CHANGELOG · WhoB companion versions noted per release
4.01WhoB 4.01
Fixed interface selection on hosts with many network interfaces (VPN tunnels, virtual machine bridges): the interface list was truncated, so LFT could pick a device with no IPv4 address and report “ioctl: Can’t assign requested address” with no replies.
lft -v and whob -v print their version to standard output.
./configure --without-cares and --without-ncurses now disable the feature instead of asking for a path.
4.0WhoB 4.0
IPv6 support
IPv6 tracing. LFT now traces IPv6 paths end to end using the same default TCP method it uses for IPv4. The address family is matched to the target; -4 and -6 force a family, and a bare IPv6 literal or the bracketed [address]:port form selects IPv6 with a port.
IPv6 addresses print in RFC 5952 shorthand by default; --expand-addr shows the fully expanded eight-group form.
Reverse DNS, whois (ASN, network name, and organization via pWhoIs, Team Cymru, RADB, and RIPE RIS), and the IANA special-purpose registry now resolve IPv6 hops. WhoB likewise accepts IPv6 addresses and host names.
IPv6 Path MTU Discovery via ICMPv6 Packet Too Big, honoring the 1280-octet minimum link MTU.
Loose source routing (gateway waypoints) is rejected for IPv6, which has no equivalent IP option (and loose source routing has largely stopped being accepted across the Internet regardless).
Path discovery and timing
New --ecmp: expose ECMP (equal-cost multi-path) members. Varies the source port per probe and sends more probes per replied hop, so the parallel next hops at a load-balanced hop are all discovered and shown as a diamond in the text, GraphViz (-g), --svg, and --mermaid output. Silent hops are unaffected. Off by default; TCP and UDP.
Retries to an unanswered hop now use a fresh source port per attempt (TCP; attempt one keeps the hop’s stable port). Middleboxes that suppress same-flow duplicates answer each retry, recovering hops previously reported [neglected]. UDP’s fixed 5-tuple is unchanged.
A hop with more than one RTT sample is now summarized as min/avg/max ±stddev in integer milliseconds (e.g. “12/17/20 ±2ms”) instead of listing each round-trip time separated by slashes. The ± sets the standard deviation apart so it cannot be misread as a fourth sample; “~” replaces ± on non-UTF-8 terminals. A single-sample hop still shows the one decimal value, and each responder in an --ecmp diamond is summarized on its own line. Applies to standard text, --ecmp member lines, and the -o/-j chart; watch mode labels jitter in its own column.
Diagram output
New --svg: emit a self-contained, styled SVG diagram of the completed trace. It uses the same device iconography and classification as GraphViz output (source, routers, AS and network seams, stateful and flag-based firewalls, cloaked no-reply hops, and the open/closed/filtered target), draws one card per hop top to bottom, and embeds the glyphs so no external icon files are needed — it renders in any SVG viewer or browser.
New --mermaid: emit a styled Mermaid “flowchart TB” definition of the trace, with per-hop node shapes by role and per-type classDef coloring. Renders directly on platforms with native Mermaid support (such as GitHub) or in any Mermaid live editor.
Refreshed the GraphViz node icons with a new resolution-independent vector icon set (authored as SVG, exported to the 72x72 and 144x144 raster sizes the renderer consumes). The set is coherent and cleanly licensed, replacing the previous mixed raster artwork.
New --show-seams: autonomous-system and network seam boundaries are now hidden by default across all output — the standard text and XML output, the GraphViz (-g), SVG (--svg), Mermaid (--mermaid), and ASCII (-o) diagrams, and watch mode. --show-seams reveals them, seam verification (-y) enables them automatically, and in watch mode the “s” key toggles them live (alongside “h” for hostnames).
The SVG diagram wraps long hostnames across multiple lines so fully-qualified names no longer overrun the fixed-width hop card.
Verbose and machine-readable output
Verbose SENT/RCVD lines: per-probe ports (PORTS=src->dst) on TCP and UDP in all modes including IPv6, per-probe RTT= on all RCVD lines, SEQ/PSEQ moved to line end, ICMP TYPE=/CODE= tags normalized to uppercase; XML gains sport/dport/rtt attributes.
XML output now escapes host and network names so externally supplied text is well-formed.
XML output (-x) now begins with an <?xml version="1.0" encoding="UTF-8"?> declaration before the <lft> root element, and the root now carries schema="lft-xml" schema_version="1" so parsers can check the format they are reading. The document was already well-formed; the prolog makes the encoding explicit for strict parsers.
