Table of Contents
Wireshark is the world’s most popular network protocol analyzer. It is used for troubleshooting, analysis, development and education.
The following vulnerabilities have been fixed:
DLL hijacking vulnerability. CVE-2016-2521
ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522
DNP dissector infinite loop. (Bug 11938) CVE-2016-2523
X.509AF dissector crash. (Bug 12002) CVE-2016-2524
HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525
HiQnet dissector crash. (Bug 11983) CVE-2016-2526
3GPP TS 32.423 Trace file parser crash. (Bug 11982) CVE-2016-2527
LBMC dissector crash. (Bug 11984) CVE-2016-2528
iSeries file parser crash. (Bug 11985) CVE-2016-2529
RSL dissector crash. (Bug 11829) CVE-2016-2530 CVE-2016-2531
LLRP dissector crash. (Bug 12048) CVE-2016-2532
Ixia IxVeriWave file parser crash. (Bug 11795)
IEEE 802.11 dissector crash. (Bug 11818)
GSM A-bis OML dissector crash. (Bug 11825)
ASN.1 BER dissector crash. (Bug 12106)
SPICE dissector large loop. (Bug 12151)
NFS dissector crash.
ASN.1 BER dissector crash. (Bug 11822)
The following bugs have been fixed:
- HTTP 302 decoded as TCP when "Allow subdissector to reassemble TCP streams" option is enabled. (Bug 9848)
- Questionable calling of ethernet dissector by encapsulating protocol dissectors. (Bug 9933)
- [Qt & Legacy & probably TShark too] Delta Time Conversation column is empty. (Bug 11559)
- extcap: abort when validating capture filter for DLT 147. (Bug 11656)
- Missing columns in Qt Flow Graph. (Bug 11710)
- Interface list doesn’t show well when the list is very long. (Bug 11733)
- Unable to use saved Capture Filters in Qt UI. (Bug 11836)
- extcap: Capture interface options snaplen, buffer and promiscuous not being used. (Bug 11865)
- Improper RPC reassembly (Bug 11913)
- GTPv1 Dual Stack with one static and one Dynamic IP. (Bug 11945)
- Wireshark 2.0.1 MPLS dissector not decoding payload when control word is present in pseudowire. (Bug 11949)
- "…using this filter" turns white (not green or red). Plus dropdown arrow does nothing. (Bug 11950)
- EIGRP field eigrp.ipv4.destination does not show the correct destination. (Bug 11953)
- tshark -z conv,type[,filter] swapped frame / byte values from / to columns. (Bug 11959)
- The field name nstrace.tcpdbg.tcpack should be nstrace.tcpdbg.tcprtt. (Bug 11964)
- 6LoWPAN IPHC traffic class not decompressed correctly. (Bug 11971)
- Crash with snooping NFS file handles. (Bug 11972)
- 802.11 dissector fails to decrypt some broadcast messages. (Bug 11973)
- Wireshark hangs when adding a new profile. (Bug 11979)
- Issues when closing the application with a running capture without packets. (Bug 11981)
- New Qt UI lacks ability to step through multiple TCP streams with Analyze > Follow > TCP Stream. (Bug 11987)
- GTK: plugin_if_goto_frame causes Access Violation if called before capture file is loaded. (Bug 11989)
- Wireshark 2.0.1 crash on start. (Bug 11992)
- Wi-Fi 4-way handshake 4/4 is displayed as 2/4. (Bug 11994)
- ACN: acn.dmx.data has incorrect type. (Bug 11999)
- editcap packet comment won’t add multiple comments. (Bug 12007)
- DICOM Sequences no longer able to be expanded. (Bug 12011)
- Wrong TCP stream when port numbers are reused. (Bug 12022)
- SSL decryption fails in presence of a Client certificate. (Bug 12042)
- LUA: TVBs backing a data source is freed too early. (Bug 12050)
- PIM: pim.group filter have the same name for IPv4 and IPv6. (Bug 12061)
- Failed to parse M3AP IE (TNL information). (Bug 12070)
- Wrong interpretation of Instance ID value in OSPFv3 packet. (Bug 12072)
- MP2T Dissector does parse RTP properly in 2.0.1. (Bug 12099)
- editcap does not adjust time for frames with absolute timestamp 0 < t < 1 secs. (Bug 12116)
- Guard Interval is not consistent between Radiotap & wlan_radio. (Bug 12123)
- Calling dumpcap -i- results in access violation. (Bug 12143)
- Qt: Friendly Name and Interface Name columns should not be editable. (Bug 12146)
- PPTP GRE call ID not always decoded. (Bug 12149)
- Interface list does not show device description anymore. (Bug 12156)
- Find Packet does not highlight the matching tree item or packet bytes. (Bug 12157)
- "total block length … is too large" error when opening pcapng file with multiple SHB sections. (Bug 12167)
- http.request.full_uri is malformed if an HTTP Proxy is used. (Bug 12176)
- SNMP dissector fails at msgSecurityParameters with long length encoding. (Bug 12181)
Windows installers and PortableApps® packages are now dual signed using SHA-1 and SHA-256 in order to comply with Microsoft Authenticode policy. Windows 7 and Windows Server 2008 R2 users should ensure that update 3123479 is installed. Windows Vista and Windows Server 2008 users should ensure that hotfix 2763674 is installed.
6LoWPAN, ACN, ASN.1 BER, BATADV, DICOM, DNP3, DOCSIS INT-RNG-REQ, E100, EIGRP, GSM A DTAP, GSM SMS, GTP, HiQnet, HTTP, HTTP/2, IEEE 802.11, IKEv2, InfiniBand, IPv4, IPv6, LBMC, LLRP, M3AP, MAC LTE, MP2T, MPLS, NFS, NS Trace, OSPF, PIM, PPTP, RLC LTE, RoHC, RPC, RSL, SNMP, SPICE, SSL, TCP, TRILL, VXLAN, WaveAgent, and X.509AF
3GPP TS 32.423 Trace, iSeries, Ixia IxVeriWave, pcap, and pcapng
Wireshark source code and installation packages are available from https://www.wireshark.org/download.html.
Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.
Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About→Folders to find the default locations on your system.
Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419)
The BER dissector might infinitely loop. (Bug 1516)
Capture filters aren’t applied when capturing from named pipes. (Bug 1814)
Filtering tshark captures with read filters (-R) no longer works. (Bug 2234)
Resolving (Bug 9044) reopens (Bug 3528) so that Wireshark no longer automatically decodes gzip data when following a TCP stream.
Application crash when changing real-time option. (Bug 4035)
Hex pane display issue after startup. (Bug 4056)
Packet list rows are oversized. (Bug 4357)
Wireshark and TShark will display incorrect delta times in some cases. (Bug 4985)
The 64-bit version of Wireshark will leak memory on Windows when the display depth is set to 16 bits (Bug 9914)
Wireshark should let you work with multiple capture files. (Bug 10488)
Dell Backup and Recovery (DBAR) makes many Windows applications crash, including Wireshark. (Bug 12036)
Community support is available on Wireshark’s Q&A site and on the wireshark-users mailing list. Subscription information and archives for all of Wireshark’s mailing lists can be found on the web site.
Official Wireshark training and certification are available from Wireshark University.
A complete FAQ is available on the Wireshark web site.
Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products.
Packet Analysis Made Easy
- Visually rich, powerful LAN analyzer
- Quickly access very large pcap files
- Professional, customizable reports
- Advanced triggers and alerts
- Fully integrated with Wireshark
