diff --git a/src/common.c b/src/common.c
index f231c7c..abd847b 100644
--- a/src/common.c
+++ b/src/common.c
@@ -115,7 +115,7 @@ open_dns(int localport, in_addr_t listen_ip)
 	addr.sin_addr.s_addr = listen_ip; 
 
 	if ((fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
-		printf("got fd %d\n", fd);
+		fprintf(stderr, "got fd %d\n", fd);
 		err(1, "socket");
 	}
 
@@ -133,7 +133,7 @@ open_dns(int localport, in_addr_t listen_ip)
 	if(bind(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0) 
 		err(1, "bind");
 
-	printf("Opened UDP socket\n");
+	fprintf(stderr, "Opened UDP socket\n");
 
 	return fd;
 }
@@ -162,12 +162,12 @@ void
 do_detach()
 {
 #ifndef WINDOWS32
-	printf("Detaching from terminal...\n");
+	fprintf(stderr, "Detaching from terminal...\n");
 	daemon(0, 0);
 	umask(0);
 	alarm(0);
 #else
-	printf("Windows version does not support detaching\n");
+	fprintf(stderr, "Windows version does not support detaching\n");
 #endif
 }
 
@@ -188,8 +188,8 @@ read_password(char *buf, size_t len)
 	int i;
 #endif
 
-	printf("Enter password: ");
-	fflush(stdout);
+	fprintf(stderr, "Enter password: ");
+	fflush(stderr);
 #ifndef WINDOWS32
 	scanf("%79s", pwd);
 #else
@@ -204,7 +204,7 @@ read_password(char *buf, size_t len)
 		}
 	}
 #endif
-	printf("\n");
+	fprintf(stderr, "\n");
 
 #ifndef WINDOWS32
 	tcsetattr(0, TCSANOW, &old);	
diff --git a/src/iodine.c b/src/iodine.c
index 7482905..0554382 100644
--- a/src/iodine.c
+++ b/src/iodine.c
@@ -539,7 +539,7 @@ handshake_version(int dns_fd, int *seed)
 					*seed = payload;
 					userid = in[8];
 
-					printf("Version ok, both using protocol v 0x%08x. You are user #%d\n", VERSION, userid);
+					fprintf(stderr, "Version ok, both using protocol v 0x%08x. You are user #%d\n", VERSION, userid);
 					return 0;
 				} else if (strncmp("VNAK", in, 4) == 0) {
 					warnx("You use protocol v 0x%08x, server uses v 0x%08x. Giving up", 
@@ -553,7 +553,7 @@ handshake_version(int dns_fd, int *seed)
 				warnx("did not receive proper login challenge");
 		}
 		
-		printf("Retrying version check...\n");
+		fprintf(stderr, "Retrying version check...\n");
 	}
 	warnx("couldn't connect to server");
 	return 1;
@@ -597,7 +597,7 @@ handshake_login(int dns_fd, int seed)
 			if (read > 0) {
 				int netmask;
 				if (strncmp("LNAK", in, 4) == 0) {
-					printf("Bad password\n");
+					fprintf(stderr, "Bad password\n");
 					return 1;
 				} else if (sscanf(in, "%64[^-]-%64[^-]-%d-%d", 
 					server, client, &mtu, &netmask) == 4) {
@@ -611,12 +611,12 @@ handshake_login(int dns_fd, int seed)
 						warnx("Received handshake with bad data");
 					}
 				} else {
-					printf("Received bad handshake\n");
+					fprintf(stderr, "Received bad handshake\n");
 				}
 			}
 		}
 
-		printf("Retrying login...\n");
+		fprintf(stderr, "Retrying login...\n");
 	}
 	warnx("couldn't login to server");
 	return 1;
@@ -650,7 +650,7 @@ handshake_case_check(int dns_fd)
 			if (read > 0) {
 				if (in[0] == 'z' || in[0] == 'Z') {
 					if (read < (27 * 2)) {
-						printf("Received short case check reply. Will use base32 encoder\n");
+						fprintf(stderr, "Received short case check reply. Will use base32 encoder\n");
 						return;
 					} else {
 						int k;
@@ -666,18 +666,18 @@ handshake_case_check(int dns_fd)
 						return;
 					}
 				} else {
-					printf("Received bad case check reply\n");
+					fprintf(stderr, "Received bad case check reply\n");
 				}
 			} else {
-				printf("Got error on case check, will use base32\n");
+				fprintf(stderr, "Got error on case check, will use base32\n");
 				return;
 			}
 		}
 
