Table of Contents
Wireshark is the world's most popular network protocol analyzer. It is used for troubleshooting, analysis, development, and education.
The following vulnerabilities have been fixed. See the security advisory for details and a workaround.
Wireshark could crash when dissecting an HTTP chunked response. (Bug 1394)
Versions affected: 0.99.5
On some systems, Wireshark could crash while reading iSeries capture files. (Bug 1415)
Versions affected: 0.10.14 to 0.99.5
Wireshark could exhaust system memory while reading a malformed DCP ETSI packet. (Bug 1264)
Versions affected: 0.99.5
Wireshark could loop excessively while reading a malformed SSL packet. (Bug 1582)
Versions affected: 0.8.20 to 0.99.5
The DHCP/BOOTP dissector was susceptible to an off-by-one error. (Bug 1416)
Versions affected: 0.10.17 to 0.99.5
Wireshark could loop excessively while reading a malformed MMS packet. (Bug 1342)
Versions affected: 0.10.12 to 0.99.5
The following bugs have been fixed:
WEP decryption would only work for the first key specified. disappear or become unusable. WEP and WPA decryption didn't work for QoS frames. WPA decryption failed if EAPOL handshake packets contained extra data. Wireshark failed to parse colon-separated WEP keys.
Merging files in Wireshark now appends files properly.
Wireshark could hang while saving an RTP stream with bad timestamp data.
You must now explicitly pass "--disable-wireshark" to the build environment if you only want to build TShark; the configure script will fail, rather than automatically building only TShark, if it's run on a system that doesn't have GTK+ headers and libraries installed.
Capture from named pipes (via
-i \\<server>\pipe\<pipename>) now works under Windows.The
frame.time_deltadisplay filter now works as expected, matching the delta time between the current and previous captured packet. A new filter,frame.time_delta_displayed, matches the delta time between the current and previous displayed packet.
The following features are new (or have been significantly updated) since the last release:
You no longer have to restart Wireshark after changing column preferences. Woohoo!
You can now export HTTP objects via File→Export→Objects→HTTP.
Display filter macros are now supported.
Right-clicking on a packet lets you copy many more things, such as the packet summary and the packet bytes.
You can now match upper- and lower-case text with the
containsoperator, e.g.upper(http.request.method) contains "GET".A great deal of code has been cleaned up, including fixing many compiler errors. Many thanks to those who worked on this.
AMQP (Advanced Message Queueing Protocol), BCTP Q.1990, Borland StarTeam, Cisco ERSPAN, CTDB (Cluster TDB), DRDA (Distributed Relational Database Architecture), DTPT (DeskTop PassThrough), EPMD (Erlang Port Mapper Daemon), FCoE (Fibre Channel over Ethernet), Firebird/Interbase (replaces the old Interbase dissector), FMP (File Mapping Protocol), H.248.10, H.248.7, IPsec/ISAKMP over TCP, Kingfisher, MIKEY (Multimedia Internet KEYing), MPEG, NSRP (Juniper Netscreen Redundant Protocol), OpcUa Binary Protocol, PPI (Per-Packet Information header), Q.932, QSIG, TAPA (Trapeze Access Point Access Protocol), WiMAX, WiMAX M2M
ACSE, AFP, AMR, ANSI IS-801, ANSI MAP, ARP, ASAP, ASN.1 BER, ASN.1 PER, AVS WLANCAP, BSSAP, BSSGP, BVLC, Camel, CDT, CIP, CMS, COPS, CPFI, DCCP, DCERPC (DCERPC, ATSVC, DFS, EFS, EVENTLOG, INITSHUTDOWN, NDR, NETLOGON, NSPI, NT, PNIO, SAMR, SPOOLSS, SRVSVC, WINREG, WKSSVC, WZCSVC), DCOM (DCOM, CBA, CBA-ACCO), DCP ETSI, DCP, DCT2000, DHCP, DIAMETER, DMP, DNP, DTLS, EDP, ENRP, EPL, ERF, FCELS, Fibre Channel, FTAM, FTBP, FW-1, GIOP, GSM MAP, GTP, H.223, H.225, H.235, H.245, H.248, H.263, HTTP, IAX2, IEEE 802.11, IGRP, INAP, IP, IPsec, IPv6, iSCSI, ISUP, IUA, IuUP, Juniper, JXTA, K12, Kerberos, L2TP, LDAP, LLDP, LWAPP, M3UA, MEGACO, MIP, MMS, MP2T, MTP3, NBAP, NDMP, Netflow, NFS, NT SONMP, OICQ, OSPF, PANA, PN-PTCP, PPP, P_Mul, Radiotap, RADIUS (Packetcable), RANAP, Redback, RNSAP, RRLP, RSVP, RTCP, RTP, RX, SCCP, SCSI (SCSI, MMC, OSD, SBC, SMC, SSC), SCTP, SDP, SIGCOMP, SIP, Skinny, SliMP3, SLL, SMB PIPE, SMB, SMB2, SMPP, SNMP, SPNEGO, SSCOP, SSL, STUN, SUA, Symantec, Syslog, TACACS, TCAP, TCP, TFTP, UDLD, UDP, ULP, UMA, UMTS (UMTS, FP, RRC), USB, VNC, WCP, WLCCP, X.25, X.411, X.509, YMSG
Wireshark source code and installation packages are available from the download page on the main web site.
Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.
Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About->Folders to find the default locations on your system.
The button is nonfunctional in the file dialogs under Windows. (Bug 942)
Community support is available on the wireshark-users mailing list. Subscription information and archives for all of Wireshark's mailing lists can be found on the web site.
Commercial support, training, and development services are available from CACE Technologies.
A complete FAQ is available on the Wireshark web site.
Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products.
Packet Analysis Made Easy
- Visually rich, powerful LAN analyzer
- Quickly access very large pcap files
- Professional, customizable reports
- Advanced triggers and alerts
- Fully integrated with Wireshark
