Wireshark · Wireshark-dev: [Wireshark-dev] Wireshark 3.2.0 is now available

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

I'm proud to announce the release of Wireshark 3.2.0.


 What is Wireshark?

  Wireshark is the world’s most popular network protocol analyzer. It is
  used for troubleshooting, analysis, development and education.

 What’s New

  This is the last release branch with official support for Windows 7
  and Windows Server 2008 R2.

  Many improvements have been made. See the “New and Updated Features”
  section below for more details.

  New and Updated Features

   The following features are new (or have been significantly updated)
   since version 3.2.0rc2:

     • Minor bug fixes.

   The following features are new (or have been significantly updated)
   since version 3.2.0rc1:

     • Minor bug fixes.

   The following features are new (or have been significantly updated)
   since version 3.1.1:

     • Miscellaneous UI fixes and updates.

     • The macOS installer now ships with Qt 5.12.6. It previously
       shipped with Qt 5.12.5.

   The following features are new (or have been significantly updated)
   since version 3.1.0:

     • Automatic updates are supported on macOS.

     • You can now select multiple packets in the packet list at the
       same time

     • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the
       corresponding menu in “Edit › Copy › As …​”

     • They can be marked/unmarked or ignored/unignored at the same time

     • They can be exported and printed using the corresponding menu
       entries “File › Export Specified Packets”, “File › Export Packet
       Dissections” and “File › Print”

   You can now follow HTTP/2 and QUIC streams.

   You can once again mark and unmark packets using the middle mouse
   button. This feature went missing around 2009 or so.

   The Windows packages are now built using Microsoft Visual Studio
   2019.

   IOGraph automatically adds a graph for the selected display filter if
   no previous graph exists

   Action buttons for the display filter bar may be aligned left via the
   context menu

     • The "Expression…​" toolbar entry has been moved to "Analyze ›
       Display filter Expression …​" as well as to the context menu of
       the display filter toolbar

   Allow extcaps to be loaded from the personal configuration directory

   The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous
   installers shipped with Qt 5.12.4.

   The following features are new (or have been significantly updated)
   since version 3.0.0:

     • You can drag and drop a field to a column header to create a
       column for that field, or to the display filter input to create a
       display filter. If a display filter is applied, the new filter
       can be added using the same rules as “Apply Filter”

     • You can drag and drop a column entry to the display filter to
       create a filter for it.

     • You can import profiles from a .zip archive or an existing
       directory.

     • Dark mode support on macOS and dark theme support on other
       platforms has been improved.

     • Brotli decompression support in HTTP/HTTP2 (requires the brotli
       library).

     • The build system now checks for a SpeexDSP system library
       installation. The bundled Speex resampler code is still provided
       as a fallback.

     • WireGuard decryption can now be enabled through keys embedded in
       a pcapng in addition to the existing key log preference (Bug
       15571[1]).

     • A new tap for extracting credentials from the capture file has
       been added. It can be accessed through the -z credentials option
       in tshark or from the “Tools › Credentials” menu in Wireshark.

     • Editcap can now split files on floating point intervals.

     • Windows .msi packages are now signed using SHA-2[2]. .exe
       installers are still dual-signed using SHA-1 and SHA-2.

     • The “Enabled Protocols” Dialog now only enables, disables and
       inverts protocols based on the set filter selection. The protocol
       type (standard or heuristic) may also be choosen as a filter
       value.

     • Save RTP stream to .au supports any codec with 8000 Hz rate
       supported by Wireshark (shown in RTP player). If save of audio is
       not possible (unsupported codec or rate), silence of same length
       is saved and warning is shown.

     • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter”
       packet list and detail popup menus now show a preview of their
       respective filters.

     • Protobuf files (*.proto) can now be configured to enable more
       precise parsing of serialized Protobuf data (such as gRPC).

     • HTTP2 support streaming mode reassembly. To use this feature,
       subdissectors can register itself to "streaming_content_type"
       dissector table and return pinfo→desegment_len and
       pinfo→desegment_offset to tell HTTP2 when to start and how many
       additional bytes requires when next called.

     • The message of stream gRPC method can now be parsed with
       supporting of HTTP2 streaming mode reassembly feature.

     • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4.
       Previous installers shipped with Qt 5.12.1.

  New Protocol Support

   3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell
   Broadcast Service Protocol (cbsp), Asynchronous Management Protocol
   (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh
   Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol
   IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo,
   Diagnostic Log and Trace (DLT), Distributed Replicated Block Device
   (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO
   Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File
   Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices
   (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP
   (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message -
   DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System
   Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband
   Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM
   Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM
   Transceiver control and data), Scalable service-Oriented MiddlewarE
   over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour
   Awareness Networking (NAN)

  Updated Protocol Support

   Too many protocols have been updated to list here.

  New and Updated Capture File Support

   3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump,
   Endace ERF, NetScaler, pcapng, and Savvius *Peek

 Getting Wireshark

  Wireshark source code and installation packages are available from
  https://www.wireshark.org/download.html.