New --json and --json-pretty: emit the trace as a JSON document (compact or indented) for jq, dashboards and scripts: run metadata, source, target, result, and one object per TTL with every responder's ASN, network name and RTT statistics. Silent TTLs and ECMP members are represented explicitly. See OUTPUT FORMATS in lft(8).
New --geojson and --kml: the trace on a map (-A is implied). Every located responder becomes a point (GeoJSON, RFC 7946) with the --json hop fields plus city, region and country; each pair of located hops becomes a great-circle segment carrying distance, RTT delta, AS change and the silent or unlocated TTLs it spans. A hop whose RTT is below the speed-of-light floor for its distance is kept but flagged as implausibly located. KML (OGC KML 2.2) opens in any KML viewer with labelled placemarks, an attribute table per hop and arched paths. --geo-color RRGGBB|rtt, --geo-width N and --geo-arc F style the path.
Colorized output (WhoB)
WhoB colorizes its pWhoIs output when writing to an interactive terminal; output to a file or pipe is unchanged. The palette adapts to a light or dark terminal background and uses 24-bit color where available.
Colorization covers every pWhoIs view: the default lookup, the route tables (-a, -A) with the queried ASN highlighted in each AS-Path, the server status (-s), the full record (type=all) and the JSON forms.
New --color and --no-color force colorization on or off in both WhoB and LFT (-o).
Text annotation (WhoB)
New -e / --enrich / --annotate[=FILE]: WhoB acts as a filter, writing its input back out with every IPv4 or IPv6 address followed by "[ASn Org-Name]" from pWhoIs ("[?]" when unrouted). Ports, prefixes and bracketed IPv6 are left intact, and each distinct address is looked up once. -F/--fields chooses what the annotation shows (ASN, org, AS org, net name, prefix, city/region/country). Pairs with any tool: traceroute, mtr, nmap, tcpdump, netstat, firewall logs.
Security hardening
Hardening across the packet parsers, whois client, and privilege handling: the classifier validates the IP version and every ICMP/ICMPv6 quoted-packet header is bounds-checked against the captured length before use; the 802.1Q VLAN offset is computed per packet instead of persisted across the trace; the raw-socket privilege drop is now unconditional and verified; a stale or spoofed segment from a non-target source can no longer be misfiled onto a probe; and the whois response parser is hardened against field over-reads and memory leaks. Details in SECURITY.md.
Fixed a one-byte heap buffer overflow while building the pWhoIs application-identifier string for -A/-N bulk ASN and network lookups: an operator-precedence error in the buffer sizing under-allocated by one byte. Benign on older C libraries, it aborted with “buffer overflow detected” under _FORTIFY_SOURCE on current glibc (e.g. Ubuntu 24.04), so -A and -N crashed on those systems. The buffer is now sized correctly and filled with a bounded snprintf.
Build and portability
Asynchronous DNS via c-ares now works with the version most distributions ship, not only c-ares 1.34+. LFT previously required the 1.34 event-model API (ares_process_fds) and silently fell back to synchronous resolution on older c-ares (Debian/Ubuntu ship 1.27, RHEL similar). It now uses the 1.34+ event API when present and the classic ares_process poll API otherwise, so installing the packaged libc-ares-dev is enough to enable async DNS. The event-API probe is now a link test that calls ares_process_fds, so a newer header shadowing an older linked library (common when a hand-built c-ares sits in /usr/local alongside the distribution package) is detected correctly and falls back to the classic API instead of producing a binary that fails to link.
3.99WhoB 3.99
New -B / --tcp-options: send a realistic client TCP option set (MSS, SACK-permitted, timestamps, window scale) on SYN probes so they resemble a real operating system's SYN instead of a bare, option-less one. Firewalls that normalize or scrub TCP may drop option-less SYNs; -B helps LFT traverse them. Default and adaptive TCP engines only; off by default, and it changes only the packets on the wire, not LFT's output.
TCP, UDP, and ICMP traces no longer count silent near hops (TTL 1-3) toward the early give-up threshold. A stateful firewall or ICMP rate policer at the local edge often suppresses the first few hops even when the path core and the target respond; excluding them lets LFT probe far enough to reach a live hop and complete the trace instead of bailing early. A genuinely dead path still terminates normally.
whob now honors a target given on the command line even when its standard input is redirected from an empty or closed source (for example `whob host </dev/null`, or when run from a script or cron). Previously a readable-but-empty stdin made whob switch to bulk-input mode and ignore the argv target, producing no output. Piped input (`echo host | whob`) and explicit `-f -` are unaffected.
