Wireshark popularny sniffer

J

josephine

Bardzo aktywny
Zasłużony
Dołączył
14 Czerwiec 2020
Posty
3996
Reakcje/Polubienia
22132
Wireshark 3.6.8 - September 7, 2022

rkghadg.png


Wireshark 3.6.8 Release Notes:
Zaloguj lub Zarejestruj się aby zobaczyć!

Wireshark 3.6.8 Download:
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.0​

What’s New​

We no longer ship official 32-bit Windows packages starting with this release. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

The display filter syntax is more powerful with many new extensions. See below for details.
The Conversation and Endpoint dialogs have been redesigned. See below for details.
The default main window layout has been changed so that the Packet Detail and Packet Bytes are side by side underneath the Packet List pane.
Hex dump imports from Wireshark and from text2pcap have been improved. See below for details.
Speed when using MaxMind geolocation has been greatly improved.
The tools and libraries required to build Wireshark have changed. See “Other Development Changes” below for more details.
Many other improvements have been made. See the “New and Updated Features” section below for more details.

New and Updated Features​

The following features are new (or have been significantly updated) since version 4.0.0rc2:
Nothing of note.
The following features are new (or have been significantly updated) since version 4.0.0rc1:
  • The macOS packages now ship with Qt 6.2.4 and require macOS 10.14. They previously shipped with Qt 5.15.3.
  • The Windows installers now ship with Npcap 1.71. They previously shipped with Npcap 1.70.
The following features are new (or have been significantly updated) since version 3.7.2:
  • The Windows installers now ship with Npcap 1.70. They previously shipped with Npcap 1.60.
The following features are new (or have been significantly updated) since version 3.7.1:
  • The 'v' (lower case) and 'V' (upper case) switches have been swapped for editcap and mergecap to match the other command line utilities.
  • The ip.flags field is now only the three high bits, not the full byte. Display filters and Coloring rules using the field will need to be adjusted.
  • New address type AT_NUMERIC allows simple numeric addresses for protocols which do not have a more common-style address approach, analog to AT_STRINGZ.
The following features are new (or have been significantly updated) since version 3.7.0:
  • The Windows installers now ship with Qt 6.2.3. They previously shipped with Qt 6.2.4.
  • The Conversation and Endpoint dialogs have been redesigned with the following improvements:
    • The context menu now includes the option to resize all columns, as well as copying elements.
    • Data may be exported as JSON.
    • Tabs may be detached and reattached from the dialog.
    • Adding and removing tabs will keep them in the same order all the time.
    • If a filter is applied, two columns are shown in either dialog detailing the difference between unmatched and matched packets.
    • Columns are now sorted via secondary properties if an identical entry is found.
    • Conversations are sorted via second address and first port number.
    • Endpoints are sorted via port numbers.
    • IPv6 addresses are sorted correctly after IPv4 addresses.
    • The dialog elements have been moved to make it easier to handle for new users.
    • Selection of tap elements is done via a list.
    • All configurations and options are done via a left side button row.
    • Columns for the Conversations and Endpoint dialogs can be hidden by a context menu.
    • TCP and UDP conversations now include the stream ID and allow filtering on it.
The following features are new (or have been significantly updated) since version 3.6.0:
  • The Windows installers now ship with Npcap 1.60. They previously shipped with Npcap 1.55.
  • The Windows installers now ship with Qt 6.2.4. They previously shipped with Qt 5.12.2.
  • The display filter syntax has been updated and enhanced:
    • A syntax to match a specific layer in the protocol stack has been added. For example in an IP-over-IP packet “ip.addr#1 == 1.1.1.1” matches the outer layer addresses and “ip.addr#2 == 1.1.1.2” matches the inner layer addresses.
    • Universal quantifiers "any" and "all" have been added to any relational operator. For example the expression "all tcp.port > 1024" is true if and only if all tcp.port fields match the condition. Previously only the default behaviour to return true if any one field matches was supported.
    • Field references, of the form ${some.field}, are now part of the syntax of display filters. Previously they were implemented as macros. The new implementation is more efficient and has the same properties as protocol fields, like matching on multiple values using quantifiers and support for layer filtering.
    • Arithmetic is supported for numeric fields with the usual operators “+”, “-”, “*”, “/”, and “%”. Arithmetic expressions must be grouped using curly brackets (not parenthesis).
    • New display filter functions max(), min() and abs() have been added.
    • Functions can accept expressions as arguments, including other functions. Previously only protocol fields and slices were syntactically valid function arguments.
    • A new syntax to disambiguate literals from identifiers has been added. Every value with a leading dot is a protocol or protocol field. Every value in between angle brackets is a literal value. See the
      Zaloguj lub Zarejestruj się aby zobaczyć!
      for details.
    • The "bitwise and" operator is now a first-class bit operator, not a boolean operator. In particular this means it is now possible to mask bits, e.g.: frame[0] & 0x0F == 3.
    • Dates and times can be given in UTC using ISO 8601 (with 'Z' timezone) or by appending the suffix "UTC" to the legacy formats. Otherwise local time is used.
    • Integer literal constants may be written in binary (in addition to decimal/octal/hexadecimal) using the prefix "0b" or "0B".
