Etherman V1.1a
--------------------

The following fixes/updates relate to version 1.0 (the unnumbered release) and
version 1.1a which is the lastest release.

Updates:
--------

- Ported to SGI platforms (under IRIX 4.0.5F on an R3000 Indigo)

- Ported to Solaris 2.x (Dual processor Sparc-10)

- Ported to DEC Alpha OSF/1 platforms

- Decstations, SGI, and Solaris machines can now "see" their own traffic,
  SunOS ( 4.1.x) machines can't.  This is due to a limitation in the SunOS
  4.1.x Network Interface Tap.

- Ultrix binaries *NO LONGER* have to be run as root.  The provisos are
  as follows:

                - non-root execution
                    - always possible
                    - on 4.2x, may lose excessive packets
                    - on 4.3, may lose excessive packets unless
                        unofficial kernel patch to pfilt.o is installed
                - root execution
                    - on 4.2x, should lose fewer packets
                    - not necessary with patched 4.3 kernel
		    - works well on patched or unpatched (4.x) kernel.

  If you use 4.3 (ONLY), you can install a kernel patch avaliable from
  gatekeeper.dec.com:/pub/.../pfilt.o which will fix a limitation in the
  current implementation.  This patch is *UNOFFICIAL* and had comes with NO
  warrenties of any kind.  If you don't wan't to hack on your kernel, root
  execution works equally well as non-root with a patched kernel.
  The patch will also potentially improve the throughput of other
  packetfilter applications such as Tcpdump, NFSwatch, etc., running as a
  NON-superuser (the patch offers no benefits to people who always run these
  type of applications as root).

  The Ultrix Packetfilter will allow non-root users to access network traffic
  if it is configured to do so.  Under Ultrix the command to allow normal
  users to access the packetfilter is (as root):

	# /usr/etc/pfconfig <device> +promisc +copyall -backlog 255

  See pfconfig(8c) for further details.

  NOTE that this command will work without the said kernel patch and will
  report a correct max backlog of 255 packets, but will only allow a backlog
  of 32 packets for non-superuser descriptors on an unpatched kernel which is
  not the correct figure of 255.

  Please do not send mail asking why non-root execution cannot be done under
  SunOS, it can't be done!

  Also keep in mind that this lets all of you users access raw network
  data if they know how (which isn't real hard).

- The Solaris version *DOES NOT* have to be run as root, but you must
  change the permissions of your pseudo-device packetfilter if you don't
  wish to run as root.  

- The 400 ethers/hostnames limitation has been removed.  A hashtable has taken
  the place of the original ethers array so that the number of entries in
  your /etc/ethers file can be arbitrary.  It has been brought to my
  attention that the format of the /etc/ethers file my cause problems under
  SunOS.  I use the format "XX:XX:XX:XX:XX:XX	host", but formats with only
  one hex number separating the colons may cause the ether_line() routine
  to incorrectly parse the ethernet address.  This in turn caused some
  hosts not to have a corresponding hostname and be displayed by their ethernet
  address only.  The routine has been re-written from the orignal man page
  specs by Dan Mosedale (mosedale@genome.stanford.edu).

- Statistics box now contains a new field displaying the number of packets
  dropped by the packetfilter.  This is a good indicator as to whether
  etherman is giving you an accurate picture as to the state of your network.
  For Ultrix users running as non-root with an unpatched kernel, you will
  be able you use the dropped figure to give you an idea as to how
  comprehensive your monitoring system capabilities are.  In the ideal
  scenario you would have no dropped packets.

- A new menu option has been added under the misc menu -- short protocol
  summary.  This option is intended for use with a netman tool which
  is yet to be released.

New resources:
--------------
- Etherman-1.0 had a list of resources that didn't work, they do now.

- The path for "manf.codes" is now configurable from the applications
  default file "Etherman.ad" through the resource "Etherman.manfCodes".
  The default resource is:

	Etherman.manfCodes:	./manf.codes

- The font path for the hershey libraries can be specified by the resource
  "Etherman.fontPath".  The default resource is:

	Etherman.fontPath:	/usr/local/lib/hershey

  Note that this overrides the HFONTLIB environment variable.

- A resource called "secondaryEthers" has been added.  This resource specifies
  a path by which a secondary ethers file may be placed.  This has been
  implemented for those people who do not wish for their "secret" ethernet
  addresses be made publicly available by either /etc/ethers or ypcat ethers.
  The default value is:

	Etherman.secondaryEthers:

- A new resource called "visualType" has been added to allow you to specify
  what type of display you have.  If this resource is left blank, etherman
  will auto-detect the display type and set it for you.  The new flags
  ( -mono, -color, -colour, -gray, -grey) may be used to overide these
  settings.  Note that greyscale is not properly supported.  The default
  is:

	Etherman.visualType:

- A new resource called "pageType" has been added to allow the selection
  of the page size of a postscript dump.  Only two selections are vaild
  ( A4, US_letter), with the default resource being:

	Etherman.pageType:	A4

- Another resource called "colourDump" can be used to toggle the generation
  of colour postscript dumps.  Only two selections are vaild ( True, False ),
  with the default resource being:

	Etherman.colourDump:	False
  
- The original release of etherman contains a hardcoded table which specified
  the colour codes of dominant protocols.  This has been changed into a user
  specified table via a resource called "protoColours".  The format for this
  table is:

	lower_ID upper_ID	"protocol name"		X_colour_name

  The lower_ID and upper_ID fields specify the respective lower and upper
  ethernet frame identifiers on which to class the protocol.  "protocol name"
  is any quoted string that will be used in the protocol key.  X_colour_name
  is any X11 colour identifier which can usually be found in rgb.txt.  Note
  that the #xxxxx notation may also be used to specify a colour.  The default
  lookup table is as follows:

	Etherman.protoColours: \
		0x0000 0x05DC   "IEEE 802.3 Length"     Pink \
		0x0800 0x0800   "IP"                    Red \
		0x0806 0x0806   "ARP"                   Green \
		0x0bad 0x0baf   "Banyan Systems"        Yellow \
		0x6000 0x6009   "DEC protocols"         Blue \
		0x8014 0x8014   "SGI net games"         brown \
		0x8019 0x8019   "Apollo DOMAIN"         PeachPuff \
		0x8035 0x8035   "RARP"                  Cornflowerblue \
		0x8037 0x8037   "IPX"                   LimeGreen \
		0x809b 0x809b   "EtherTalk"             Magenta \
		0x80F3 0x80F3   "AARP"                  orange \
		0x8137 0x8138   "Novell"                Cyan \
		0x9001 0x9003   "3Com"                  aquamarine \
		0x0000 0xffff   "Other"                 Grey70


  Note that the \'s are needed to continue a line.  A hard limit of 20 entrys
  applies to this table.  The upper_ID and lower_ID may be used to group
  protocols as in the "DEC protocols" example above.  The table is searched
  in a linear fashion, so the first match on ethernet frame ID will be used
  to colour the link.  If you think of it as a switch, you will note that the
  "Other" protocol is analogous to a default case.

- The maximum timeout for a host/link can be specified by the "maxTimeout"
  resource.  The defaut (float) value is:

	Etherman.maxTimeout:		100.0

- The path for the postscript dump file can be specified with the 
  "psdumpFile" resource.  The default resource is:

	Etherman.psdumpFile:		./network_dumps.ps

- The path for the protocol summaries file can be specified with the
  "dumpFile resource.  The default resource is:

	Etherman.dumpFile:		./etherman_comms_summaries.txt

- The path for the short dump file can be specified with the
  "shortdumpFile resource.  The default resource is:

	Etherman.shortdumpFile:		./etherman_short_summaries.txt

- The dimensions of the display (in pixels) can be specified with the
  "screenWidth" and "screenHeight" resources.  The default resources are:

	Etherman.screenWidth:		900
	Etherman.screenHeight:		790

Bug fixes:
----------

- The Xtoolkit options processing has been fixed up.  Several new flags
  have been added (please see updated manpage).  No longer cores on
  bogus options :-)

- The filterType resource is checked when etherman is started.  This means
  that commands like "etherman -xrm 'Etherman.filterType:udprwho'" are now
  possible.  Check Etherman.ad for a list of possibilities.

- Minor bugs in display routines:
	- when "by packets" was selected, text was not positioned correctly.
	- Dominant protocols were selected (by packets) regardless of how
	  you were displaying.

- Major bugs in display routines:
	- Radius of the destination was being increased with each packet
	  resulting in a "bar-bell" type effect.

- Minor bugs in ps dumps.

- IP multicasts are now recognised but they are only handled at ethernet
  level, that is, no attempt has been made to resolve hostnames into
  multicast groups or determine which hosts received and processed a
  multicast packet at IP level.  Future maybe :-)

- All IP Protocols listed in RFC 1340 (Assigned Numbers) are now recognised!
  This means that those of you who continually received annoying messages
  like "PROTOCOL IP/77 UNKNOWN", ypu will no longer see these appearing.  If
  Etherman finds an unassigned number (generally IP/99 - 254), it will
  generate a diagnostic message informing you of such a protocol.

- 802.3 packets are now recognised correctly (see notes on protoColours).
  Unfortunately 802.3 packets are not decoded so you cannot distinguish
  between say Novell and AppleTalk traffic under 802.3 framing.

- Most of the warning messages have been cleaned up (including failed ioctls
  etc.).

misc:
-----

- Several requests were received to incorporate the "xvertext" or "libXrot"
  libraries into etherman.  Although I was successful into grafting the calls
  into vogl and making it work, the display was *SLOWER* than the current
  version with the hershey font libraries.  The only advantages I could see
  was that you could configure an X font into etherman and it looked nicer.
  Because we have had so many complaints about the speed of etherman (ie.
  it chokes my system), I decided to revert back to hershey.

- You can rename "Etherman.ad" to "Etherman" and put it in your standard
  apps-defaults directory.  The ".ad" is for development only, that is, when
  it gets converted to a ".h" file for fallback resources, it doesn't
  overwrite "Etherman.h" (not that there is such a file anyway, but it gets
  confusing).  In general /usr/local/lib/X11/app-defaults.

- Greyscale support has not been completed.

- The protocol summary is wrong; only protocols that are known by etherman
  are included...  this needs work work.