Build hardening for the setuid-root binary: compiled with stack-smashing protection, fortified library calls, position-independent execution, and read-only relocations, applied automatically where the toolchain supports them. Negligible runtime cost.
LFT now aborts if the post-socket setuid() privilege drop fails, rather than continuing with root privileges.
Fixed a null format argument in a whois "no reply" message and an AS-number buffer that truncated 10-digit AS numbers.
Fixed -D with an IP address: an inverted interface-lookup check rejected a valid local IP as unknown, and a missing-braces else ran the device-name assignments unconditionally. -D now works with either a device name or a local interface IP (the send device is set in both cases).
Makefile now lists the shared headers (lft_lib.h, lft_types.h, lft_queue.h, lft_lsrr.h) as dependencies of every object file, so editing a header recompiles all objects. Previously a header-only change could leave stale objects linked with mismatched struct layout.
Source-port selection reworked for stateful-firewall traversal. One-shot TCP traces now use a distinct source port per hop by default, so each TTL is a separate 5-tuple and a stateful firewall cannot rate-limit the trace as one flow. -s N fixes one source port for every hop, overriding the default and -z. -z uses one consistent random source port for the whole trace (the previous default behavior), keeping all hops on one ECMP path. Watch mode holds the source port constant within each cycle and rotates it between cycles, preserving per-cycle ECMP consistency while presenting a fresh flow each cycle. Per-hop variation is TCP only.
The watch-mode interval may now be given in the detached form (-W 5 / --watch 5), as the manual page always implied. Previously only -W5 / --watch=5 took effect; the detached value silently became a stray argument and the interval fell back to the 5-second default.
Watch-mode topology inheritance no longer tightens probe pacing (scatter_ms) in narrowed cycles. The 5 ms clamp quadrupled the send rate once the path was learned, tripping per-source ICMP rate-limit policers on backbone routers and showing 50-73% phantom loss on far hops that measured 0% with --no-learn. Narrowed cycles now keep the standard adaptive pacing; TTL narrowing, pipeline widening, and the adaptive timeout are unchanged.
Fixed watch-mode ASN/NETNAME/ORGNAME columns showing the first public hop's whois data for every subsequent hop: the shared pWhoIs session's consolidated fields are write-once until reset, and the per-query reset was missing, so the first successful lookup's values were inherited by all later hops. Each hop now gets its own lookup result.
Watch mode now displays the ASN/NETNAME/ORGNAME columns by default ([w] toggles them off); previously they appeared only when -A or -N was given.
Fixed TCP watch-mode cycles losing target replies behind stateful middleboxes (CGNAT/pf/conntrack): probe sequence numbers restarted from the session ISN each cycle, so once topology inheritance narrowed the probe count, the target SYN was re-sent with a lower sequence number on the same 4-tuple and middleboxes silently dropped it as out-of-window. The ISN base now advances by the prior cycle's probe count at each reset, keeping sequence numbers monotonic across cycles. The 5-tuple (and thus ECMP path selection) is unchanged; UDP's fixed IP-ID base is unaffected.
Watch mode path-change detection rebuilt as a proper heuristic. Detection now arms only after the path has been learned (path length stable for 3 cycles, or 8 cycles at most), requires a changed hop to persist for two observed cycles before alerting, and tolerates multipath: a hop alternating among addresses already seen at the same TTL is an "ECMP shift", not a path change. Only confirmed changes flash the status bar; flaps, ECMP shifts (capped at three log lines per hop), and path-length changes are quiet log-drawer entries, each prefixed with its cycle number. A confirmed change resets that hop's multipath memory so a later reversion to the old path alerts as a route restore. Cloaked cycles ('*') neither advance nor cancel a pending change, so reroutes on rate-limited hops still confirm. The 'c' (full clear) key re-enters the learning period.
Duplicate target-hop lines from ahead-limit overshoot are now suppressed in all probe modes. When -a is large enough, probes at TTLs beyond the target also reach it and each was printed as an additional [target open] (or [replied]) line. The report loop in finish() already guarded this; the same found_target guard is now in tcp_base_finish() (lft_btcptrace.c) and icmp_finish() (lft_icmptrace.c), so only the first target hop line is emitted regardless of protocol.
Reverse-DNS retry for unresolved hops in watch mode: the per-IP dns_cache now tracks attempts and in-flight state per entry. A PTR lookup that timed out on an early cycle is retried on later cycles (up to 3 attempts total) instead of leaving the hostname blank for the life of the session; IPs that genuinely have no PTR record stop being queried after the cap, preserving the no-redundant-queries behavior of the persistent cache.