    • Logical AND now has higher precedence than logical OR, in line with most programming languages.
    • It is now possible to index protocol fields from the end using negative indexes. For example the following expression tests the last two bytes of the TCP protocol field: tcp[-2:] == AA:BB. This was a longstanding bug that has been fixed in this release.
    • Set elements must be separated using a comma, e.g: {1, 2, "foo"}. Using only whitespace as a separator was deprecated in 3.6 and is now a syntax error.
    • Support for some additional character escape sequences in double quoted strings has been added. Along with octal (\<number>) and hex (\x<number>) encoding, the following C escape sequences are now supported with the same meaning: \a, \b, \f, \n, \r, \t, \v. Previously they were only supported with character constants.
    • Unicode universal character names are now supported with the escape sequences \uNNNN or \UNNNNNNNN, where N is a hexadecimal digit.
    • Unrecognized escape sequences are now treated as a syntax error. Previously they were treated as a literal character. In addition to the sequences indicated above, backslash, single quotation and double quotation mark are also valid sequences: \\, \', \".
    • A new strict equality operator "===" or "all_eq" has been added. The expression "a === b" is true if and only if all a’s are equal to b. The negation of "===" can now be written as "!==" (any_ne).
    • The aliases "any_eq" for "==" and "all_ne" for "!=" have been added.
    • The operator "~=" is deprecated and will be removed in a future version. Use "!==", which has the same meaning instead.
    • Floats must be written with a leading and ending digit. For example the values ".7" and "7." are now invalid as floats. They must be written "0.7" and "7.0" respectively.
    • The display filter engine now uses PCRE2 instead of GRegex (GLib’s bindings to the older and end-of-life PCRE library). PCRE2 is compatible with PCRE so any user-visible changes should be minimal. Some exotic patterns may now be invalid and require rewriting.
    • Literal strings can handle embedded null bytes (the value '\0') correctly. This includes regular expression patterns. For example the double-quoted string "\0 is a null byte" is a legal literal value. This may be useful to match byte patterns but note that in general protocol fields with a string type still cannot contain embedded null bytes.
    • Booleans can be written as True/TRUE or False/FALSE. Previously they could only be written as 1 or 0.
    • It is now possible to test for the existence of a slice.
    • All integer sizes are now compatible. Unless overflow occurs any integer field can be compared with any other.
  • The text2pcap command and the “Import from Hex Dump” feature have been updated and enhanced:
    • text2pcap supports writing the output file in all the capture file formats that wiretap library supports, using the same -F option as editcap, mergecap, and tshark.
    • Consistent with the other command line tools like editcap, mergecap, tshark, and the "Import from Hex Dump" option within Wireshark, the default capture file format for text2pcap is now pcapng. The -n flag to select pcapng (instead of the previous default, pcap) has been deprecated and will be removed in a future release.
    • text2pcap supports selecting the encapsulation type of the output file format using the wiretap library short names with an -E option, similar to the -T option of editcap.
    • text2pcap has been updated to use the new logging output options and the -d flag has been removed. The "debug" log level corresponds to the old -d flag, and the "noisy" log level corresponds to using -d multiple times.
    • text2pcap and “Import from Hex Dump” support writing fake IP, TCP, UDP, and SCTP headers to files with Raw IP, Raw IPv4, and Raw IPv6 encapsulations, in addition to Ethernet encapsulation available in previous versions.
    • text2pcap supports scanning the input file using a custom regular expression, as supported in “Import from Hex Dump” in Wireshark 3.6.x.
    • In general, text2pcap and wireshark’s “Import from Hex Dump” have feature parity.
  • The default main window layout has been changed so that the Packet Detail and Packet Bytes are side by side underneath the Packet List pane.
  • The HTTP2 dissector now supports using fake headers to parse the DATAs of streams captured without first HEADERS frames of a long-lived stream (such as a gRPC streaming call which allows sending many request or response messages in one HTTP2 stream). Users can specify fake headers using an existing stream’s server port, stream id and direction.
  • The IEEE 802.11 dissector supports Mesh Connex (MCX).
  • The “Capture Options” dialog contains the same configuration icon as the Welcome Screen. It is now possible to configure interfaces there.
  • The “Extcap” dialog remembers password items during runtime, which makes it possible to run extcaps multiple times in row without having to reenter the password each time. Passwords are never stored on disk.
  • It is possible to set extcap passwords in tshark and other CLI tools.
  • The extcap configuration dialog now supports and remembers empty strings. There are new buttons to reset values back to their defaults.
  • Support to display JSON mapping for Protobuf message has been added.
  • macOS debugging symbols are now shipped in separate packages, similar to Windows packages.
  • In the ZigBee ZCL Messaging dissector the zbee_zcl_se.msg.msg_ctrl.depreciated field has been renamed to zbee_zcl_se.msg.msg_ctrl.deprecated
  • The interface list on the welcome page sorts active interfaces first and only displays sparklines for active interfaces. Additionally, the interfaces can now be hidden and shown via the context menu in the interface list
  • The Event Tracing for Windows (ETW) file reader now supports displaying IP packets from an event trace logfile or an event trace live session.
  • ciscodump now supports IOS, IOS-XE and ASA remote capturing

