23 Apr 2010

This is NFSWATCH Version 4.99.11.  Changes from Version 4.99.10 are:

	- README file converted to utf8
	- Fix compile issues on Solaris and Linux alpha machines
	- Add a ChangeLog file
	- Add TODO note about broken strict aliasing rule

-------------------------------------------------------------------------------

							15 Apr 2009

This is NFSWATCH Version 4.99.10.  Changes from Version 4.99.9 are:

	- use libpcap for packet capturing, thus allowing to monitor NFS
	  traffic also on InfiniBand and other interconnects.
	- Add some TODO items...

-------------------------------------------------------------------------------

							25 May 2007

This is NFSWATCH Version 4.99.9.  Changes from Version 4.99.8 are:

	- Improve filehandle decoding on Linux.
	- Exclude known non-exports instead of guessing exports.
	- Do not handle the second argument of RENAME3 and LINK3,
	  as it doesn't seem to work anyway.

-------------------------------------------------------------------------------

							13 March 2007

This is NFSWATCH Version 4.99.8.  Changes from Version 4.99.7 are:

	- Handle more Linux filehandle's fsid_type
	- Improve parsing of device name and instance number in dlpi

-------------------------------------------------------------------------------

							30 January 2007

This is NFSWATCH Version 4.99.7.  Changes from Version 4.99.6 are:

	- Make per-procedure statistics work for NFSv3
	- Makefile cleanups

-------------------------------------------------------------------------------

							14 June 2006

This is NFSWATCH Version 4.99.6.  Changes from Version 4.99.5 are:

	- Fix buffer overflow problems
	- Compiler warnings cleanup
	- Allow compiling on IRIX (using GCC)

-------------------------------------------------------------------------------

							22 November 2005

This is NFSWATCH Version 4.99.5.  Changes from Version 4.99.4 are:

	- Analyze NFS on TCP
	- Improve total packet count display
	- Allow compiling for 64-bit Solaris
	- Allow compiling for older Solaris releases (5.6 and 5.7)
	- Compiler warnings cleanup

-------------------------------------------------------------------------------

							13 July 2005

This is NFSWATCH Version 4.99.4.  Changes from Version 4.99.3 are:

	- Fix NFS packet counting bug
	- Improve Linux filehandle parsing

-------------------------------------------------------------------------------

							 2 June 2005

This is NFSWATCH Version 4.99.3.  Changes from Version 4.99.2 are:

	- Add xfs to the list of recognized filesystems

-------------------------------------------------------------------------------

							22 April 2005

This is NFSWATCH Version 4.99.2.  Changes from Version 4.99.1 are:

	- Cleanup spec file for Fedora Extras

-------------------------------------------------------------------------------

							25 February 2005

This is NFSWATCH Version 4.99.1.  Changes from Version 4.3 are:

	- Deal with NFSv3 and Linux filehandles

-------------------------------------------------------------------------------

							12 February 1996

This is NFSWATCH Version 4.3.  The only changes from Version 4.2 are:

	- Should now compile properly on Solaris 2.5 (SunOS 5.5).  Thanks
	  to Alexandre Oliva for the patch.  As with Solaris 2.4, expect
	  several warnings on xdr.c.
	
	- Added a patch to let is_exported() on SVR4 deal with symbolic links
	  in /etc/dfs/dfstab.  Thanks to Ronald Hello for the patch.

	- Added a patch to allow NFSWATCH to find out about more local file
	  system types (XFS on IRIX, PCFS and HSFS on SunOS).  Thanks to
	  Andreas Stolcke for the patch.

	- Added a patch to allow NFSwatch to understand Network Appliance
	  FAServer file handles.  Thanks to Guy Harris for the patch.

-------------------------------------------------------------------------------

							31 March 1995

This is NFSWATCH Version 4.2.  The only changes from Version 4.1 are:

	- Should now compile properly on Solaris 2.4 (SunOS 5.4), although
	  you should expect several warnings on xdr.c due to some annoying
	  discrepancies between type definitions.

	- Added a workaround to a bug in Solaris 2.3 that causes
	  screwed up packets when the snapshot length is small.
	
	- Added a patch to fix identification of file system devices
	  in Solaris 2.x.
	
	- Added the "qeN" devices for Sun's SQE board (Quad Ethernet).

