Wireshark

No entries match these filters. Clear filters

1. Planned release notes, unconfirmed · source
   • ▪Development Release: 4.7.4
2. Planned roadmap, proposed · source
   • ▪Wireshark 5.0.0rc1 October 21, 2026 Next development release leading to 5.0
3. docs update Oct 9, 2026 · issue 098

   Wireshark 4.7.5 adds packet tagging with frame.tag, Zstandard capture compression, process-info recording, and UTF-8 hex display⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Capture live traffic and record which process sent/received each packet, including full path, command line, and user — useful for endpoint forensics
   copy

   $ dumpcap --process-info=full -i eth0 -w output.pcapng

   Rewrite a capture to a Zstandard-compressed file using fast compression (negative level) to minimise CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. overhead while storing large captures
   copy

   $ tshark -r input.pcapng -w output.pcapng.zst --compress zstd -o capture.zstd_compression_level:-1

   Strip all process-info metadata from a capture before sharing it externally, removing PID/path/user references
   copy

   $ editcap --discard-process-info input.pcapng sanitised.pcapng

   • Adds capture.zstd_compression_level preference to control Zstandard compression level (1–22, negative for fast mode, default 3) for saved and exported captures in TShark via -o capture.zstd_compression_level:<level>⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --process-info[=basic|full] flag to TShark and Dumpcap to record the process ID, name (basic), or full path, command line, and user (full) for each captured packet
   • Adds --discard-process-info flag to Editcap to strip process metadata blocks and per-packet process references from capture files
   • Adds 11.7.1. Automatic Profile Switching to switch configuration profiles automatically based on a filter (e.g. frame.process.pid)
   • Adds UTF-8 encoding option for hexdump text display, drawing each multi-byte character over its first byte column with a dim ] marker on the last byte
   • Adds capture.zstd_compression_level preference to control Zstandard compression level (1–22, negative for fast mode, default 3) for saved and exported captures in TShark via -o capture.zstd_compression_level:<level>⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --process-info[=basic|full] flag to TShark and Dumpcap to record the process ID, name (basic), or full path, command line, and user (full) for each captured packet
   • Adds --discard-process-info flag to Editcap to strip process metadata blocks and per-packet process references from capture files
   • Adds 11.7.1. Automatic Profile Switching to switch configuration profiles automatically based on a filter (e.g. frame.process.pid)

   1 more in Everything

4. docs update Oct 9, 2026 · issue 098

   Wireshark 4.7.5 adds folderselect extcap arg type and a limit_to_display_filter option for Lua tap listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Expose a folder-picker argument in a custom extcap interface so users can select a log directory via the Wireshark GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
   copy

   $ arg {number=3}{call=--logdir}{display=Log directory}{tooltip=A folder for log files}{type=folderselect}{mustexist=true}

   • Adds folderselect as a new extcap argument type (type=folderselect), presenting a folder-picker dialog to the user; supports mustexist=true to require the folder to already exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds limit_to_display_filter parameter to Listener.new() in the Lua API, causing a tap to follow the main Wireshark display filter and retap automatically when it changes.
   • Adds ENABLE_PACKAGEKIT CMake option to enable update notifications on Linux distributions.

   3 details in Everything

5. docs update Oct 6, 2026 · issue 096

   Wireshark: Adds capture.zstd_compression_level preference to control ZstandardZstandardA fast lossless compression algorithm and library developed by Facebook, offering better compression ratios than zlib at comparable or higher speeds, making it attractive for tools that need to compress large data streams efficiently. compression for saved or exported captures with .zst suffix.