Removed Features and Support​

  • The CMake options starting with DISABLE_something were renamed ENABLE_something for consistency. For example DISABLE_WERROR=On became ENABLE_WERROR=Off. The default values are unchanged.

New Protocol Support​

Allied Telesis Loop Detection (AT LDF), AUTOSAR I-PDU Multiplexer (AUTOSAR I-PduM), DTN Bundle Protocol Security (BPSec), DTN Bundle Protocol Version 7 (BPv7), DTN TCP Convergence Layer Protocol (TCPCL), DVB Selection Information Table (DVB SIT), Enhanced Cash Trading Interface 10.0 (XTI), Enhanced Order Book Interface 10.0 (EOBI), Enhanced Trading Interface 10.0 (ETI), FiveCo’s Legacy Register Access Protocol (5co-legacy), Generic Data Transfer Protocol (GDT), gRPC Web (gRPC-Web), Host IP Configuration Protocol (HICP), Huawei GRE bonding (GREbond), Locamation Interface Module (IDENT, CALIBRATION, SAMPLES - IM1, SAMPLES - IM2R0), Mesh Connex (MCX), Microsoft Cluster Remote Control Protocol (RCP), Open Control Protocol for OCA/AES70 (OCP.1), Protected Extensible Authentication Protocol (PEAP), Realtek, REdis Serialization Protocol v2 (RESP), Roon Discovery (RoonDisco), Secure File Transfer Protocol (sftp), Secure Host IP Configuration Protocol (SHICP), SSH File Transfer Protocol (SFTP), USB Attached SCSI (UASP), and ZBOSS Network Coprocessor product (ZB NCP)

Updated Protocol Support​

Too many protocols have been updated to list here.

New and Updated Capture File Support​

There is no new or updated capture file support in this release.

Major API Changes​

  • proto.h: The field display types "STR_ASCII" and "STR_UNICODE" have been removed. Use "BASE_NONE" instead.
  • proto.h: The field display types for floats have been extended and refactored. The type BASE_FLOAT has been removed. Use BASE_NONE instead. New display types for floats are BASE_DEC, BASE_HEX, BASE_EXP and BASE_CUSTOM.
  • The Wireshark Lua API now uses the
    Zaloguj lub Zarejestruj się aby zobaczyć!
    bindings to PCRE2. Code using the Lua GRegex module will have to be updated to use lrexlib-pcre2 instead. In most cases the API should be compatible and the conversion just requires a module name change.
  • The tap registration system has been updated and the list of arguments for tap_packet_cb has changed. All taps registered through register_tap_listener have to be updated.