3.98WhoB 3.98
Build fixes for Linux: lft_watch.c now explicitly includes <sys/ioctl.h> for struct winsize and TIOCGWINSZ. These were pulled in transitively on macOS but not on Linux glibc, breaking the build of --watch support out-of-the-box on Linux.
whob link line cleaned up: the whob CLI tool no longer drag-links the ncurses libraries (it never used them). Makefile / Makefile.in now define WHOB_LIBS = $(filter-out -lncurses -lncursesw,$(LIBS)) and use it in the whob target. c-ares stays in the whob link since whois.c uses it for the server-prefetch async resolver path.
3.97WhoB 3.97
watch-mode UDP ECMP stability across cycles: watch_reset_session no longer zeros sess->seq_start between cycles, preserving the IP-ID base that UDP probes embed for ECMP flow-hash consistency. Without this, each watch cycle re-randomized the IP-ID base and took a different ECMP branch on multi-path networks, defeating the 3.97 UDP ECMP-stability fix. TCP (sport) and ICMP (icmp_initial_seq anchor) were already preserved correctly.
watch-mode hop count indicator no longer over-counts: with noisy>=2 (forced in watch mode for the log drawer), EVT_RECV_PACKET formerly incremented the live hop counter for every responding TTL including ahead-limit overshoot replies past the target; the handler now recounts from hop_info[] capped at num_hops+1, matching EVT_PROGRESS_OK. The watch status-bar peak counter (max_hops_seen) is now set to the current cycle's n_hops rather than maximized, so it cannot get sticky after a short path follows a long one.
watch-mode topology inheritance (--watch / -W): the first cycle is a conventional broad scan, but once the path length and RTT envelope have been stable for three consecutive cycles, subsequent cycles narrow ttl_limit to learned_num_hops + learn_margin (default 2), widen ahead_limit to the full known path width (capped at 16 to stay friendly to per-source ICMP rate limits), shrink timeout_ms to max(8 * max_observed_rtt, 200 ms), and tighten scatter_ms to 5. Auto-tune resets immediately if a cycle misses the target or the probe protocol changes, reverting to broad-scan defaults until the path stabilizes again. --no-learn disables the feature entirely; --learn-margin N (0 to 10) tunes the TTL probe margin above the learned path length.
UDP probe ECMP flow-hash stability: all probes in a UDP trace session now use a fixed destination port rather than incrementing the port with each TTL (the traditional VJ traceroute approach). Each probe is identified by a pseudorandom session-unique value embedded in the IP ID field; ICMP time-exceeded replies echo this value back in the quoted inner IP header, allowing exact probe-to-reply matching without varying the 5-tuple. The IP ID base is generated the same way as the TCP initial sequence number (rand()), ensuring it is non-zero and session-unique. This keeps every UDP probe on the same ECMP path.
ICMP probe ECMP flow-hash stability: a 2-byte compensation word appended to each ICMP echo payload keeps the ICMP checksum constant across all probes in a session. Because routers hash on the ICMP checksum field as a proxy for the missing port fields, holding the checksum constant ensures all probes follow the same ECMP path.
For completeness, our TCP tracing implementation supported ECMP flow-hash stability (and was the first tool to do this) since 1998.
Added a 'Capabilities' section to the version (-v) output to display the version of libraries against which LFT was linked at compile-time.
3.96WhoB 3.96
rtt-statistics (-j N / --stats=N): per-hop RTT min/avg/max/stddev in all output modes; ASCII art candlestick chart above -o hop diagram; global Y-axis scale; jitter alert (>25 ms delta) highlighted in yellow with annotation; -o auto-activates with default 3 probes; -m/-M override probe count.