   └──▷ TRY IT
   Rewrite a capture to Zstandard at maximum compression to minimise long-term storage size.
   copy

   $ tshark -r input.pcapng -w output.pcapng.zst --compress zstd -o capture.zstd_compression_level:9

   Capture live traffic and record the full process context (path, command line, user) for every packet — useful for correlating packets to specific applications.
   copy

   $ dumpcap --process-info=full -w capture.pcapng

   Filter on tagged packets in a capture where tagging rules have flagged HTTP errors, or isolate all tagged packets regardless of rule.
   copy

   $ tshark -r capture.pcapng -Y 'frame.tag == "HTTP errors"'

   • Adds Zstandard (zstd) as a supported capture-file compression format alongside gzip and LZ4, selectable when writing captures to disk.
   • Adds packet tagging: display-filter-based rules set the frame.tag field and show a short label (typically an emoji) in a dedicated Tag column, with optional per-tag URLs that open on click; managed via 'Tagging Rules...' dialog and stored per configuration profile.
   • Adds Aggregation Fields section (11.6.7) to Preferences, accessible at Preferences → Aggregation → Aggregation fields.
   • Adds Welcome Page Banner Slides configuration (section 11.24) supporting multiple slide types and time-limited slides.
   • Adds Personal themes subsection (11.6.4.1) under Theme and Font preferences.

   5 details in Everything

6. docs update Oct 4, 2026 · issue 094

   Wireshark Lua tap API gains limit_to_display_filter parameter to restrict listeners to the active display filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds limit_to_display_filter optional parameter to Listener.new() so Lua tap listeners automatically retap using the current main display filter whenever it changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

7. docs update Oct 4, 2026 · issue 094

   Wireshark gains packet tagging with frame.tag, process-info capture flags, and UTF-8 hexdump display⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Capture live traffic with full process attribution (PID, name, path, command line, user) to identify which application sent each packet.
   copy

   $ dumpcap --process-info=full -i eth0 -w capture_with_procs.pcapng

   Strip process metadata from a capture file before sharing it externally to avoid leaking host process details.
   copy

   $ editcap --discard-process-info capture_with_procs.pcapng sanitized_output.pcapng

   • Adds --process-info[=basic|full] flag to TShark and Dumpcap to record the process ID, name, path, command line, and user for each captured packet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --discard-process-info flag to Editcap to strip process metadata blocks and per-packet process references from a capture file.
   • Adds packet tagging: rules match a display filter and write a short label (emoji or text) to a dedicated Tag column, setting the frame.tag field so tagged packets can be filtered with expressions like frame.tag == 'HTTP errors'.
   • Tagging rules support an optional URL per rule; clicking a tag opens the linked ticket, runbook, or wiki page, with click behavior controlled by a per-profile Follow Link setting (Ctrl+Shift+Click, plain click, or right-click only).
   • Tagging rules are stored per configuration profile (same mechanism as coloring rules) and are managed via the 'Tagging Rules...' dialog; a Copy to Coloring Rule button pre-fills the Coloring Rules dialog with the same name and filter.

   +3 more show less

   • Adds a Processes global configuration profile that includes PID and Proc Name columns and filter buttons for captures that record per-packet process information, with automatic profile switching via frame.process.pid.
   • Stores coloring rules in coloring_rules.jsonc (JSON array of objects with filter, foreground, background, and enabled fields) in the personal configuration folder, falling back to the global coloring_rules.jsonc.
   • Adds UTF-8 hexdump display option: each multi-byte character is drawn over its first byte's column, a dim ] marks the last byte, and hovering any byte highlights the whole character.
   • Adds --process-info[=basic|full] flag to TShark and Dumpcap to record the process ID, name, path, command line, and user for each captured packet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --discard-process-info flag to Editcap to strip process metadata blocks and per-packet process references from a capture file.
   • Adds packet tagging: rules match a display filter and write a short label (emoji or text) to a dedicated Tag column, setting the frame.tag field so tagged packets can be filtered with expressions like frame.tag == 'HTTP errors'.
   • Tagging rules support an optional URL per rule; clicking a tag opens the linked ticket, runbook, or wiki page, with click behavior controlled by a per-profile Follow Link setting (Ctrl+Shift+Click, plain click, or right-click only).
   • Tagging rules are stored per configuration profile (same mechanism as coloring rules) and are managed via the 'Tagging Rules...' dialog; a Copy to Coloring Rule button pre-fills the Coloring Rules dialog with the same name and filter.