Other Development Changes​

  • The
    Zaloguj lub Zarejestruj się aby zobaczyć!
    is now required to build Wireshark.
  • You must now have a compiler with C11 support in order to build Wireshark.
  • The following libraries and tools have had their minimum required version increased:
    • CMake 3.10 is required on macOS and Linux.
    • Qt version 5.12 (was 5.6.0), although compilation with 5.10 and 5.11 is still possible, but will trigger a warning during configuration.
    • Windows SDK 10.0.18362.0 is required due to issues with C11 support.
    • macOS version 10.11 to 10.14 (was 10.8) is required depending on the version of Qt:
    • Qt 5.10 or higher requires macOS version 10.11
    • Qt 5.12 or higher requires macOS version 10.12
    • Qt 5.14 or higher requires macOS version 10.13
    • Qt 6.0 or higher requires macOS version 10.14
    • GLib version 2.50.0 (was 2.38.0) is required.
    • Libgcrypt version 1.8.0 (was 1.5.0) is required.
    • c-ares version 1.13.0 (was 1.5.0).
    • Python version 3.6.0 (was 3.4.0).
    • GnuTLS version 3.5.8 (was 3.3.0).
    • Nghttp2 minimum version has been set to 1.11.0 (none previous).
  • Perl is no longer required to build Wireshark, but may be required to build some source code files and run code analysis checks.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.1​

October 26, 2022


Wireshark 4.0.1 and 3.6.9 have been released. Installers for Windows, Mac OS X 10.14 and later, and source code are now available.


In 4.0.1​


Several bugs have been fixed. See the release notes for details.


For a complete list of changes, please refer to the
Zaloguj lub Zarejestruj się aby zobaczyć!
.


In 3.6.9​


Two vulnerabilities have been fixed. See the release notes for details.


For a complete list of changes, please refer to the
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Official releases are available right now from the
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.2​

What’s New​


We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.4​

What’s New​


We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you will likely have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:

New and Updated Features​

There are no new or updated features in this release.

Removed Features and Support​

New Protocol Support​

There are no new protocols in this release.

Updated Protocol Support​

ASTERIX, BGP, DHCP, ERF, F5 Ethernet trailer, GMR-1 RR, Gryphon, GSM SMS, H.261, H.450, ISO 10681, ISO 15765, MIPv6, NAS-5gs, NR RRC, NS Trace, OptoMMP, PDCP-LTE, PDCP-NR, QSIG, ROHC, RSVP, RTCP, SCTP, SIP, TCP, TECMP, TWAMP, UDS, and UMTS RLC

New and Updated Capture File Support​

There is no new or updated capture file support in this release.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.5​

What’s New​

We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you will likely have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:

New and Updated Features​

There are no new or updated features in this release.

Removed Features and Support​

New Protocol Support​

There are no new protocols in this release.

Updated Protocol Support​

DHCP, DIS, DNS, ERF, FF, genl, GQUIC, GSM A-bis OML, HL7, IEEE 802.11, ITS, LAPD, netfilter, netlink-route, netlink-sock_diag, nl80211, RLC, RPCoRDMA, RTPS, SCTP, SMB, UDS, VNC, and WCP

New and Updated Capture File Support​

There is no new or updated capture file support in this release.
Netmon and NetScaler

New File Format Decoding Support​

There is no new or updated file format support in this release.

Getting Wireshark​

Wireshark source code and installation packages are available from
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Vendor-supplied Packages​

Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the
Zaloguj lub Zarejestruj się aby zobaczyć!
on the Wireshark web site.

File Locations​

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use Help › About Wireshark › Folders or tshark -G folders to find the default locations on your system.

Getting Help​

The User’s Guide, manual pages and various other documentation can be found at
Zaloguj lub Zarejestruj się aby zobaczyć!

