version 2.3.1
-------------

* BUGFIX: if executable was invoked using specific command, path to the
configuration file became invalid. See issue #2.

version 2.3.0
-------------

* Support for sockets (TCP/UNIX domain) as an alternative to execv(3). This
feature allows remote systems to be notified immediately after event occurs
without unnecessary overhead.

* New configuration options 'notify_sock', 'notify_exec'. If set to true,
'notify_sock' sends notification message (FILTER_NAME:EVT) to all connected
clients via TCP socket (configured with option '-l' on program's invocation),
'notify_exec' executes content of event hooks. Both options can be set
simultaneously. By default socket notification is disabled.

* Command-line option names has been changed, long options are supported.

* Running `make install` not only copies compiled binary into target directory
but it also sets file capabilities with `setcap`. This allows to run the
binary without root privileges.

* New option '-m' (--accept-max) which overrides default value for maximum
number of concurrent client connections on socket.

* Working directory is set to match directory name where configuration file is
located. This allows to use @include statement in the configuration file
referencing included files by their relative path.

version 2.2.1
-------------

* Carry out the command expansion only once for each event, at program start.

version 2.2.0
-------------

* Match rule is optional in the filter definition. If no BPF filter is
specified or the option is ommited altogether, capture all traffic on the
interface.

* New event session_error. If there's an error in packet capture, fire up this
event. The event was introduced to act upon interface shutdowns immediatelly.
If this event is triggered before the event 'session_end', it cancels out any
future triggers of 'session_end', until the event 'session_begin' is
triggered again. This event is mandatory. Note that in some cases it is not
possible to restart packet capture.

version 2.1.2
-------------

* System call select(2) replaced by poll(2). The latter system call no longer
limits how many file descriptors can be watched for. This allows users to
define number of filters greater than FD_SETSIZE, which on most GNU/Linux
distributions is 1024.

version 2.1.1
-------------

* Interface shutdown or any other problem causing packet reading to fail is no
longer a reason to kill the daemon.

* Use DLT_IEEE802_11_RADIO link-layer type when monitor mode is enabled.

* Allow users to alter default link-layer type using the configuration option
'link_type'.

version 2.1.0
-------------

* New configuration option 'monitor_mode'. If enabled and supported by the
network interface, IEEE 802.11 wireless LANs management and control frames
will be accessible.

* Specify read timeout using pcap_set_timeout. On some systems, unspecified
timeout caused the select(2) to freeze.

* If no applicable filters are left to use, die instead of useless pooling.

version 2.0.2
-------------

* validation rules for configuration file

* hook execution is done in 'controlled' manner, transparency of the whole
ordeal was increased

* event hooks that failed to execute are not subsequently reexecuted, entire
filter is freed from the memory

* bug fixes and code cleanup


version 2.0
-----------

* Total redesign of previous version. Almost entire code base was replaced or
removed. Version 2.0 no longer relies on POSIX threads, instead it takes
advantage of events triggered on file descriptors, see select(2). Use of
threads was a huge misstep, it not only made a whole program much more
complicated but also more resource consumming.