   +2 more show less

   • Adds a Processes global configuration profile that includes PID and Proc Name columns and filter buttons for captures that record per-packet process information, with automatic profile switching via frame.process.pid.
   • Adds UTF-8 hexdump display option: each multi-byte character is drawn over its first byte's column, a dim ] marks the last byte, and hovering any byte highlights the whole character.

   1 more in Everything

8. docs update Sep 24, 2026 · issue 084

   Wireshark docs add process-level packet attribution via --process-info and frame.process filter field in pcapngpcapngA file format for storing captured network packets, extending the older pcap format with support for multiple interfaces, metadata blocks, and comments. Cyber tools use it to record richer packet traces without losing interface context. captures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Capture traffic with full process metadata so you can later filter by process name or command line to attribute suspicious connections to specific applications.
   copy

   $ dumpcap --process-info -w capture.pcapng

   • Adds frame.process filter field to query packets by the process (ID, name, executable path, command line, parent process, or user) that sent or received them, recorded in pcapng files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes --process-info option in dumpcap to control what process metadata is captured: nothing, IDs and names, or full detail (executable path, command line, parent process, user).
   • Surfaces process metadata under Process information in the frame details panel and in the Output tab of the Capture Options dialog.

   3 details in Everything

9. docs update Sep 8, 2026 · issue 068

   Wireshark 4.7.4 adds column freezing and pinned-row strip to the packet list for easier horizontal and vertical navigation.

   └──▷ HOW TO FIND IT
   Keep a suspicious packet in view while scrolling through surrounding traffic to compare fields without losing your reference point.
   📍In the packet list, right-click the row you want to keep visible and choose Pin Row to Top. The row appears in a fixed strip above the packet list. To return to it in the main list, right-click the pinned strip and choose Go to Packet. To release all pinned rows, right-click the strip and choose Unpin All Rows.
   Lock high-value columns (e.g., Time, Source, Destination) in place while scrolling right to inspect wide protocol fields without losing context.
   📍In the packet list header, right-click the rightmost column you want frozen (e.g., Destination) and choose Freeze Column. That column and all columns to its left stay fixed. To release, right-click any column header and choose Unfreeze Columns.
   • Adds Freeze Column context menu item to freeze a column and all columns to its left so they remain visible while scrolling horizontally, with Unfreeze Columns to clear them.
   • Adds Pin Row to Top toggle to pin a packet's row in a persistent strip above the packet list, keeping it visible regardless of scroll position or display filter, up to a fixed maximum number of pinned rows.
   • Adds Go to Packet context menu item in the pinned-row strip to scroll the main packet list to a pinned packet's current position.
   • Adds Unpin All Rows context menu item in the pinned-row strip to clear all pinned rows at once.

   4 details in Everything

10. 67a3f77342 [Automatic update for 2026-08-30] Aug 30, 2026 · release notes

    Wireshark adds Grease for TLS Signature Algorithms and bookmark support to ExtcapOptionsDialog

11. d0f8156f7b [Automatic update for 2026-08-23] Aug 23, 2026 · release notes

    Wireshark gains simple Ogg support, PROFINET secure SXP dissection, and expanded NVMe decoding

    • Adds file-ogg dissector for simple Ogg container support.
    • Adds Profinet secure SXP (SAM and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows.) dissection capability.
    • Expands NVMe/NVMe-MI decode to include Security payloads.

    3 details in Everything

12. docs update Aug 17, 2026 · issue 048

    Wireshark docs add JSON export options (deduplication, compact mode, values, raw bytes) and Aggregation View for packet-list grouping.