Added active Path MTU Discovery: -K / --mtu / --path-mtu starts probes at the local interface MTU (queried via SIOCGIFMTU; 1500 fallback) so that bottleneck links return ICMP "fragmentation needed" (type 3, code 4) messages identifying the path MTU; probe size steps down on each PTB received, using the next-hop MTU value or, for pre-RFC-1191 routers that return zero, the next lower RFC 1191 plateau (65535→32000→17914→8166→4352→2002→1492→1006→ 508→296→68); hops where the path MTU is constrained show [MTU: NNNN] in regular output, as pathmtu="NNNN" in XML, and as a separate row in ASCII art (-o); hops that silently drop oversized DF probes without returning a PTB show [MTU Limit] hop N dropped DF probe (NNNN bytes, no PTB received) immediately after the [neglected] line for that hop; -L is silently ignored when -K is active; documented in lft.8 with PTB terminology explained
Extended active PMTUD (-K) to ICMP probe mode (-p): open_sockets() now queries SIOCGIFMTU and sets sess->userlen for ICMP as it does for TCP/UDP; generateICMPPacket() picks up sess->userlen as the total packet size; PTB (type 3, code 4) responses are intercepted in icmp_process_packet() and handled by lft_pmtud_icmp_handle_ptb() which steps down sess->userlen the same way lft_pmtud_handle_ptb() steps down the TCP/UDP trace_packet template; icmp_check_timeouts() flags timed-out hops as pmtud_blackhole and calls lft_pmtud_verify_blackholes() (now non-static) before icmp_finish(); icmp_finish() emits per-hop [MTU Limit] / [neglected] output matching finish() behaviour; lft.8 -K section updated to reference all three probe protocols and explain the payload-inflation rationale
Migrated c-ares usage from deprecated API to c-ares 1.34+ event model: replaced ares_fds()/ares_process() with ARES_OPT_SOCK_STATE_CB / ares_process_fds() in both lft_lib.c (main trace loop) and whois.c (whois server prefetch); replaced ares_gethostbyname() with ares_getaddrinfo() in whois.c; removed all -Wdeprecated-declarations pragma suppressions; builds cleanly at -std=gnu23 with zero warnings
Annotation labels in -o ASCII art updated: stateful firewall now shows Stateful FW (U+21F6), flag-based filter shows Flag FW (U+2691), BSD TCP anomaly shows BSD Bug (U+21C4), AS boundary shows ASN Seam and network boundary shows NET Seam (both U+2573); plain ASCII fallbacks updated to [Stateful FW], [Flag FW], [BSD Bug] respectively; seam fallbacks retain x-AS-Seam-x / x-Net-Seam-x for compatibility
RTT chart x-axis label now shows end-to-end RTT derived from the target column's own min/max samples (not the global trace min/max), formatted as "End-to-End RTT Nmin–Nmax ms, N hops to proto://address:port" where proto reflects the active probe mode (tcp/udp/icmp) and port is the destination port; falls back to "N hops traced, target unreachable" when target was not reached; lft.8 -j entry updated accordingly
Updated include/win32/wingetopt.c to add getopt_long() implementation (required since 3.95 added getopt_long() throughout lft.c; Windows builds were broken at link time without it); wingetopt.h extended with struct option, no_argument / required_argument / optional_argument constants, getopt_long() declaration, and opterr / optopt globals
Rewrote makefile.vc (formerly auto-generated by the defunct Bakefile tool): now hand-maintained with NPCAP_DIR / CARES_DIR configurable paths, proper Npcap SDK linkage (wpcap.lib Packet.lib), c-ares linkage (cares.lib), correct include search paths, and a DEBUG=1 mode; documents SDK download URLs and quick-start instructions in the header comment
Removed deprecated lft.spec instructions
Updated config/install-sh
Updated config/config.guess and config/config.sub
3.95WhoB 3.95
Replaced gethostbyname()/gethostbyaddr() with getaddrinfo()/getnameinfo() throughout (~50 calls) for modernization and prerequisite for IPv6
Added asynchronous reverse-DNS via c-ares: PTR queries sent for each hop IP as it is revealed by an incoming ICMP time-exceeded response, merged into the existing select() loop via ares_fds()/ares_process(); results are ready by the time the trace completes, eliminating post-trace serial DNS latency (typically 180-260ms savings on a 10-15 hop trace)
Whois library lazy DNS resolution: w_init() registers known server hostnames in a cache but fires no lookups; a new w_prefetch() function resolves a single server on first use via c-ares when w_ask() is called, bypassing the OS resolver (and mDNSResponder on macOS) only for the service actually needed
