections being placed in the list of
	closed entries.  Thanks to Gal Laszlo <slowTCP_at_hotmail.com> for
	pointing out the symptom.

        Added support for Frame Relay FRAD/DLCI interfaces.  Thanks to
        Raffaele Gariboldi <lele_at_italynetwork.it> for the information
        and testing.

	Sorting is now done with the Quicksort algorithm.

	IP Traffic Monitor now adds connection entries to the TCP window
	upon the receipt of header-only packets.  There are cases in which
        we have to check for possible TCP scans which are implemented with
        non-SYN packets.

	The reverse DNS lookup function revname() now times out after
        five seconds, and stops reverse lookups for that session in case
        rvnamed dies.

	Added some notes to the packet size breakdown window.

	Moved rvnamed cache index update code such that updating of the
	cache indexes will only be performed once fork() succeeds,
	otherwise, the allocated slot will just be reallocated for
	the next queries.  This is so that should the fork() fail,
	future invocations for that IP address won't have the rvnamed
	parent thinking its resolving when there actually wasn't a child
	performing the resolution.  If the fork() problem condition was
	temporary, the next invocation can still have rvnamed fork() off
	to resolve the address.  This of course assumes the IP address
	hasn't expired from the cache.

	Some cosmetic updates (as always).

	The manual features a new format for the sidebars.  Corrected
	typos and spelling errors.

	iptraf-x.y.z.tar.gz no longer comes with precompiled
	binaries.  However a separate iptraf-x.y.z.i386.bin.tar.gz will
	come only with the precompiled x86 executable programs
	(i386/glibc-2.1/ncurses-5.0).

New features in IPTraf 2.4.0 and changes to IPTraf 2.3.1

	This version now allows multiple instances of the same facility
	in different processes, but only one instance can monitor an
	interface.  Please see the RELEASE-NOTES file.

	As a consequence of the above changes, the default names of the
	logfiles then reflect the instance or interface being
	monitored.  See the RELEASE-NOTES file.
	
	Implemented a dialog box allowing the user to log to a custom
	log file.

	Implemented -L command-line parameter to allow specification of
	the log file name when IPTraf is started with the -B parameter.

	Removed hardcoded UNIX-domain socket name bound by IPTraf, instead
	a socket name is generated from the current time and pid.  Also
        removed hardcoded socket name in rvnamed, to which it directs
        replies to IPTraf.  rvnamed still binds to hardcoded socket names
	though.

	IP Traffic Monitor can optionally display the source MAC addresses
	for LAN-based packets.  Added appropriate configuration item.

	IPTraf now reads /etc/ethers in addition to its own database of
	MAC addresses.  Thanks to Frederic Peters <fpeters_at_debian.org> for
	the patch.

	Moved time-related configuration items to a Timers... submenu to
	save on screen space.

	The version.h file no longer exists, rather, a plain version file
	is in place containing merely the version number.  The Makefile
	reads this file, determines the target machine information
	and passes this data to the compiler with -D parameters.

	Imposed an upper limit of 200 on rvnamed child  processes.
	rvnamed should really not go runaway with a normally-functioning
	DNS server, but I had the good fortune of experiencing a dead DNS
	server while monitoring.  Took my machine down real fast.

	Precompiled executables now require glibc-2.1 dynamic libaries.

	Included a Setup installation script to ease somewhat the
	installation process (installation can still be done the old way
	though).

	Cosmetic/color changes.

	Reflected changes to manual.

Changes to IPTraf 2.3.0

	Fixed segfault bug when sorting is attempted on an empty TCP
	window.  Thanks to Ramon van Elten <mainwave_at_datura.cx> for the
	report and for the assistance in diagnosis.

	Fixed cosmetic error (sort progress window doesn't disappear)
	when attempt is made to sort a TCP window with only 1 entry.
	Thanks again to Ramon for the report.

	Updated some comments.

New features in IPTraf 2.3.0 and changes to IPTraf 2.2.2

	Implemented sorting in the IP traffic monitor, TCP/UDP statistical
	breakdown, and LAN station monitor.  Great thanks go to Gal Laszlo
	<slowTCP_at_hotmail.com> for the patch.  (Note to Gal: I had to do a
	heck of a lot of overhaul, and had to implement a clearer screen
	design, but your patch provided the basis :) Thanks a lot.)

	Implemented better bounds checking in the text input routine.

	Added information boxes to TCP/UDP delete and detach filter
	functions.