Community support is available on
Zaloguj lub Zarejestruj się aby zobaczyć!
and on the wireshark-users mailing list. Subscription information and archives for all of Wireshark’s mailing lists can be found on
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Bugs and feature requests can be reported on
Zaloguj lub Zarejestruj się aby zobaczyć!
.
You can learn protocol analysis and meet Wireshark’s developers at
Zaloguj lub Zarejestruj się aby zobaczyć!
.

How You Can Help​

The Wireshark Foundation helps as many people as possible understand their networks as much as possible. You can find out more and donate at
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Frequently Asked Questions​

A complete FAQ is available on the
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.6​

May 25, 2023
  • What’s New:
  • We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release. Issue 17779
  • If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you will likely have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon. Issue 18734.
  • Bug Fixes:
  • The following vulnerabilities have been fixed:
  • wnpa-sec-2023-12 Candump log file parser crash. Issue 19062. CVE-2023-2855.
  • wnpa-sec-2023-13 BLF file parser crash. Issue 19063. CVE-2023-2857.
  • wnpa-sec-2023-14 GDSDB dissector infinite loop. Issue 19068.
  • wnpa-sec-2023-15 NetScaler file parser crash. Issue 19081. CVE-2023-2858.
  • wnpa-sec-2023-16 VMS TCPIPtrace file parser crash. Issue 19083. CVE-2023-2856.
  • wnpa-sec-2023-17 BLF file parser crash. Issue 19084. CVE-2023-2854.
  • wnpa-sec-2023-18 RTPS dissector crash. Issue 19085. CVE-2023-0666.
  • wnpa-sec-2023-19 IEEE C37.118 Synchrophasor dissector crash. Issue 19087. CVE-2023-0668.
  • wnpa-sec-2023-20 XRA dissector infinite loop. Issue 19100.
  • The following bugs have been fixed:
  • Conversations list has incorrect unit (bytes) in bit speed columns in the 3.7 development versions. Issue 18211.
  • The media_type table should treat media types, e.g. application/3gppHal+json, as case-insensitive. Issue 18611.
  • NNTP dissector bug. Issue 18981.
  • Incorrect padding in BFCP decoder. Issue 18890.
  • SPNEGO dissector bug. Issue 18991.
  • SRT values are incorrect when applying a time shift. Issue 18999.
  • Add warning that capturing is not supported in Wireshark installed from flatpak. Issue 19008.
  • Opening Wireshark with -z io,stat option. Issue 19042.
  • batadv dissector bug. Issue 19047.
  • radiotap-gen build fails if pcap is not found. Issue 19059.
  • [UDS] When filtering the uds.wdbi.data_identifier or uds.iocbi.data_identifier field is interpreted as 1 byte whereas it consists of 2 bytes. Issue 19078.
  • Wireshark can’t save this capture in that format. Issue 19080.
  • MSMMS parsing buffer overflow. Issue 19086.
  • USB HID parser shows wrong label for usages Rx/Vx/Vbrx of usage page Generic Desktop Control. Issue 19095.
  • "Follow ? QUIC Stream" mixes data between streams. Issue 19102.
  • New and Updated Features:
  • The media type dissector table now properly treats media types and subtypes as case-insensitive automatically, per RFC 6838. Media types no longer need to be lower cased before registering or looking up in the table.
  • Removed Features and Support
  • New Protocol Support:
  • There are no new protocols in this release.
  • Updated Protocol Support:
  • batadv, BFCP, CommunityID, COSE, GDSDB, H.265, HTTP, ILP, ISAKMP, MSMMS, NNTP, NR RRC, NTLMSSP, QUIC, RTPS, SPNEGO, Synphasor, TCP, UDS, ULP, USB HID, and XRA
  • New and Updated Capture File Support
  • BLF, Candump, NetScaler, and VMS TCPIPtrace
  • New File Format Decoding Support
  • There is no new or updated file format support in this release.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.7​

What’s New​


We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you might have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.8​

What’s New​

We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you might have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:

New and Updated Features​

There are no new or updated features in this release.

New Protocol Support​

There are no new protocols in this release.

Updated Protocol Support​

BT SDP, CBOR, CFM, CP2179, CQL, DHCPFO, DICOM, F1AP, GSM DTAP, IEEE 802.11, IPv4, NAS-5GS, PFCP, PKT CCC, QUIC, RTP, TFTP, WebSocket, and XnAP

New and Updated Capture File Support​

There is no new or updated capture file support in this release.