-		printf("Retrying case check...\n");
+		fprintf(stderr, "Retrying case check...\n");
 	}
 
-	printf("No reply on case check, continuing\n");
+	fprintf(stderr, "No reply on case check, continuing\n");
 }
 
 static void
@@ -691,7 +691,7 @@ handshake_switch_codec(int dns_fd)
 	int read;
 
 	dataenc = get_base64_encoder();
-	printf("Switching to %s codec\n", dataenc->name);
+	fprintf(stderr, "Switching to %s codec\n", dataenc->name);
 	/* Send to server that this user will use base64 from now on */
 	for (i=0; running && i<5 ;i++) {
 		int bits;
@@ -712,26 +712,26 @@ handshake_switch_codec(int dns_fd)
 			
 			if (read > 0) {
 				if (strncmp("BADLEN", in, 6) == 0) {
-					printf("Server got bad message length. ");
+					fprintf(stderr, "Server got bad message length. ");
 					goto codec_revert;
 				} else if (strncmp("BADIP", in, 5) == 0) {
-					printf("Server rejected sender IP address. ");
+					fprintf(stderr, "Server rejected sender IP address. ");
 					goto codec_revert;
 				} else if (strncmp("BADCODEC", in, 8) == 0) {
-					printf("Server rejected the selected codec. ");
+					fprintf(stderr, "Server rejected the selected codec. ");
 					goto codec_revert;
 				}
 				in[read] = 0; /* zero terminate */
-				printf("Server switched to codec %s\n", in);
+				fprintf(stderr, "Server switched to codec %s\n", in);
 				return;
 			}
 		}
-		printf("Retrying codec switch...\n");
+		fprintf(stderr, "Retrying codec switch...\n");
 	}
-	printf("No reply from server on codec switch. ");
+	fprintf(stderr, "No reply from server on codec switch. ");
 
 codec_revert: 
-	printf("Falling back to base32\n");
+	fprintf(stderr, "Falling back to base32\n");
 	dataenc = get_base32_encoder();
 }
 
@@ -749,7 +749,7 @@ handshake_autoprobe_fragsize(int dns_fd)
 	int max_fragsize = 0;
 
 	max_fragsize = 0;
-	printf("Autoprobing max downstream fragment size... (skip with -m fragsize)\n"); 
+	fprintf(stderr, "Autoprobing max downstream fragment size... (skip with -m fragsize)\n"); 
 	while (running && range > 0 && (range >= 8 || !max_fragsize)) {
 		for (i=0; running && i<3 ;i++) {
 			tv.tv_sec = 1;
@@ -769,8 +769,8 @@ handshake_autoprobe_fragsize(int dns_fd)
 					int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff);
 					if (acked_fragsize == proposed_fragsize) {
 						if (read == proposed_fragsize) {
-							printf("%d ok.. ", acked_fragsize);
-							fflush(stdout);
+							fprintf(stderr, "%d ok.. ", acked_fragsize);
+							fflush(stderr);
 							max_fragsize = acked_fragsize;
 							range >>= 1;
 							proposed_fragsize += range;
@@ -780,30 +780,30 @@ handshake_autoprobe_fragsize(int dns_fd)
 						}
 					}
 					if (strncmp("BADIP", in, 5) == 0) {
-						printf("got BADIP.. ");
-						fflush(stdout);
+						fprintf(stderr, "got BADIP.. ");
+						fflush(stderr);
 					}
 				}
 			}
 		}
 badlen:
-		printf("%d not ok.. ", proposed_fragsize);
-		fflush(stdout);
+		fprintf(stderr, "%d not ok.. ", proposed_fragsize);
+		fflush(stderr);
 		range >>= 1;
 		proposed_fragsize -= range;
 	}
 	if (!running) {
-		printf("\n");
+		fprintf(stderr, "\n");
 		warnx("stopped while autodetecting fragment size (Try probing manually with -m)");
 		return 0;
 	}
 	if (range == 0) {
 		/* Tried all the way down to 2 and found no good size */
-		printf("\n");
+		fprintf(stderr, "\n");
 		warnx("found no accepted fragment size. (Try probing manually with -m)");
 		return 0;
 	}
-	printf("will use %d\n", max_fragsize);
+	fprintf(stderr, "will use %d\n", max_fragsize);
 	return max_fragsize;
 }
 
