I'm proud to announce the release of Wireshark 4.2.0rc3.
This is the third release candidate for Wireshark 4.2.
What is Wireshark?
Wireshark is the world’s most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.
What’s New
Wireshark supports dark mode on Windows.
A Windows installer for Arm64 has been added.
Packet list sorting has been improved.
Wireshark and TShark are now better about generating valid UTF-8
output.
A new display filter feature for filtering raw bytes has been added.
Display filter autocomplete is smarter about not suggesting invalid
syntax.
"Tools › MAC Address Blocks" can lookup a MAC address in the IEEE OUI
registry.
The enterprises, manuf, and services configuration files have been
compiled in for improved start-up times. These files are no longer
available in the master branch in our source code repository. You can
download the manuf file[1] from our automated build directory.
The installation target no longer installs development headers by
default.
The Wireshark installation is relocatable on Linux (and other ELF
platforms with support for relative RPATHs).
Wireshark can be compiled on Windows using MSYS2[2]. Check the
Developer’s guide for instructions.
Wireshark can be cross-compiled for Windows using Linux. Check the
Developer’s guide for instructions.
"Tools › Browser (SSL Keylog)" can launch your web browser with the
SSLKEYLOGFILE environment variable set to the appropriate value.
Windows installer file names now have the format
Wireshark-<version>-<architecture>.exe.
Many other improvements have been made. See the “New and Updated
Features” section below for more details.
Bug Fixes
The following bugs have been fixed:
• Issue 18413[3] - RTP player do not play audio frequently on
Windows builds with Qt6.
• Issue 18510[4] - Playback marker does not move after resume with
Qt6.
New and Updated Features
The following features are new (or have been significantly updated)
since version 4.2.0rc2:
• The Windows installers now ship with Npcap 1.78. They previously
shipped with Npcap 1.77.
The following features are new (or have been significantly updated)
since version 4.2.0rc1:
• The Windows installers now ship with Npcap 1.77. They previously
shipped with Npcap 1.71.
The following features are new (or have been significantly updated)
since version 4.1.0:
• Improved dark mode support.
• The Windows installers now ship with Qt 6.5.3. They previously
shipped with Qt 6.2.3.
The following features are new (or have been significantly updated)
since version 4.0.0:
• The API has been updated to ensure that the dissection engine
produces valid UTF-8 strings.
• Wireshark now builds with Qt6 by default. To use Qt5 instead pass
USE_qt6=OFF to CMake.
• The "ciscodump" extcap supports Cisco IOS XE 17.x.
• The default interval between GUI updates when capturing has been
decreased from 500ms to 100ms, and is now configurable.
• The -n option also now disables IP address geolocation
information lookup in configured MaxMind databases (and
geolocation lookup can be enabled with -Ng.) This is most
relevant for TShark, where geolocation lookups are synchronous.
• The display filter drop-down list is now sorted by "most recently
used" instead of "most recently created".
• Display filter syntax-related changes:
• It is now possible to filter on raw packet data for any field
by using the syntax `@some.field == <bytes…>`. This can be
useful to filter on malformed UTF-8 strings, among other use
cases where it is necessary to look at the field’s raw data.
• Negation (unary minus) now works with any display filter
arithmetic expression.
• Using the slice operator with strings produces a string.
Previously it would produce a byte array. This is useful to
index/slice UTF-8 multibyte strings. String byte slices can still
be obtained using the "@" (raw operator) prefix.
• Arithmetic expressions are allowed as set elements.
• Absolute date and time values can be written as Unix time.
• The limitation where a minus sign needed to be preceded by a
space character has been removed.
• Added XOR logical operator.
• Fixed the implementation of `all … in` membership operator
(#19188[5]).
• When parsing absolute time values the display filter engine
has learned to understand timezones as specified in
strptime(3)[6], including some common North American
designations. Arbitrary timezone names are not supported however.
Previously only ISO8601 offsets and the "UTC" designation was
understood.
• Writing value strings without double quotes is deprecated and
will generate a warning. Value strings are integer or boolean
values that can be represented using a user-friendly textual
format, such as "Set"/"Unset" instead of numerical values like 1
and 0. It is now a requirement that value strings need to be
written enclosed in double-quotes.
• The deprecated ~≃ operator symbol has been removed. It was
replaced by !== in version 4.0.
• Running the test suite requires the pytest[7] Python module. The
emulation layer that allowed running tests without pytest
installed has been removed.
• When saving files or exporting packets after changing their time
with the "Time Shift" dialog, the shifted time is written to the
new file.