New File Format Decoding Support​

There is no new or updated file format support in this release.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.9​

What’s New​

We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you might have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:

New and Updated Features​

There are no new or updated features in this release.

New Protocol Support​

There are no new protocols in this release.

Updated Protocol Support​

ESL, GNW, IDN, IEEE 1722, IEEE 1905.1a, ITS, Kafka, ProtoBuf, RTP, RTPS, SCCP, TACACS, and Tibia

New and Updated Capture File Support​

There is no new or updated capture file support in this release.

New File Format Decoding Support​

There is no new or updated file format support in this release.

Getting Wireshark​

Wireshark source code and installation packages are available from
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Vendor-supplied Packages​

Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the
Zaloguj lub Zarejestruj się aby zobaczyć!
on the Wireshark web site.

File Locations​

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use Help › About Wireshark › Folders or tshark -G folders to find the default locations on your system.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.10​

What’s New​


We do not ship official 32-bit Windows packages for Wireshark 4.0 and later. If you need to use Wireshark on that platform, we recommend using the latest 3.6 release.
Zaloguj lub Zarejestruj się aby zobaczyć!

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you might have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Bug Fixes​

The following bugs have been fixed:
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.0.11​

November 16, 2023
  • The following bugs have been fixed:
  • First ZigBee APS packet is not decrypted. Issue 16507.
  • Problem with decoding OpenFlow actions in OFPT_FLOW_MOD message. Issue 17072.
  • The "frames" method in sharkd does not consider time references and displays incorrect delta time. Issue 17923.
  • Wireshark and TShark throw packet-wireguard-WARNING when running on systems with FIPS enabled. Issue 18441.
  • Wireshark interprets If_fcslen option in the Interface Description Block as byte instead of bit. Issue 19174.
  • Flathub’s Wireshark page shows wrong version number. Issue 19382.
  • OSPFv3 RI decode error. Issue 19444.
  • GSM SIM READ / UPDATE BINARY command has wrong offset. Issue 19472.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.2.0​

November 15, 2023​

What’s New​

This is the first major Wireshark release under the Wireshark Foundation, a nonprofit which hosts Wireshark and promotes protocol analysis education. The foundation depends on your contributions in order to do its work. If you or your employer would like to contribute or become a sponsor, please visit
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Wireshark supports dark mode on Windows.
A Windows installer for Arm64 has been added.
Packet list sorting has been improved.
Wireshark and TShark are now better about generating valid UTF-8 output.
A new display filter feature for filtering raw bytes has been added.
Display filter autocomplete is smarter about not suggesting invalid syntax.
Tools › MAC Address Blocks can lookup a MAC address in the IEEE OUI registry.
The enterprises, manuf, and services configuration files have been compiled in for improved start-up times. These files are no longer available in the master branch in our source code repository. You can download the
Zaloguj lub Zarejestruj się aby zobaczyć!
from our automated build directory.
The installation target no longer installs development headers by default.
The Wireshark installation is relocatable on Linux (and other ELF platforms with support for relative RPATHs).
Wireshark can be compiled on Windows using
Zaloguj lub Zarejestruj się aby zobaczyć!
. Check the Developer’s guide for instructions.
Wireshark can be cross-compiled for Windows using Linux. Check the Developer’s guide for instructions.
Tools › Browser (SSL Keylog) can launch your web browser with the SSLKEYLOGFILE environment variable set to the appropriate value.
Windows installer file names now have the format Wireshark-<version>-<architecture>.exe.
Wireshark now supports the Korean language.
Many other improvements have been made. See the “New and Updated Features” section below for more details.