  Vendor-supplied Packages

   Most Linux and Unix vendors supply their own Wireshark packages. You
   can usually install or upgrade Wireshark using the package management
   system specific to that platform. A list of third-party packages can
   be found on the download page[3] on the Wireshark web site.

 File Locations

  Wireshark and TShark look in several different locations for
  preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These
  locations vary from platform to platform. You can use About→Folders to
  find the default locations on your system.

 Getting Help

  The User’s Guide, manual pages and various other documentation can be
  found at https://www.wireshark.org/docs/

  Community support is available on Wireshark’s Q&A site[4] and on the
  wireshark-users mailing list. Subscription information and archives
  for all of Wireshark’s mailing lists can be found on the web site[5].

  Bugs and feature requests can be reported on the bug tracker[6].

 Frequently Asked Questions

  A complete FAQ is available on the Wireshark web site[7].

  Last updated 2019-12-18 18:28:45 UTC

 References

   1. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15571
   2. https://support.microsoft.com/en-us/help/4472027/2019-sha-2-code-s
  igning-support-requirement-for-windows-and-wsus
   3. https://www.wireshark.org/download.html#thirdparty
   4. https://ask.wireshark.org/
   5. https://www.wireshark.org/lists/
   6. https://bugs.wireshark.org/
   7. https://www.wireshark.org/faq.html


Digests

wireshark-3.2.0.tar.xz: 31550972 bytes
SHA256(wireshark-3.2.0.tar.xz)=4cfd33a19a454ff4002243e9d04d6afd64280a109a21ae652a192f2be2b1b66c
RIPEMD160(wireshark-3.2.0.tar.xz)=cb8aab36143465b6e7e8121bc2cbdc8c315494a7
SHA1(wireshark-3.2.0.tar.xz)=6c7d9784809fb16b57ca557864f78509aaf4f82a

Wireshark-win32-3.2.0.exe: 63919160 bytes
SHA256(Wireshark-win32-3.2.0.exe)=a2e8a26ea751477fd3b26ddc755e27be1c91746ef115324f4c51c0b009e46740
RIPEMD160(Wireshark-win32-3.2.0.exe)=13478816e67f172da86a03840da88a4750daf487
SHA1(Wireshark-win32-3.2.0.exe)=128b13aa651a6323bc89cbef8cbd8407c6e70294

Wireshark-win64-3.2.0.exe: 69147616 bytes
SHA256(Wireshark-win64-3.2.0.exe)=373af8674889b446412fb4c34f9b0299c66724086343238ea2b3a99e9e8d80d7
RIPEMD160(Wireshark-win64-3.2.0.exe)=914d2b45fe48324df973ccac68db4e2fd9ed8f35
SHA1(Wireshark-win64-3.2.0.exe)=7c81840143c3a065795873b7237e5add6131e957

Wireshark-win64-3.2.0.msi: 48230400 bytes
SHA256(Wireshark-win64-3.2.0.msi)=35f03abd34817ed05919bdc2609b52185bade17cdab2ffbf8bac395c640b5e99
RIPEMD160(Wireshark-win64-3.2.0.msi)=bf018d18f7f624f3fb2f056bc6ce94d939028b8e
SHA1(Wireshark-win64-3.2.0.msi)=9931b56a62fb46fc005196da2b219287a283fbbe

Wireshark-win32-3.2.0.msi: 42917888 bytes
SHA256(Wireshark-win32-3.2.0.msi)=5d2bbe7cf71bd9f1a717765ce4058f69a7df552813d7c4cf424ac896c4bc0ec8
RIPEMD160(Wireshark-win32-3.2.0.msi)=806aa3938de437d23f04e965a8128764fb9b9f99
SHA1(Wireshark-win32-3.2.0.msi)=561440ae0f2067f8d099028c2e86ad5ae8547218

WiresharkPortable_3.2.0.paf.exe: 36523736 bytes
SHA256(WiresharkPortable_3.2.0.paf.exe)=dcf2f54b574ea1c5378993f6d50ece0aed78ca30057f8a74a291373a4fc2530f
RIPEMD160(WiresharkPortable_3.2.0.paf.exe)=46aeac519c32325c3f947f783c0588415fd36726
SHA1(WiresharkPortable_3.2.0.paf.exe)=d942f10b7854f40ef8102d8d8a00983707f1b8e6

Wireshark 3.2.0 Intel 64.dmg: 96319887 bytes
SHA256(Wireshark 3.2.0 Intel 64.dmg)=a1f5b86d3ae8a2be38db218d07ad1d123315433292adae71a9756bbc881438ee
RIPEMD160(Wireshark 3.2.0 Intel 64.dmg)=e2fcd24a57e93e43bbe0cd7e4ea8768af13c45da
SHA1(Wireshark 3.2.0 Intel 64.dmg)=d8ec239ffb70a6eab7e6cde9668674f7fec2d01d

You can validate these hashes using the following commands (among others):

    Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256
    Linux (GNU Coreutils): sha256sum wireshark-x.y.z.tar.xz
    macOS: shasum -a 256 "Wireshark x.y.z Intel 64.dmg"
    Other: openssl sha256 wireshark-x.y.z.tar.xz

Attachment: signature.asc
Description: OpenPGP digital signature