New -Q flag disables async DNS at runtime without recompiling; documented in --help (under Advanced Resolution Options) and the manpage
-T timing display shows "resolving: X.XXs (async)" label when c-ares handled name resolution during the trace, distinguishing from the synchronous path
configure now probes common third-party prefix directories (/opt/homebrew, /usr/local, /opt/local, /opt/pkg) for both libpcap and c-ares before falling back to AC_CHECK_LIB; ./configure now finds Homebrew-installed c-ares on Apple Silicon without requiring manual LDFLAGS/CPPFLAGS
Added pkg-config support for c-ares detection (mirroring existing pcap path)
Added --with-cares=PATH configure option for manual c-ares path override
Added --disable-async-dns configure option to disable c-ares at build time
All async DNS code guarded by #ifdef HAVE_CARES; builds and runs correctly with or without c-ares installed; -Q is a safe no-op when not compiled in
c-ares initialised with ARES_OPT_TIMEOUTMS=500ms, ARES_OPT_TRIES=2 (1000ms worst-case per host); DNS results are a bonus and never block the trace -- unresolved hops display numerically as before
Updated lft.8 manpage to document -Q and async DNS behavior
Added -o ASCII art hop diagram output: horizontal per-hop columns with Unicode box-drawing headers (┌─ HOP N ─┐) with ASCII fallback ([- HOP N -]); ANSI color auto-detected via TERM/COLORTERM/isatty and suppressed by NO_COLOR; terminal-width-aware row wrapping; SOURCE and TARGET columns with port numbers
Column layout (top to bottom): header, hostname, IP address, AS number (-A), network name (-N), round-trip time, then feature annotation line
Feature labels use needlework and symbolic Unicode glyphs when the terminal supports them, with plain ASCII fallbacks for all annotations: seam boundaries, cloaked hops, firewall anomalies, and target state indicators each have a distinct glyph style in Unicode mode and a readable ASCII equivalent when Unicode is unavailable
Narrowed ICMP unreachable stop behavior: only codes 0 (net), 1 (host), 2 (protocol), 3 (port), 9 (net admin prohibited), 10 (host admin prohibited), and 13 (communication admin prohibited) halt the trace by default; all other codes (4, 5-8, 11-12, 14-15) are recorded but the trace continues; new lft_icmp_stops_trace() static inline helper in lft_lib.h shared between lft_lib.c and lft_btcptrace.c
Adaptive mode (-E/-e) now automatically implies --ignore-unreachables (break_on_icmp=0); the adaptive engine needs to probe through devices that send ICMP unreachables to perform stateful path analysis
Added getopt_long() replacing getopt(); every short flag now has a long-form equivalent (e.g. --dport, --min-probes, --max-hops, --ignore-unreachables, --adaptive, --ascii, --tcp-window); multiple aliases supported where traceroute convention warrants (--min-ttl / --first-hop, --max-hops / --ttl-max, --quiet / --silent, --length / --bytes, --device / --receive-device, --from-device / --source-device); all short flags remain fully backward-compatible
Added -w (--tcp-window) to usage() help text under Advanced Tracing Options and to the manpage; the option existed and functioned but was undocumented in both places
Added "long-form options available, see lft(8)" note to --help output
Fixed manpage: -m and -M descriptions corrected from "re-attempts per host" to "probes per hop"; -M default corrected from 3 to 2 (matching actual code default); "min tll" typo corrected to "min ttl"; "Type of Serice" typo corrected to "Type of Service"
Updated manpage -i description to enumerate the specific ICMP codes that stop the trace by default and note that adaptive mode implies it
Updated manpage -E/e entry to note that adaptive mode implies --ignore-unreachables
Whois and getnameinfo DNS calls now protected by timeout wrappers: w_getaddrinfo_timed() (POSIX: alarm/SIGALRM; Windows: worker thread + WaitForSingleObject/TerminateThread) prevents whois server resolution from stalling the trace indefinitely; lft_getnameinfo_timed() applies the same Windows thread-based ceiling to getnameinfo() calls in the output path
configure now emits a deferred advisory warning (AC_MSG_WARN) when c-ares is not found, displayed at the bottom of configure output; libpcap AC_MSG_ERROR messages updated to consistent style with platform-specific install instructions including macOS Homebrew
Suppressed unresolved [AS?] and [NULL]/[NET?] annotations in -o ASCII art and GraphViz output to avoid cluttering columns where no data is available; regular output retains the annotation but normalises the label from [NULL] to [NET?] for consistency with [AS?]