Bug Fixes​

The following bugs have been fixed:

New and Updated Features​

The following features are new (or have been significantly updated) since version 4.2.0rc3:
  • Nothing of note.
The following features are new (or have been significantly updated) since version 4.2.0rc2:
  • The Windows installers now ship with Npcap 1.78. They previously shipped with Npcap 1.77.
The following features are new (or have been significantly updated) since version 4.2.0rc1:
  • The Windows installers now ship with Npcap 1.77. They previously shipped with Npcap 1.71.
The following features are new (or have been significantly updated) since version 4.1.0:
  • Improved dark mode support.
  • The Windows installers now ship with Qt 6.5.3. They previously shipped with Qt 6.2.3.
The following features are new (or have been significantly updated) since version 4.0.0:
  • The API has been updated to ensure that the dissection engine produces valid UTF-8 strings.
  • Wireshark now builds with Qt6 by default. To use Qt5 instead pass USE_qt6=OFF to CMake.
  • The "ciscodump" extcap supports Cisco IOS XE 17.x.
  • The default interval between GUI updates when capturing has been decreased from 500ms to 100ms, and is now configurable.
  • The -n option also now disables IP address geolocation information lookup in configured MaxMind databases (and geolocation lookup can be enabled with -Ng.) This is most relevant for TShark, where geolocation lookups are synchronous.
  • The display filter drop-down list is now sorted by "most recently used" instead of "most recently created".
  • Display filter syntax-related changes:
    • It is now possible to filter on raw packet data for any field by using the syntax @some.field == <bytes…>. This can be useful to filter on malformed UTF-8 strings, among other use cases where it is necessary to look at the field’s raw data.
    • Negation (unary minus) now works with any display filter arithmetic expression.
    • Using the slice operator with strings produces a string. Previously it would produce a byte array. This is useful to index/slice UTF-8 multibyte strings. String byte slices can still be obtained using the "@" (raw operator) prefix.
    • Arithmetic expressions are allowed as set elements.
    • Absolute date and time values can be written as Unix time.
    • The limitation where a minus sign needed to be preceded by a space character has been removed.
    • Added XOR logical operator.
    • Fixed the implementation of all … in membership operator (
      Zaloguj lub Zarejestruj się aby zobaczyć!
      ).
    • When parsing absolute time values the display filter engine has learned to understand timezones as specified in
      Zaloguj lub Zarejestruj się aby zobaczyć!
      , including some common North American designations. Arbitrary timezone names are not supported however. Previously only ISO8601 offsets and the "UTC" designation was understood.
    • Writing value strings without double quotes is deprecated and will generate a warning. Value strings are integer or boolean values that can be represented using a user-friendly textual format, such as "Set"/"Unset" instead of numerical values like 1 and 0. It is now a requirement that value strings need to be written enclosed in double-quotes.
    • The deprecated ~≃ operator symbol has been removed. It was replaced by !== in version 4.0.
  • Running the test suite requires the
    Zaloguj lub Zarejestruj się aby zobaczyć!
    Python module. The emulation layer that allowed running tests without pytest installed has been removed.
  • When saving files or exporting packets after changing their time with the "Time Shift" dialog, the shifted time is written to the new file.
  • TLS secrets used in decrypting packets can be embedded (or discarded) from the capture file via the GUI, similar to the options --inject-secrets and --discard-all-secrets in editcap.
  • The text of any configured column (displayed or hidden) can be filtered anywhere that filters are used - in display filters, filters in taps, coloring rules, Wireshark read filters, and the -Y, -R, and -e options to TShark, the "Apply as Filter" GUI option, etc.
    • The filter field names are prefixed by "_ws.col", followed by a lowercase version of the COL_ name found in epan/column-utils.h, e.g. "_ws.col.info" or "_ws.col.protocol"
    • Using the column names as a filter is slower than other filter types because the columns must be constructed, so when the same filtering can be achieved via other fields, prefer that.
  • The external name resolution text files "manuf", "enterprises" and "services" have been removed and replaced with static binary data. You can dump the respective internal data using tshark -G manuf|enterprises|services.
  • The "manuf" file is now also read from the personal configuration folder, and is profile-based.
  • The Lua console dialogs under the Tools menu were refactored and redesigned. It now consists of a single dialog window for input and output.
  • Wireshark now shows byte units in the statistics in the user-selected language (uses the system default language by default).
  • Packet list sorting has been improved:
    • When sorting packet list with a filter applied, only the visible packets are sorted, which greatly increases sorting speed.
    • The cache size for column text is limited to a default of 10000 rows, which limits the maximum memory usage. The maximum value can be changed in Preferences→Appearance→Layout
    • Due to the above, columns that require packet dissection can only be sorted if the number of visible rows is less than the cache size. If there are more rows visible, a warning will appear. Columns that do not require packet dissection (those that calculated directly from the capture file frame headers, such as packet number, time, and frame length) can be sorted with any number of visible rows.
    • Sorting can be interrupted.
  • When changing the dissector via the "Decode As" table for values that have default dissectors registered, selecting "(none)" will select no dissection (while still allowing heuristic dissectors to attempt to dissect.) The previous behavior was to reset the dissector to the default. To facilitate resetting the dissector, the default dissector is now sorted at the top of the list of possible dissector options.
  • The personal extcap plugin folder location on Unix has been changed to follow existing conventions for architecture-dependent files. The extcap personal folder is now $HOME/.local/lib/wireshark/extcap. Previously it was $XDG_CONFIG_HOME/wireshark/extcap.
  • The "init.lua" file is now loaded from any of the Lua plugin directories. Previously it was loaded from the personal configuration directory. (For backward-compatibility this is still allowed; note that deprecated features may be removed in a future release).
  • Installation of development headers must be done explicitly using the CMake command cmake --install <builddir> --component Development.
  • The Windows build has a new SpeexDSP external dependency (
    Zaloguj lub Zarejestruj się aby zobaczyć!
    ). The speex code that was previously bundled has been removed.
  • New --print-timers option added to TShark.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
C