@@ -817,7 +817,7 @@ handshake_set_fragsize(int dns_fd, int fragsize)
 	int r;
 	int read;
 
-	printf("Setting downstream fragment size to max %d...\n", fragsize);
+	fprintf(stderr, "Setting downstream fragment size to max %d...\n", fragsize);
 	for (i=0; running && i<5 ;i++) {
 		tv.tv_sec = i + 1;
 		tv.tv_usec = 0;
@@ -836,10 +836,10 @@ handshake_set_fragsize(int dns_fd, int fragsize)
 				int accepted_fragsize;
 
 				if (strncmp("BADFRAG", in, 7) == 0) {
-					printf("Server rejected fragsize. Keeping default.");
+					fprintf(stderr, "Server rejected fragsize. Keeping default.");
 					return;
 				} else if (strncmp("BADIP", in, 5) == 0) {
-					printf("Server rejected sender IP address.\n");
+					fprintf(stderr, "Server rejected sender IP address.\n");
 					return;
 				}
 
@@ -847,9 +847,9 @@ handshake_set_fragsize(int dns_fd, int fragsize)
 				return;
 			}
 		}
-		printf("Retrying set fragsize...\n");
+		fprintf(stderr, "Retrying set fragsize...\n");
 	}
-	printf("No reply from server when setting fragsize. Keeping default.\n");
+	fprintf(stderr, "No reply from server when setting fragsize. Keeping default.\n");
 }
 
 static int
@@ -954,7 +954,7 @@ static void
 usage() {
 	extern char *__progname;
 
-	printf("Usage: %s [-v] [-h] [-f] [-u user] [-t chrootdir] [-d device] "
+	fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-u user] [-t chrootdir] [-d device] "
 			"[-P password] [-m maxfragsize] [nameserver] topdomain\n", __progname);
 	exit(2);
 }
@@ -963,19 +963,19 @@ static void
 help() {
 	extern char *__progname;
 
-	printf("iodine IP over DNS tunneling client\n");
-	printf("Usage: %s [-v] [-h] [-f] [-u user] [-t chrootdir] [-d device] "
+	fprintf(stderr, "iodine IP over DNS tunneling client\n");
+	fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-u user] [-t chrootdir] [-d device] "
 			"[-P password] [-m maxfragsize] [nameserver] topdomain\n", __progname);
-	printf("  -v to print version info and exit\n");
-	printf("  -h to print this help and exit\n");
-	printf("  -f to keep running in foreground\n");
-	printf("  -u name to drop privileges and run as user 'name'\n");
-	printf("  -t dir to chroot to directory dir\n");
-	printf("  -d device to set tunnel device name\n");
-	printf("  -P password used for authentication (max 32 chars will be used)\n");
-	printf("  -m maxfragsize, to limit size of downstream packets\n");
-	printf("nameserver is the IP number of the relaying nameserver, if absent /etc/resolv.conf is used\n");
-	printf("topdomain is the FQDN that is delegated to the tunnel endpoint.\n");
+	fprintf(stderr, "  -v to print version info and exit\n");
+	fprintf(stderr, "  -h to print this help and exit\n");
+	fprintf(stderr, "  -f to keep running in foreground\n");
+	fprintf(stderr, "  -u name to drop privileges and run as user 'name'\n");
+	fprintf(stderr, "  -t dir to chroot to directory dir\n");
+	fprintf(stderr, "  -d device to set tunnel device name\n");
+	fprintf(stderr, "  -P password used for authentication (max 32 chars will be used)\n");
+	fprintf(stderr, "  -m maxfragsize, to limit size of downstream packets\n");
+	fprintf(stderr, "nameserver is the IP number of the relaying nameserver, if absent /etc/resolv.conf is used\n");
+	fprintf(stderr, "topdomain is the FQDN that is delegated to the tunnel endpoint.\n");
 
 	exit(0);
 }
@@ -986,8 +986,8 @@ version() {
 
 	svnver = "$Rev$ from $Date$";
 