-------------------------------------------------------------------------------

							1 December 1993

This is NFSWATCH Version 4.1.  It lets you monitor NFS requests to any given
machine, or the entire local network.  It mostly monitors NFS client traffic
(NFS requests); it also monitors the NFS reply traffic from a server in
order to measure the response time for each RPC.

This is primarily a release to fix bugs that were present in the previous
release.  The following changes and bug fixes have been made since NFSWATCH
4.0:

	- Compiles and runs under Solaris 2.2 and Solaris 2.3.

	- Compiles and runs under DEC OSF/1 V1.3 and later.

	- The NFS procedure display code has been fixed.

	- Now understands Auspex file handles (thanks to Guy Harris).

	- Now understands IRIX file handles (thanks to Jim Patterson).

	- Now saves "-procs" output in the log file (thanks to Gary Schaps).

	- The screendump feature now works properly on Solaris 2.x systems
	  (thanks to Gerry Singleton).

	- The mechanism by which NFS file handles are parsed has been split
	  out into a separate module and completely redesigned.  It is now
	  independent of the platform on which nfswatch is running, and uses
	  a variety of heuristics to figure out what the file handle
	  represents.  Doubtless these heuristics will fail in some cases;
	  we have not been able to test the code against all possible NFS
	  servers.

	  If you find that nfswatch is not properly decoding a file handle
	  from one of your servers (say, foo.bar.com), you can help us out
	  by doing

		% nfswatch -dst foo.bar.com -fhdebug

	  and capturing a page or two of the output.  Then mail it to us,
	  and also tell us exactly what software is running on the server
	  (e.g., "DEC OSF/1 V1.3").  We cannot promise to fix the problem,
	  of course.

The following features and bug fixes appeared in NFSWATCH 4.0:

	- NFSWATCH now runs on Sun SPARC machines under SunOS 5.x (Solaris
	  2.x) using the Data Link Provider Interface (DLPI), dlpi(7).

	- NFSWATCH now runs on Silicon Graphics machines under IRIX 4.0
	  using the snoop(7) interface.  It should also work on versions 3.2
	  and 3.3 (you'll need "-lbsd" on 3.2). Thanks to Tim Hudson of
	  Mincom Pty for the patches.

	- NFSWATCH "almost" works on System V Release 4 systems.  There are
	  some problems with the fact that Solaris 2.x uses DLPI 2.0 (good),
	  but most SVR4s out there still use DLPI 1.3 (bad).  I've had a few
	  beta testers working on it, but they have not yet gotten it to
	  work.  If you manage to get it working, *please* send patches.

	- NFSWATCH now keeps track of timing information in the procedure
	  display, showing how quickly NFS calls receive replies.  Thanks to
	  Peter Phillips of the University of British Columbia for the code.
	  
	- NFSWATCH now has an authenticator display, which shows the username
	  or user id of the originator of each packet.  Thanks again to Peter
	  Phillips for the code.

	- A first pass at support for FDDI interfaces has been added.  The
	  support is better on some systems than others, as described below:

	  IRIX40: Has not been tested, and almost definitely will not work
		  "as is".  The packet header that's read into from snoop
		  probably needs to be different.  Send us patches if you
		  get it to work.

	  SUNOS4: Has been tested on a Sun-4/380 under SunOS 4.1.2.  Works
		  with the SunNet FDDI/DX boards.

	  SUNOS5: Has not been tested, but "should" work.  Send us patches
		  if it doesn't.

	  SVR4:  Has not been tested, but "should" work.  Send us patches if
		  it doesn't.  (And if you get the rest of it working; see
		  above.)

	  ULTRIX: Works with Ultrix V4.2 or later *only*.  All flavors of
		  Ultrix 4.2 (including 4.2A, 4.2B, 4.2C) require kernel
		  patches before you can use the FDDI code.  Obtain the
		  patched versions of net_common.o and pfilt.o from your
		  Customer Support Center.

	- A new option, "-server hostname" has been added to watch all the
	  traffic between a server and its clients; this is equivalent to
	  "src == hostname || dst == hostname", which is not specifiable
	  using the other options.  Thanks again to Peter Phillips for the
	  patches.