Camel1965

Bardzo aktywny
Zasłużony
Dołączył
8 Wrzesień 2010
Posty
37854
Reakcje/Polubienia
33966

Wireshark 4.2.1​

What’s New​

Bug Fixes​

The following vulnerabilities have been fixed:
The following bugs have been fixed:

New and Updated Features​

There are no new or updated features in this release.

New Protocol Support​

There are no new protocols in this release.

Updated Protocol Support​


New and Updated Capture File Support​

There is no new or updated capture file support in this release.
pcapng: the if_tsoffset option is now supported.

Prior Versions​

This document only describes the changes introduced in Wireshark 4.2.1.You can find release notes for prior versions at the following locations:

Getting Wireshark​

Wireshark source code and installation packages are available from
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Vendor-supplied Packages​

Most Linux and Unix vendors supply their own Wireshark packages.You can usually install or upgrade Wireshark using the package management system specific to that platform.A list of third-party packages can be found on the
Zaloguj lub Zarejestruj się aby zobaczyć!
on the Wireshark web site.

File Locations​

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.These locations vary from platform to platform.You can use Help › About Wireshark › Folders or tshark -G folders to find the default locations on your system.

Getting Help​

The User’s Guide, manual pages and various other documentation can be found at
Zaloguj lub Zarejestruj się aby zobaczyć!

Community support is available on
Zaloguj lub Zarejestruj się aby zobaczyć!
and on the wireshark-users mailing list.Subscription information and archives for all of Wireshark’s mailing lists can be found on
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Bugs and feature requests can be reported on
Zaloguj lub Zarejestruj się aby zobaczyć!
.
You can learn protocol analysis and meet Wireshark’s developers at
Zaloguj lub Zarejestruj się aby zobaczyć!
.

How You Can Help​

The Wireshark Foundation helps as many people as possible understand their networks as much as possible.You can find out more and donate at
Zaloguj lub Zarejestruj się aby zobaczyć!
.

Frequently Asked Questions​

A complete FAQ is available on the
Zaloguj lub Zarejestruj się aby zobaczyć!
.
Kliknij aby rozwinąć...
Zaloguj lub Zarejestruj się aby zobaczyć!
 
Musisz się zalogować lub zarejestrować aby odpowiedzieć

Podobne tematy:

China O'Brien
System Informer
Odpowiedzi
0
Wyświetleń
21
China O'Brien
China O'Brien
OXYGEN THIEF
Steganos LockNote 2
Odpowiedzi
1
Wyświetleń
55
yyy
yyy
China O'Brien
IP-Toolbox
Odpowiedzi
0
Wyświetleń
83
China O'Brien
China O'Brien
OXYGEN THIEF
Sunny - łatwe tworzenie zrzutów ekranu
Odpowiedzi
0
Wyświetleń
60
OXYGEN THIEF
OXYGEN THIEF
China O'Brien
Jim's Toolbox
Odpowiedzi
2
Wyświetleń
73
OXYGEN THIEF
OXYGEN THIEF
Do góry