• TLS secrets used in decrypting packets can be embedded (or
discarded) from the capture file via the GUI, similar to the
options --inject-secrets and --discard-all-secrets in editcap.
• The text of any configured column (displayed or hidden) can be
filtered anywhere that filters are used - in display filters,
filters in taps, coloring rules, Wireshark read filters, and the
-Y, -R, and -e options to TShark, the "Apply as Filter" GUI
option, etc.
• The filter field names are prefixed by "_ws.col", followed by
a lowercase version of the COL_ name found in
epan/column-utils.h, e.g. "_ws.col.info" or "_ws.col.protocol"
• Using the column names as a filter is slower than other filter
types because the columns must be constructed, so when the same
filtering can be achieved via other fields, prefer that.
• The external name resolution text files "manuf", "enterprises"
and "services" have been removed and replaced with static binary
data. You can dump the respective internal data using `tshark -G
manuf|enterprises|services`.
• The "manuf" file is now also read from the personal configuration
folder, and is profile-based.
• The Lua console dialogs under the Tools menu were refactored and
redesigned. It now consists of a single dialog window for input
and output.
• Wireshark now shows byte units in the statistics in the
user-selected language (uses the system default language by
default).
• Packet list sorting has been improved:
• When sorting packet list with a filter applied, only the
visible packets are sorted, which greatly increases sorting
speed.
• The cache size for column text is limited to a default of
10000 rows, which limits the maximum memory usage. The maximum
value can be changed in Preferences→Appearance→Layout
• Due to the above, columns that require packet dissection can
only be sorted if the number of visible rows is less than the
cache size. If there are more rows visible, a warning will
appear. Columns that do not require packet dissection (those that
calculated directly from the capture file frame headers, such as
packet number, time, and frame length) can be sorted with any
number of visible rows.
• Sorting can be interrupted.
• When changing the dissector via the "Decode As" table for values
that have default dissectors registered, selecting "(none)" will
select no dissection (while still allowing heuristic dissectors
to attempt to dissect.) The previous behavior was to reset the
dissector to the default. To facilitate resetting the dissector,
the default dissector is now sorted at the top of the list of
possible dissector options.
• The personal extcap plugin folder location on Unix has been
changed to follow existing conventions for architecture-dependent
files. The extcap personal folder is now
`$HOME/.local/lib/wireshark/extcap`. Previously it was
`$XDG_CONFIG_HOME/wireshark/extcap`.
• The "init.lua" file is now loaded from any of the Lua plugin
directories. Previously it was loaded from the personal
configuration directory. (For backward-compatibility this is
still allowed; note that deprecated features may be removed in a
future release).
• Installation of development headers must be done explicitly using
the CMake command `cmake --install <builddir> --component
Development`.
• The Windows build has a new SpeexDSP external dependency
(https://www.speex.org). The speex code that was previously
bundled has been removed.
• New `--print-timers` option added to TShark.
Removed Features and Support
• With the addition of the universal and consistent filtering
support for column text, the previous support in the -e option to
TShark for displaying column text via the column title has been
removed in general. Those field names cannot be used elsewhere
(as they may not be legal filter names) and create confusion if
more than one column has the same title or if a column is
renamed. Prefer the column format instead, e.g. "_ws.col.info"
for "_ws.col.Info". However, for backwards compatibility with
existing tools and scripts, the titles of the default columns can
continue to be used with `tshark -e` (but not elsewhere.)
• The bundled script "dtd_gen.lua" that was disabled by default has
been removed from the installation. It can be found in the
Wireshark Wiki under "Contrib"[8].
• The Wi-Fi NAN dissector filter name has been changed from 'nan'
to 'wifi_nan'.
