1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
Wireshark 2.4.0rc2 Release Notes
This is the first release candidate for Wireshark 2.4.0.
__________________________________________________________________
What is Wireshark?
Wireshark is the world's most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.
__________________________________________________________________
What's New
New and Updated Features
The following features are new (or have been significantly updated)
since version 2.2.0:
* Experimental 32-bit and 64-bit Windows Installer (.msi) packages
are available. It is recommended that you use these independently
of the NSIS (.exe) installers. That is, you should make sure the
NSIS package is completely uninstalled before installing the
Windows Installer package and vice-versa.
* Source packages are now compressed using xz instead of bzip2.
* The legacy (GTK+) UI is disabled by default in the Windows
installer.
* The legacy (GTK+) UI is disabled by default in Autotools and CMake.
* SS7 Point Codes can now be resolved into names with a hosts-like
file.
* Wireshark can now go fullscreen to have more room for packets.
* TShark can now export objects like the other GUI interfaces.
* Support for G.722 and G.726 codecs in the RTP Player (via the
SpanDSP library).
* You can now choose the output device when playing RTP streams.
* Added support for dissectors to include a unit name natively in
their hf field. A field can now automatically append "seconds" or
"ms" to its value without additional printf-style APIs.
* The Default profile can now be reset to default values.
* You can move back and forth in the selection history in the Qt UI.
* IEEE 802.15.4 dissector now uses an UAT for decryption keys. The
original decryption key preference has been obsoleted.
* Extcap utilities can now provide configuration for a GUI interface
toolbar to control the extcap utility while capturing.
* Extcap utilities can now validate the capture filter.
* Display filter function len() can now be used on all string and
byte fields.
* Added timeline view for 802.11 wireless packet data.
New Protocol Support
Bluetooth HCI Vendor Intel, CAN FD, Citrix NetScaler Metric Exchange
Protocol, Citrix NetScaler RPC Protocol, DirectPlay 8 protocol,
Ericsson A-bis P-GSL, Ericsson A-bis TFP (Traffic Forwarding Protocol),
Facebook Zero, Fc00/cjdns Protocol, Generic Netlink (genl), GSM Osmux,
GSMTAP based logging, Health Level 7 (HL7), High-speed SECS message
service (HSMS), HomePNA, IndigoCare iCall protocol, IndigoCare Netrix
protocol, iPerf2, ISO 15765, Linux 802.11 Netlink (nl80211), Local
Service Discovery (LSD), M2 Application Protocol, Mesh Link
Establishment (MLE), MUDURL, Netgear Ensemble Protocol, NetScaler HA
Protocol, NetScaler Metric Exchange Protocol, NetScaler RPC Protocol,
NM protocol, Nordic BLE Sniffer, NVMe, NVMe Fabrics RDMA, OBD-II PIDs,
OpenThread simulator, RFTap Protocol, SCTE-35 Digital Program Insertion
Messages, Snort Post-dissector, Thread CoAP, UDP based FTP w/ multicast
(UFTP and UFTP4), Unified Diagnostic Services (UDS), vSocket, Windows
Cluster Management API (clusapi), and X-Rite i1 Display Pro (and
derivatives) USB protocol
Updated Protocol Support
Too many protocols have been updated to list here.
New and Updated Capture File Support
ERF, IxVeriWave, Libpcap, and Pcap-ng
IEEE802.11: wlan_mgt display filter element got renamed to wlan.
Libgcrypt is now a required dependency.
__________________________________________________________________
Getting Wireshark
Wireshark source code and installation packages are available from
[1]https://www.wireshark.org/download.html.
Vendor-supplied Packages
Most Linux and Unix vendors supply their own Wireshark packages. You
can usually install or upgrade Wireshark using the package management
system specific to that platform. A list of third-party packages can be
found on the [2]download page on the Wireshark web site.
__________________________________________________________________
File Locations
Wireshark and TShark look in several different locations for preference
files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations
vary from platform to platform. You can use About->Folders to find the
default locations on your system.
__________________________________________________________________
Known Problems
Dumpcap might not quit if Wireshark or TShark crashes. ([3]Bug 1419)
The BER dissector might infinitely loop. ([4]Bug 1516)
Capture filters aren't applied when capturing from named pipes. ([5]Bug
1814)
Filtering tshark captures with read filters (-R) no longer works.
([6]Bug 2234)
Application crash when changing real-time option. ([7]Bug 4035)
Wireshark and TShark will display incorrect delta times in some cases.
([8]Bug 4985)
Wireshark should let you work with multiple capture files. ([9]Bug
10488)
Dell Backup and Recovery (DBAR) makes many Windows applications crash,
including Wireshark. ([10]Bug 12036)
__________________________________________________________________
Getting Help
Community support is available on [11]Wireshark's Q&A site and on the
wireshark-users mailing list. Subscription information and archives for
all of Wireshark's mailing lists can be found on [12]the web site.
Official Wireshark training and certification are available from
[13]Wireshark University.
__________________________________________________________________
Frequently Asked Questions
A complete FAQ is available on the [14]Wireshark web site.
__________________________________________________________________
Last updated 2017-06-28 17:23:59 UTC
References
1. https://www.wireshark.org/download.html
2. https://www.wireshark.org/download.html#thirdparty
3. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419
4. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516
5. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814
6. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234
7. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4035
8. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4985
9. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10488
10. https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12036
11. https://ask.wireshark.org/
12. https://www.wireshark.org/lists/
13. http://www.wiresharktraining.com/
14. https://www.wireshark.org/faq.html
|