    • Adds No duplicate keys JSON export option: merges duplicate keys in a JSON object into a single key whose value is a JSON array containing all values.
    • Adds Compact (no indentation) JSON export option: outputs compact JSON without indentation or extra whitespace, reducing output size and improving export performance.
    • Adds Values JSON export option: exports a name/value pair for each field with the decoded field value.
    • Adds Raw Bytes JSON export option: exports a name/value pair for each field with the raw hex bytes of its packet data.
    • Introduces Aggregation View, which displays frames aggregated by selected field values showing only the most recently received ones for each combination; disabled by default and enabled by adding aggregation fields in preferences.

    +2 more show less

    • Documents that Wireshark 4.6 is the last release branch to officially support Windows 10 (version 1809), Windows Server 2019, Red Hat EL 8, and Qt 5.
    • Documents end-of-support dates and milestone notes for all major Wireshark releases from 1.0 through 4.6 in a new End of Support planning table.

    7 details in Everything

13. 08ff3a70b7 [Automatic update for 2026-08-16] Aug 16, 2026 · release notes

    Adds ws_socketpair API, gsmtap_um capture support, EHT PPE dissection, and extcap logging pipe.

    • Adds ws_socketpair function in wsutil for creating socket pairs.
    • Supports LINKTYPE_GSMTAP_UM (217) in GSMTAP capture files.
    • Adds EHT PPE Thresholds dissection to ieee80211 dissector.
    • Enables compressed payload dissection in SAP DIAG/RFC.
    • Supports logging via control pipe in extcap-base.

    5 details in Everything

14. 813d5933f6 [Automatic update for 2026-08-09] Aug 9, 2026 · release notes

    Wireshark adds BTLE StageFeed command dissection, Bittorrent handshake bit decoding, and Synchrophasor stream config sharing

    • IDN: Added dissection of StageFeed Commands and improved audio handling.
    • bittorrent: Decodes extension bits in the handshake message.
    • Synchrophasor: Allows configuration sharing between multiple capture streams.

    3 details in Everything

15. c2fb0ac2a3 [Automatic update for 2026-08-02] Aug 2, 2026 · release notes

    Adds Vector ASC CAN trace decoder and DECT NR+ TAP header dissector

    • Added vector_asc capture file format support (decoder)
    • Added dect_nr_tap protocol dissector

    2 details in Everything

16. 4a80f48387 [Automatic update for 2026-07-26] Jul 26, 2026 · release notes

    Adds NVMe-MI Identify/log page/HMB decoding, NVMe/Mi Admin response support, and UTF-8 CSV export with optional BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.

    • Adds Export Packet Dissections UTF-8 CSV option with optional BOM in the wiretap library

    1 detail in Everything

17. 51831814f0 [Automatic update for 2026-07-12] Jul 12, 2026 · release notes

    Adds ZIP file support in Fileshark, CoAP-EAP dissector for RFC 9820, and WTAP_ENCAP_PROCMON to wiretap.

    • Add WTAP_ENCAP_PROCMON encapsulation table entry to wiretap
    • Introduce dissector table for Manufacturer-Specific PIDs in RDM

    2 details in Everything

18. 101e06613f [Automatic update for 2026-07-05] Jul 5, 2026 · release notes

    New HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. stream follow, JSON+ lookup features, and improved ORAN/H3/DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. dissectors.

    • Follow HTTP/3 Stream feature implemented for HTTP/3 connections
    • JSON+ dissector gains wildcardfield, protocol-scoped lookups, and per-protocol filters

    2 details in Everything

19. 3f7ae7067c [Automatic update for 2026-06-21] Jun 21, 2026 · release notes

    Wireshark adds HTTP QUERY method support, SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic. async comm, sharkd socket options, and more

    • Adds QUERY method and Accept-Query header field support in the HTTP dissector
    • Adds SMB2 support for asynchronous communications
    • Adds --install-optional argument handling to haiku-setup.sh script for Haiku OS setup
    • Enables Unix Domain Sockets on Windows via sharkd when available

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sharkd now restricts TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. socket connections to loopback addresses only (IPv4 or IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.)
    • !sharkd on Linux abstract sockets now only allows peers with the same eUID to connect
20. c15cd034f9 [Automatic update for 2026-06-14] Jun 14, 2026 · release notes

    Wireshark adds support for injecting Encrypted Client Hello and TLS secrets from F5 Trailers.