New File Format Decoding Support
RTPDump
New Protocol Support
Aruba UBT, ASAM Capture Module Protocol (CMP), ATSC Link-Layer
Protocol (ALP), DECT DLC protocol layer (DECT-DLC), DECT NWK protocol
layer (DECT-NWK), DECT proprietary Mitel OMM/RFP Protocol (also named
AaMiDe), Digital Object Identifier Resolution Protocol (DO-IRP),
Discard Protocol, FiRa UWB Controller Interface (UCI), FiveCo’s
Register Access Protocol (5CoRAP), Fortinet FortiGate Cluster
Protocol (FGCP), GPS L1 C/A LNAV navigation messages, GSM Radio Link
Protocol (RLP), H.224, High Speed Fahrzeugzugang (HSFZ), Hypertext
Transfer Protocol version 3 (HTTP/3), ID3v2, IEEE 802.1CB (R-TAG),
Iperf3, JSON 3GPP, Low Level Signalling (ATSC3 LLS), Management
Component Transport Protocol (MCTP), Management Component Transport
Protocol - Control Protocol (MCTP CP), Matter home automation
protocol, Microsoft Delivery Optimization, Multi-Drop Bus (MDB),
Non-volatile Memory Express - Management Interface (NVMe-MI) over
MCTP, RDP audio output virtual channel Protocol (rdpsnd), RDP
clipboard redirection channel Protocol (cliprdr), RDP Program virtual
channel Protocol (RAIL), SAP Enqueue Server (SAPEnqueue), SAP GUI
(SAPDiag), SAP HANA SQL Command Network Protocol (SAPHDB), SAP
Internet Graphic Server (SAP IGS), SAP Message Server (SAPMS), SAP
Network Interface (SAPNI), SAP Router (SAPROUTER), SAP Secure Network
Connection (SNC), SBAS L1 Navigation Messages (SBAS L1), SINEC AP1
Protocol (SINEC AP), SMPTE ST2110-20 (Uncompressed Active Video),
Train Real-Time Data Protocol (TRDP), UBX protocol of u-blox GNSS
receivers (UBX), UDP Tracker Protocol for BitTorrent (BT-Tracker),
UWB UCI Protocol, Video Protocol 9 (VP9), VMware HeartBeat, Windows
Delivery Optimization (MS-DO), Z21 LAN Protocol (Z21), Zabbix, ZigBee
Direct (ZBD), and Zigbee TLV
Updated Protocol Support
• JSON: The dissector now has a preference to enable/disable
"unescaping" of string values. By default it is off. Previously
it was always on.
• JSON: The dissector now supports "Display JSON in raw form".
• IPv6: The dissector has a new preference to show some semantic
details about addresses (default off).
• IPv6: The dissector now supports dissecting the Application-aware
IPv6 Networking (APN6) option[9] in the Hop-by-Hop Options Header
(HBH) and Destination Options Header (DOH), including all three
types of APN ID, which are 32-bit, 64-bit and 128-bit in length.
• XML: The dissector now supports display character according to
the "encoding" attribute of the XML declaration, and has a new
preference to set default character encoding for some XML
document without "encoding" attribute.
• SIP: The dissector now has a new preference to set default
charset for displaying the body of SIP messages in raw text view.
• HTTP: The dissector now supports dissecting chunked data in
streaming reassembly mode. Subdissectors of HTTP can register
itself in "streaming_content_type" subdissector table for
enabling streaming reassembly mode while transferring in chunked
encoding. This feature ensures the server stream messages of
GRPC-Web over HTTP/1.1 can be dissected even if the last chunk is
absent.
• The media type dissector table now properly treats media types
and subtypes as case-insensitive automatically, per RFC 6838.
Media types no longer need to be lower cased before registering
or looking up in the table.
• CFM: The dissector has been overhauled and updated to the level
of IEEE std 802.1Q-2022 and ITU-T Rec. G.8013/Y.1371 (08/2015).
This includes dissection of additional PDU types and TLVs as well
as deeper dissection of existing PDUs and TLVs.
Too many other protocol updates have been made to list them all here.
New and Updated Codec support
Adaptive Multi-Rate (AMR), if compiled with opencore-amr[10].
Major API Changes
• Lua function "package.prepend_path" has been removed. If you need
it please consider adding your own package.path customization
code or installing your dependencies in Wireshark’s default
paths.
• The reassemble_streaming_data_and_call_subdissector() API has
been added to provide a simpler way to reassemble the streaming
data of a high level protocol that is not on top of TCP.
• Some of the API now uses C99 types instead of GLib types. Issue
19116[11]
Getting Wireshark
Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.
Vendor-supplied Packages
Most Linux and Unix vendors supply their own Wireshark packages. You
can usually install or upgrade Wireshark using the package management
system specific to that platform. A list of third-party packages can
be found on the download page[12] on the Wireshark web site.
File Locations
Wireshark and TShark look in several different locations for
preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These
locations vary from platform to platform. You can use "Help › About
Wireshark › Folders" or `tshark -G folders` to find the default
locations on your system.
Getting Help
The User’s Guide, manual pages and various other documentation can be
found at https://www.wireshark.org/docs/
Community support is available on Wireshark’s Q&A site[13] and on the
wireshark-users mailing list. Subscription information and archives
for all of Wireshark’s mailing lists can be found on the web site[14].
Bugs and feature requests can be reported on the issue tracker[15].
You can learn protocol analysis and meet Wireshark’s developers at
SharkFest[16].