-	printf("iodine IP over DNS tunneling client\n");
-	printf("SVN version: %s\n", svnver);
+	fprintf(stderr, "iodine IP over DNS tunneling client\n");
+	fprintf(stderr, "SVN version: %s\n", svnver);
 
 	exit(0);
 }
@@ -1139,7 +1139,7 @@ main(int argc, char **argv)
 	if(handshake(dns_fd, autodetect_frag_size, max_downstream_frag_size))
 		goto cleanup2;
 	
-	printf("Sending queries for %s to %s\n", topdomain, nameserv_addr);
+	fprintf(stderr, "Sending queries for %s to %s\n", topdomain, nameserv_addr);
 
 	if (foreground == 0) 
 		do_detach();
diff --git a/src/iodined.c b/src/iodined.c
index d1d1c57..5c03397 100644
--- a/src/iodined.c
+++ b/src/iodined.c
@@ -238,7 +238,7 @@ send_chunk(int dns_fd, int userid) {
 		((users[userid].outpacket.fragment & 15) << 1) | (last & 1);
 
 	if (debug >= 1) {
-		printf("OUT  pkt seq# %d, frag %d (last=%d), offset %d, fragsize %d, total %d, to user %d\n",
+		fprintf(stderr, "OUT  pkt seq# %d, frag %d (last=%d), offset %d, fragsize %d, total %d, to user %d\n",
 			users[userid].outpacket.seqno & 7, users[userid].outpacket.fragment & 15, 
 			last, users[userid].outpacket.offset, datalen, users[userid].outpacket.len, userid);
 	}
@@ -482,7 +482,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len)
 		}
 				
 		if (debug >= 1) {
-			printf("PING pkt from user %d\n", userid);
+			fprintf(stderr, "PING pkt from user %d\n", userid);
 		}
 
 		if (users[userid].q.id != 0) {
@@ -532,7 +532,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len)
 				up_frag <= users[userid].inpacket.fragment) {
 				/* Got repeated old packet, skip it */
 				if (debug >= 1) {
-					printf("IN   pkt seq# %d, frag %d, dropped duplicate\n",
+					fprintf(stderr, "IN   pkt seq# %d, frag %d, dropped duplicate\n",
 						up_seq, up_frag);
 				}
 				/* Update seqno and maybe send immediate response packet */
@@ -557,7 +557,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len)
 			users[userid].inpacket.offset += read;
 
 			if (debug >= 1) {
-				printf("IN   pkt seq# %d, frag %d (last=%d), fragsize %d, total %d, from user %d\n",
+				fprintf(stderr, "IN   pkt seq# %d, frag %d (last=%d), fragsize %d, total %d, from user %d\n",
 					up_seq, up_frag, lastfrag, read, users[userid].inpacket.len, userid);
 			}
 
@@ -583,7 +583,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len)
 						}
 					}
 				} else {
-					printf("Discarded data, uncompress() result: %d\n", ret);
+					fprintf(stderr, "Discarded data, uncompress() result: %d\n", ret);
 				}
 				users[userid].inpacket.len = users[userid].inpacket.offset = 0;
 			}
@@ -608,7 +608,7 @@ handle_ns_request(int dns_fd, struct query *q)
 	if (debug >= 2) {
 		struct sockaddr_in *tempin;
 		tempin = (struct sockaddr_in *) &(q->from);
-		printf("TX: client %s, type %d, name %s, %d bytes NS reply\n", 
+		fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes NS reply\n", 
 			inet_ntoa(tempin->sin_addr), q->type, q->name, len);
 	}
 	if (sendto(dns_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) {
@@ -639,7 +639,7 @@ forward_query(int bind_fd, struct query *q)
 	myaddr->sin_port = htons(bind_port);
 	
 	if (debug >= 2) {
-		printf("TX: NS reply \n");
+		fprintf(stderr, "TX: NS reply \n");
 	}
 
 	if (sendto(bind_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) {
@@ -667,20 +667,20 @@ tunnel_bind(int bind_fd, int dns_fd)
 	id = dns_get_id(packet, r);
 	
 	if (debug >= 2) {
-		printf("RX: Got response on query %u from DNS\n", (id & 0xFFFF));
+		fprintf(stderr, "RX: Got response on query %u from DNS\n", (id & 0xFFFF));
 	}
 