	- A new option, "-map", is available to help translate file system
	  device names to "english" names, e.g. "/usr" instead of
	  "fs1(7,23)".  Thanks yet again to Peter Phillips.

	- Two new options have been added to allow NFSWATCH to be run from
	  cron, via rsh, etc.  The "-bg" option tells NFSWATCH to run in the
	  background, with no screen display.  All information will be put
	  into the logfile only.  The "-T maxtime" option tells NFSWATCH to
	  terminate execution after maxtime seconds.

	- A new interactive command has been added.  The "n" command toggles
	  the display of client names or client host numbers in client mode,
	  so that foreign hosts can be identified.

	- The maximum number of client hosts for a single server has been
	  increased to 512.  The maximum number of internet addresses for a
	  single host has been increased to 16.  The maximum number of
	  interfaces that can be watched at one time has been increased to
	  16.

	- The bug in which file matching did not work on Sun-3 systems has
	  been fixed.

	- The bug in which the standard input got closed upon exit, making
	  the curses routines screw up, has been fixed.

	- The bug causing miscompilation of nit.c on SunOS 4.0 has been
	  fixed.

	- Note that due to limitations in the SVR4 DLPI, the ethernet broad-
	  cast, arp, and rarp packet counters will not be supported.  Also
	  note that on SVR4s still using DLPI 1.3, which does not support
	  promiscuous mode, the "-all" and "-dst" options to NFSWATCH will
	  not work.

NFSWATCH has been successfully compiled and at least minimally tested on the
following architectures and operating systems:

	Architecture		Operating System
	------------		----------------
	Sun-3 (68000)		SunOS 4.1.1
	Sun-4 (SPARC)		SunOS 4.1.1, 4.1.2, 4.1.3
	Sun-4 (SPARC)		SunOS 5.1, 5.2, 5.3

	DEC VAX			Ultrix 4.0, 4.1, 4.2
	DEC RISC		Ultrix 4.0, 4.1, 4.2
	DEC Alpha AXP		DEC OSF/1 V1.3 and later

	SGI Personal IRIS	IRIX 4.0.1
	SGI 4D/440		IRIX 4.0.5

To compile NFSWATCH, just say "make."  The Makefile will use the "uname"
command to determine what operating system should be compiled for.  If for
some reason this blows up in your face, say "make OS=foo" where "foo" is one
of the following:

	Macro Value		Operating System
	-----------		----------------
	IRIX40			Silicon Graphics IRIX 4.0
	SUNOS4			Sun Microsystems SunOS 4.x
	SUNOS5			Sun Microsystems SunOS 5.x (Solaris 2.x)
	SVR4			AT&T System V Release 4
	ULTRIX			Digital Equipment Ultrix 4.x
	DECOSF			Digital Equipment Corp. OSF/1 V1.3 & later

On Sun systems, NFSWATCH needs to either be run as root, or made setuid root
(this is safe; it setuids itself back after opening the needed device).  On
Ultrix systems, it does not need to be setuid root or run as root, but the
super-user has to enable promiscuous mode operation using pfconfig(8).  On
SGI systems, it needs to be either run as root or made setuid to root.  On
SVR4 systems, it needs to be either run as root or made setuid to root.

On pre-4.2 Ultrix systems, the enclosed "pfcopyall" program can be used to
change the value of the "pfcopyall" variable in the kernel so that you can
see packets sent by the host you are running on.  Otherwise, these packets
will not be included in the output of NFSWATCH.

You can redistribute this program as much as you want.  All we ask is that
you give credit where credit is due.  If you make modifications or bug fixes,
please send them back to us, in "diff -c" format, so they can be incorporated
into the next release.


Original authors (email addresses out of date AFAIK):

Dave Curry					Jeff Mogul
IBM Internet Security Services			Digital Equipment Corp.
Integrated Systems Solutions Corporation	Western Research Laboratory
Long Meadow Road, Mail Stop 223			250 University Avenue
Sterling Forest, NY 10979			Palo Alto, CA 94301
davy@vnet.ibm.com				mogul@wrl.dec.com


Current Maintainer:

Christian Iseli
Ludwig Institute for Cancer Research and
Swiss Institute of Bioinformatics
Bâtiment Génopode, Université de Lausanne
CH-1015 Lausanne, Switzerland
c4chris@users.sourceforge.net