How You Can Help
The Wireshark Foundation helps as many people as possible understand
their networks as much as possible. You can find out more and donate
at wiresharkfoundation.org[17].
Frequently Asked Questions
A complete FAQ is available on the Wireshark web site[18].
References
1. https://www.wireshark.org/download/automated/data/manuf
2. https://www.msys2.org/
3. https://gitlab.com/wireshark/wireshark/-/issues/18413
4. https://gitlab.com/wireshark/wireshark/-/issues/18510
5. https://gitlab.com/wireshark/wireshark/-/issues/19188
6. https://man.netbsd.org/strptime.3
7. https://pypi.org/project/pytest/
8. https://wiki.wireshark.org/Contrib
9. https://www.ipv6plus.net/Phase3/apn6/
10. https://sourceforge.net/projects/opencore-amr/
11. https://gitlab.com/wireshark/wireshark/-/issues/19116
12. https://www.wireshark.org/download.html
13. https://ask.wireshark.org/
14. https://www.wireshark.org/lists/
15. https://gitlab.com/wireshark/wireshark/-/issues
16. https://sharkfest.wireshark.org
17. https://wiresharkfoundation.org
18. https://www.wireshark.org/faq.html
Digests
wireshark-4.2.0rc3.tar.xz: 44842368 bytes
SHA256(wireshark-4.2.0rc3.tar.xz)=1fa536284c0d084f35c9e67a90f859c347d9f20c458d11baf142f54dabd701ea
SHA1(wireshark-4.2.0rc3.tar.xz)=8189595fb61cb02f304c6a2996a8e3d0e9f5c006
Wireshark-4.2.0rc3-arm64.exe: 67459288 bytes
SHA256(Wireshark-4.2.0rc3-arm64.exe)=51bbd69ffbcd3b246e0000cd902d434f8bfb737686d6378bc1cd05750cb1a5e5
SHA1(Wireshark-4.2.0rc3-arm64.exe)=cafd538c204c36a86e71fed0f23ff40bac7112ea
Wireshark-4.2.0rc3-x64.exe: 85947472 bytes
SHA256(Wireshark-4.2.0rc3-x64.exe)=a3429f76829f25c34179cbbee4c98abc8e510efa9b448d40ab8a5290afef67c5
SHA1(Wireshark-4.2.0rc3-x64.exe)=8077c0f34e5c486230abdf80c1508a7aec531d5a
Wireshark-4.2.0rc3-x64.msi: 62504960 bytes
SHA256(Wireshark-4.2.0rc3-x64.msi)=ad8c7439f7fff3b46e5833b2c336deb21e482087d654f66c73658ec12a887197
SHA1(Wireshark-4.2.0rc3-x64.msi)=d3c691be0e27863944ace3b011436468615587f4
WiresharkPortable64_4.2.0rc3.paf.exe: 53219496 bytes
SHA256(WiresharkPortable64_4.2.0rc3.paf.exe)=5e0172c7512c9a8495ae6177ce735f6e00358d26b6509eb8f0f225cbad5459b3
SHA1(WiresharkPortable64_4.2.0rc3.paf.exe)=d4a757e37a3bf329a4f85dbbd99a8f8a5687e78f
Wireshark 4.2.0rc3 Arm 64.dmg: 63937457 bytes
SHA256(Wireshark 4.2.0rc3 Arm
64.dmg)=14476a223115140a140491ddd7a5af992a5294b96c553c66eefe923cc3d150fb
SHA1(Wireshark 4.2.0rc3 Arm 64.dmg)=b19e98f9a7598847a815b7a5c75baac4799631f1
Wireshark 4.2.0rc3 Intel 64.dmg: 67269204 bytes
SHA256(Wireshark 4.2.0rc3 Intel
64.dmg)=f1117fd122427b4274dfa2e69542833972f4bd151e09953f2bd8b746fe4745da
SHA1(Wireshark 4.2.0rc3 Intel 64.dmg)=4d11e7faf858d11e3e3c675d0c1a68d2767396c0
You can validate these hashes using the following commands (among others):
Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256
Linux (GNU Coreutils): sha256sum wireshark-x.y.z.tar.xz
macOS: shasum -a 256 "Wireshark x.y.z Arm 64.dmg"
Other: openssl sha256 wireshark-x.y.z.tar.xz
OpenPGP_signature.asc
Description: OpenPGP digital signature
___________________________________________________________________________ Sent via: Wireshark-announce mailing list <wireshark-announce@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-announce Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-announce mailto:wireshark-announce-requ...@wireshark.org?subject=unsubscribe