 	/* Get sockaddr from id */
 	fw_query_get(id, &query);
 	if (!query && debug >= 2) {
-		printf("Lost sender of id %u, dropping reply\n", (id & 0xFFFF));
+		fprintf(stderr, "Lost sender of id %u, dropping reply\n", (id & 0xFFFF));
 		return 0;
 	}
 
 	if (debug >= 2) {
 		struct sockaddr_in *in;
 		in = (struct sockaddr_in *) &(query->addr);
-		printf("TX: client %s id %u, %d bytes\n",
+		fprintf(stderr, "TX: client %s id %u, %d bytes\n",
 			inet_ntoa(in->sin_addr), (id & 0xffff), r);
 	}
 	
@@ -707,7 +707,7 @@ tunnel_dns(int tun_fd, int dns_fd, int bind_fd)
 	if (debug >= 2) {
 		struct sockaddr_in *tempin;
 		tempin = (struct sockaddr_in *) &(q.from);
-		printf("RX: client %s, type %d, name %s\n", 
+		fprintf(stderr, "RX: client %s, type %d, name %s\n", 
 			inet_ntoa(tempin->sin_addr), q.type, q.name);
 	}
 	
@@ -878,7 +878,7 @@ write_dns(int fd, struct query *q, char *data, int datalen)
 	if (debug >= 2) {
 		struct sockaddr_in *tempin;
 		tempin = (struct sockaddr_in *) &(q->from);
-		printf("TX: client %s, type %d, name %s, %d bytes data\n", 
+		fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes data\n", 
 			inet_ntoa(tempin->sin_addr), q->type, q->name, datalen);
 	}
 
@@ -889,7 +889,7 @@ static void
 usage() {
 	extern char *__progname;
 
-	printf("Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
+	fprintf(stderr, "Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
 		"[-t chrootdir] [-d device] [-m mtu] "
 		"[-l ip address to listen on] [-p port] [-n external ip] [-b dnsport] [-P password]"
 		" tunnel_ip[/netmask] topdomain\n", __progname);
@@ -900,31 +900,31 @@ static void
 help() {
 	extern char *__progname;
 
-	printf("iodine IP over DNS tunneling server\n");
-	printf("Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
+	fprintf(stderr, "iodine IP over DNS tunneling server\n");
+	fprintf(stderr, "Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
 		"[-t chrootdir] [-d device] [-m mtu] "
 		"[-l ip address to listen on] [-p port] [-n external ip] [-b dnsport] [-P password]"
 		" tunnel_ip[/netmask] topdomain\n", __progname);
-	printf("  -v to print version info and exit\n");
-	printf("  -h to print this help and exit\n");
-	printf("  -c to disable check of client IP/port on each request\n");
-	printf("  -s to skip creating and configuring the tun device, "
+	fprintf(stderr, "  -v to print version info and exit\n");
+	fprintf(stderr, "  -h to print this help and exit\n");
+	fprintf(stderr, "  -c to disable check of client IP/port on each request\n");
+	fprintf(stderr, "  -s to skip creating and configuring the tun device, "
 		"which then has to be created manually\n");
-	printf("  -f to keep running in foreground\n");
-	printf("  -D to increase debug level\n");
-	printf("  -u name to drop privileges and run as user 'name'\n");
-	printf("  -t dir to chroot to directory dir\n");
-	printf("  -d device to set tunnel device name\n");
-	printf("  -m mtu to set tunnel device mtu\n");
-	printf("  -l ip address to listen on for incoming dns traffic "
+	fprintf(stderr, "  -f to keep running in foreground\n");
+	fprintf(stderr, "  -D to increase debug level\n");
+	fprintf(stderr, "  -u name to drop privileges and run as user 'name'\n");
+	fprintf(stderr, "  -t dir to chroot to directory dir\n");
+	fprintf(stderr, "  -d device to set tunnel device name\n");
+	fprintf(stderr, "  -m mtu to set tunnel device mtu\n");
+	fprintf(stderr, "  -l ip address to listen on for incoming dns traffic "
 		"(default 0.0.0.0)\n");
-	printf("  -p port to listen on for incoming dns traffic (default 53)\n");
-	printf("  -n ip to respond with to NS queries\n");
-	printf("  -b port to forward normal DNS queries to (on localhost)\n");
-	printf("  -P password used for authentication (max 32 chars will be used)\n");
-	printf("tunnel_ip is the IP number of the local tunnel interface.\n");
-	printf("   /netmask sets the size of the tunnel network.\n");
-	printf("topdomain is the FQDN that is delegated to this server.\n");
+	fprintf(stderr, "  -p port to listen on for incoming dns traffic (default 53)\n");
+	fprintf(stderr, "  -n ip to respond with to NS queries\n");
+	fprintf(stderr, "  -b port to forward normal DNS queries to (on localhost)\n");
+	fprintf(stderr, "  -P password used for authentication (max 32 chars will be used)\n");
+	fprintf(stderr, "tunnel_ip is the IP number of the local tunnel interface.\n");
+	fprintf(stderr, "   /netmask sets the size of the tunnel network.\n");
+	fprintf(stderr, "topdomain is the FQDN that is delegated to this server.\n");
 	exit(0);
 }
 