Added startup privilege check: lft_check_permissions() probes for raw socket access (the same capability pcap requires) before executing the trace; if insufficient, exits immediately with platform-appropriate remediation guidance -- on Linux recommends setcap(8) with setuid-root as a last resort; on macOS/BSD instructs the setuid-root method with the resolved binary path ready to copy-paste; on Windows directs the user to run as Administrator with Npcap installed
3.94WhoB 3.94
Fixed libpcap detection in configure: replaced deprecated pcap_lookupdev() (removed in libpcap 1.10) with pcap_findalldevs(), which is what the code actually calls at runtime via lft_pcap_lookupdev()
Added pkg-config support for libpcap detection, with fallback to manual detection for systems without pkg-config
Fixed memory leak in lft_pcap_lookupdev(): pcap_findalldevs() result list was never freed with pcap_freealldevs()
Updated make install to detect platform (Linux vs. others) and check for root privileges before granting capabilities: on Linux with root, uses setcap(8) to grant cap_net_raw,cap_net_admin without a setuid root binary; falls back to setuid root if setcap is unavailable; warns clearly if install is not run as root; on non-Linux platforms uses setuid root directly
Updated --enable-universal to target arm64 + x86_64 (Apple Silicon + Intel) replacing the obsolete i386 + ppc targets
Improved configure error messages for missing libpcap with platform-specific install instructions
Replaced pcap_open_live() with pcap_create()/pcap_set_snaplen()/ pcap_set_promisc()/pcap_set_timeout()/pcap_activate() for improved error reporting; activation failures now surface via pcap_geterr() with distinct fatal (ERR_PCAP_ACTIVATE_ERROR) and non-fatal (WRN_PCAP_ACTIVATE) paths
Improved raw socket permission error to display platform-appropriate hint for granting required privileges
3.93WhoB 3.93
Updated lft_types.h to reflect some DARWIN (Apple) specifics
3.92WhoB 3.92
Changed lft_types.h to reflect some OpenBSD specifics
Improved feature: 'whob me' and 'whob whoami' to display your public IP
3.78WhoB 3.78
Added feature: 'whob me' to display your current public IP address
3.77WhoB 3.77
Added feature: 'whob -gA' to show all prefixes TRANSITING an ASN Very powerful, much-requested feature! Enjoy Many thanks to Prefix WhoIs team!
3.76WhoB 3.76
Remove compiler warnings using more casts (Victor)
Autoremake ./configure script so everyone has a reasonable default
3.75WhoB 3.75
Improved cross-compiling compatiblity (thanks to Gustavo Z.)
3.74WhoB 3.74
Fixed source port randomizaiton with -z (thanks to Conor M.)
Fixed compilation on OpenBSD (thanks to Renaud A.)
3.71WhoB 3.71
WhoB: Autodetect input from STDIN (pipe) without '-f -'
WhoB: Redirect some extraneous output to STDERR
3.7WhoB 3.7
Added support for 4-byte ASNs
Added support for whob reading bulk input from stdin using '-f -'
3.6WhoB 3.6
Added support for 4-byte ASNs
3.5WhoB 3.5
Roy T. provided DNS speed-ups
Added GraphViz output option with -g
3.35WhoB 3.35
Roy T. provided some clean-ups to avoid double free()s
Bug fixes only
3.33WhoB 3.33
Fixed free(sess->hostname) bug (segfault on unresolvable hostname)
Improved error hanlding of pcap failures related to data link type
Kurt's FreeBSD fix for pcap snprintf
Bug fixes only
3.32WhoB 3.32
Added support for several encapsulating protocols such as PPP
no other changes
3.31WhoB 3.31
Added #define for AI_NUMERICSERV undeclared on some platforms/versions
No other changes
3.3WhoB 3.3
Improved LFT target detection behind firewalls
Updated LFT for newer pcap version defaults
WhoB ignores comments [#,;] in input files
Added LFT option -f to specify fake source address
Applied many, many, many fixes from Juli M. of USA -- Thanks!
Applied many, many, many fixes from Markus Gothe of Sweden -- Thanks!