@@ -932,8 +932,8 @@ static void
 version() {
 	char *svnver;
 	svnver = "$Rev$ from $Date$";
-	printf("iodine IP over DNS tunneling server\n");
-	printf("SVN version: %s\n", svnver);
+	fprintf(stderr, "iodine IP over DNS tunneling server\n");
+	fprintf(stderr, "SVN version: %s\n", svnver);
 	exit(0);
 }
 
@@ -1112,18 +1112,18 @@ main(int argc, char **argv)
 			usage();
 			/* NOTREACHED */
 		}
-		printf("Requests for domains outside of %s will be forwarded to port %d\n",
+		fprintf(stderr, "Requests for domains outside of %s will be forwarded to port %d\n",
 			topdomain, bind_port);
 	}
 	
 	if (port != 53) {
-		printf("ALERT! Other dns servers expect you to run on port 53.\n");
-		printf("You must manually forward port 53 to port %d for things to work.\n", port);
+		fprintf(stderr, "ALERT! Other dns servers expect you to run on port 53.\n");
+		fprintf(stderr, "You must manually forward port 53 to port %d for things to work.\n", port);
 	}
 
 	if (debug) {
-		printf("Debug level %d enabled, will stay in foreground.\n", debug);
-		printf("Add more -D switches to set higher debug level.\n");
+		fprintf(stderr, "Debug level %d enabled, will stay in foreground.\n", debug);
+		fprintf(stderr, "Add more -D switches to set higher debug level.\n");
 		foreground = 1;
 	}
 
@@ -1160,10 +1160,10 @@ main(int argc, char **argv)
 	created_users = init_users(my_ip, netmask);
 	
 	if (created_users < USERS) {
-		printf("Limiting to %d simultaneous users because of netmask /%d\n",
+		fprintf(stderr, "Limiting to %d simultaneous users because of netmask /%d\n",
 			created_users, netmask);
 	}
-	printf("Listening to dns for domain %s\n", topdomain);
+	fprintf(stderr, "Listening to dns for domain %s\n", topdomain);
 
 	if (foreground == 0) 
 		do_detach();
diff --git a/src/tun.c b/src/tun.c
index eb3e4e2..9d372dc 100644
--- a/src/tun.c
+++ b/src/tun.c
@@ -85,7 +85,7 @@ open_tun(const char *tun_device)
 		if_name[sizeof(if_name)-1] = '\0';
 
 		if (ioctl(tun_fd, TUNSETIFF, (void *) &ifreq) != -1) {
-			printf("Opened %s\n", ifreq.ifr_name);
+			fprintf(stderr, "Opened %s\n", ifreq.ifr_name);
 			return tun_fd;
 		}
 
@@ -98,7 +98,7 @@ open_tun(const char *tun_device)
 			snprintf(ifreq.ifr_name, IFNAMSIZ, "dns%d", i);
 
 			if (ioctl(tun_fd, TUNSETIFF, (void *) &ifreq) != -1) {
-				printf("Opened %s\n", ifreq.ifr_name);
+				fprintf(stderr, "Opened %s\n", ifreq.ifr_name);
 				snprintf(if_name, sizeof(if_name), "dns%d", i);
 				return tun_fd;
 			}
@@ -133,14 +133,14 @@ open_tun(const char *tun_device)
 			return -1;
 		}
 
-		printf("Opened %s\n", tun_name);
+		fprintf(stderr, "Opened %s\n", tun_name);
 		return tun_fd;
 	} else {
 		for (i = 0; i < TUN_MAX_TRY; i++) {
 			snprintf(tun_name, sizeof(tun_name), "/dev/tun%d", i);
 
 			if ((tun_fd = open(tun_name, O_RDWR)) >= 0) {
-				printf("Opened %s\n", tun_name);
+				fprintf(stderr, "Opened %s\n", tun_name);
 				snprintf(if_name, sizeof(if_name), "tun%d", i);
 				return tun_fd;
 			}
@@ -270,7 +270,7 @@ open_tun(const char *tun_device)
 	}
 	
 	snprintf(tapfile, sizeof(tapfile), "%s%s.tap", TAP_DEVICE_SPACE, adapter);
-	printf("Opening device %s\n", tapfile);
+	fprintf(stderr, "Opening device %s\n", tapfile);
 	dev_handle = CreateFile(tapfile, GENERIC_WRITE | GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM | FILE_FLAG_OVERLAPPED, NULL);
 	if (dev_handle == INVALID_HANDLE_VALUE) {
 		return -1;
@@ -394,7 +394,7 @@ tun_setip(const char *ip, int netbits)
 	net.s_addr = htonl(netmask);
 
 	if (inet_addr(ip) == INADDR_NONE) {
-		printf("Invalid IP: %s!\n", ip);
+		fprintf(stderr, "Invalid IP: %s!\n", ip);
 		return 1;
 	}
 #ifndef WINDOWS32
@@ -405,7 +405,7 @@ tun_setip(const char *ip, int netbits)
 			ip,
 			inet_ntoa(net));
 	
-	printf("Setting IP of %s to %s\n", if_name, ip);
+	fprintf(stderr, "Setting IP of %s to %s\n", if_name, ip);
 #ifndef LINUX
 	r = system(cmdline);
 	if(r != 0) {
@@ -415,18 +415,18 @@ tun_setip(const char *ip, int netbits)
 				"/sbin/route add %s/%d %s",
 				ip, netbits, ip);
 	}
-	printf("Adding route %s/%d to %s\n", ip, netbits, ip);
+	fprintf(stderr, "Adding route %s/%d to %s\n", ip, netbits, ip);
 #endif
 	return system(cmdline);
 #else /* WINDOWS32 */
 
 	/* Set device as connected */
-	printf("Enabling interface '%s'\n", if_name);
+	fprintf(stderr, "Enabling interface '%s'\n", if_name);
 	status = 1;
 	r = DeviceIoControl(dev_handle, TAP_IOCTL_SET_MEDIA_STATUS, &status, 
 		sizeof(status), &status, sizeof(status), &len, NULL);
 	if (!r) {
-		printf("Failed to enable interface\n");
+		fprintf(stderr, "Failed to enable interface\n");
 		return -1;
 	}
 	
@@ -442,12 +442,12 @@ tun_setip(const char *ip, int netbits)
 	r = DeviceIoControl(dev_handle, TAP_IOCTL_CONFIG_TUN, &ipdata, 
 		sizeof(ipdata), &ipdata, sizeof(ipdata), &len, NULL);
 	if (!r) {
-		printf("Failed to set interface in TUN mode\n");
+		fprintf(stderr, "Failed to set interface in TUN mode\n");
 		return -1;
 	}
 
 	/* use netsh to set ip address */
-	printf("Setting IP of interface '%s' to %s (can take a few seconds)...\n", if_name, ip);
+	fprintf(stderr, "Setting IP of interface '%s' to %s (can take a few seconds)...\n", if_name, ip);
 	snprintf(cmdline, sizeof(cmdline), "netsh interface ip set address \"%s\" static %s %s",
 		if_name, ip, inet_ntoa(net));
 	return system(cmdline);
@@ -466,7 +466,7 @@ tun_setmtu(const unsigned mtu)
 				if_name,
 				mtu);
 		
-		printf("Setting MTU of %s to %u\n", if_name, mtu);
+		fprintf(stderr, "Setting MTU of %s to %u\n", if_name, mtu);
 		return system(cmdline);
 	} else {
 		warn("MTU out of range: %u\n", mtu);