3.2WhoB 3.2
Added support for 802.1q tagged VLANs
Manual page corrections (thanks to Brett)
WhoB will use Prefix WhoIs for bulk file resolution in Cymru-compatible format with '-c' but Cymru will be used with '-C'
3.1WhoB 3.1
New configure options: --enable-gtod Forces LFT to use gettimeofday() on each packet instead of using the BPF timestamp. This is critical on platforms that have enabled 'fastts' or that do not have high-precision BPF timestamping. --enable-universal generates binaries including both PPC and Intel architecture (for users running Mac OS X/Darwin)
Improved compatibility with NetBSD and Darwin/Mac OS X
Added autoconf support for NetBSD
Improved compatibility with older compilers (thanks to Sean)
Updated autoconf bits and pieces
By popular request, reversed the -g option of WhoB WhoB now uses gigo mode by default unless -g is specified which turns ON its parser and enables the other various options
Completely refactored and now a workable library
LFT has a new (-b) TCP Basic trace method that makes TCP traces NAT-friendly
LFT has a new (-p) ICMP trace method that uses echo requests to trace paths
Many memory issues fixed
Cleanup of several 2.6b5-3.0b features
2.6WhoB 2.6
LFT prints 'open' in the target block if the target dest port is open
LFT indicates the reason it marked ports open/closed in verbose(2) output
LFT prints an asterisk when it retransmits a packet after a timeout
LFT uses Prefix WhoIs (bulk) or RISWHOIS (bulk) for netname resolution
LFT has a new (-u) traditional UDP-based tracing feature
LFT displays start and finish times/dates when using the (-T) option
LFT has a new (-U) feature to display all times in UTC/GMT0
LFT only shows time spent tracing/resolving at verbosity level 1 or higher
LFT sets the ToS bit on outgoing IP datagrams when (-I) option is used
LFT gets timevals from packets instead of calling gettimeofday()
LFT won't be fooled into thinking there's a firewall on a gateway just because adaptive mode ups the state waiting for replies that never come
Improved LFT performance (removed gettimeofday() on each packet)
WhoB/library uses Prefix WhoIs to resolve OrgNames and NetNames
WhoB/library has improved support for RIPE NCC RIS and Prefix WhoIs
WhoB supports bulk resolution (-f option) from an input file
WhoB also supports one-per-line output (-cf option) from a bulk input file
WhoB will use putenv() on Solaris who is missing setenv() to set TZ
WhoB has a new (-g) feature to take input directly from the command line and print output directly from Prefix WhoIs (referred to as GIGO)
Added $DESTDIR support to Makefile (thanks Daniel)
Fixed an off-by-one bug in LFT related to ASN display encountered when a trace contains one or more neglected TTLs
Fixed an off-by-one bug in LFT's verbose output regarding TTLs
Fixed variable ordering in whois.c from 2.6b1 (thanks Erick)
Numerous platform-specific improvements
Reconfigured autoconf and segregated ./config/
Updated autoconf components to v2.59
2.5WhoB 2.5
Inclusive of betas 2.32 to 2.4x
Added -z option to pseudo-randomize source port
Added behavior to automatically select the most appropriate interface based on routing (this was on the most wanted list)
Added (-P) option to automatically send 3 probes for more stats
Added (-V) lots of verbose debugging information
Added (-F) feature to revert to sending FIN packets
Added (-T) option to show trace and resolution timings (LFT is fast)
Added BSD 4.[23] and derivative (bug) inappropriate TTL detection
Engine: Use sequence numbers as packet ID instead of destination port numbers. This achieves a number of goals: Return ICMP and TCP packets are more uniquely identified. It is now possible to check the route for specific destination port, which is important if route varies based on port (such as with transparent proxying using a load balancing switch on port 80) (thank you Ugen!)
Engine: Send SYN packets. Variety of firewalls and NAT devices won't pass through a single TCP packet that is not a part of established connection, unless it carries SYN flag only (initial packet). Pitfall: this may create useless PCB blocks on destination host, if it does not use SYN cookies or some other SYN flood protection. However it's better then not being able to use lft from behind firewalls. (thank you Ugen!)
Renamed (-H) max hops/ttl option
UI cleaned up in several areas, especially result list & RTT display
Detect local packet filter
Fixed Makefile.solaris (last time we'll see this before autoconf)
added <sockio.h> for Solaris
Default source port is now 53/tcp (dns-xfer)
Configurable source port on command line through -p or host:port
Configurable initial destination port on command line using -d
Source and Destination ports use /etc/services for lookup
Fixed a bug that created a gethostbyaddr() call even when the user specified NOT to do reverse DNS lookups -- makes -n option way faster!
Changed the way lft auto-detects the IP address of the interface selected * now, we determine what address is assigned to the interface instead of just getting the hosts's primary/default address and using it * thanks, Aaron, for bringing this to our attention! * thanks, Lane, for coming up with a platform-independent way of making it work.
added option to suppress status indicator and only show trace (or errors) * people using lft from a web page wanted this
added option to select the network interface used as hop zero * string length of device is tested to avoid potential buffer overflows
modified the status bar to display:
Aaron Bentley (Univ Toronto) tested lft successfully under Debian Woody Linux * Aaron also contributed a variation of net device selection -- thanks
added option to disable reverse DNS host lookups
made several areas slightly more user-friendly
modified the status bar to display:
changed "source" port from tcp/80 to tcp/25
modified initialization of 32-bit unsigned integer used to calculate checksum
fixed round trip time calculation
several other minor tweaks
tested under RedHat Linux, Darwin 5.5 (MacOS X v10.1)