    • Adds tls.secrets injection for Encrypted Client Hello (ECH) to improve ECH traffic decryption
    • Adds F5 Trailer dissector with TLS secrets extraction to capture handshake keys directly from F5-specific trailer fields

    2 details in Everything

21. 849f1d184f [Automatic update for 2026-06-07] Jun 7, 2026 · release notes

    Wireshark auto-installs opencore DLLs on MSYS2 and makes Funnel plugins load at startup

    • Packaging now automatically installs the opencore DLLs for MSYS2 builds

    1 detail in Everything

22. 530f9c34b7 [Automatic update for 2026-05-31] May 31, 2026 · release notes

    Adds Stratoshark theme to Qt UI, per-flavor default selection and new Bill Validator Dissector for mdb.

    └──▷ HOW TO FIND IT
    Switch Wireshark to the Stratoshark theme via the profile manager and save settings.
    📍Open Tools › Preferences › Profile Dialog, select Stratoshark from the Theme dropdown, then click Save.
    Filter traffic specifically for Bill Validator messages in live capture.
    copy

    $ Apply display filter: `mdb.bv`

    • Adds the Stratoshark theme option in the Qt Profile Dialog alongside per-flavor default selection logic.
    • Introduces a named Bill Validator dissector under the mdb protocol tree in packet details.

    2 details in Everything

23. 7751439f1d [Automatic update for 2026-05-24] May 24, 2026 · release notes

    Wireshark adds IEEE 802.11 WNM Sleep Mode dissection and Netlink MPR support

    • Adds WNM Sleep Mode subelement dissection for IEEE 802.11 frames
    • Adds MPR (Multi-Packet Reception) support to the nvme-mi dissector
    • Adds NL80211_ATTR_PROTOCOL_FEATURES value dissection to the nl80211 dissector

    3 details in Everything

24. 67e9eba775 [Automatic update for 2026-05-03] May 3, 2026 · release notes

    Wireshark adds HiPerConTracer timestamp presentation improvement, PROFINET PROFIsafe fixes, and wslua debug hook granularity.

    • Improved send timestamp presentation in the HiPerConTracer dissector.

    1 detail in Everything

25. 3474674f73 [Automatic update for 2026-04-26] Apr 26, 2026 · release notes

    New etype 0x8905 decoding, DIS radio stream analysis, and ENIP LLDP support

    • Adds etype 0x8905 as Cisco TTAG by default in KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. decryption logic
    • Adds radio stream analysis support for the DIS protocol dissector
    • Adds LLDP management support to the ENIP dissector

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes the 3DES-only libnettle implementation from Kerberos support
26. 7801e2ce1d [Automatic update for 2026-04-19] Apr 19, 2026 · release notes

    Adds Lua Debugger with editing and stepping capabilities; supports SM2/SM3/SM4 in RTPS security.

    └──▷ USE IT
    Automate capture file operations using sharkd with required comment syntax.
    shell copy

    curl -X POST http://localhost:9997 -d 'action=setcomment;comment=My new note'

    • Lua Debugger: Adds Step Over, Step In, Step Out, editable script editor, and unsaved indicator to the Qt GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. under Tools menu
    • RTPS dissector: adds recognition of SM2, SM3, and SM4 algorithms in security attributes
    • sharkd protocol: requires mandatory comment parameter for setcomment action; implements skeleton for cf_close

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sharkd setcomment action now mandates a comment parameter, which will fail calls providing an empty or missing argument.
27. eba43a6f74 [Automatic update for 2026-04-05] Apr 5, 2026 · release notes

    Wireshark eba43a6f74 adds font zooming via scroll wheel, new Zigbee StringN support, and ORAN FH CUS dissector cleanup.

    └──▷ HOW TO FIND IT
    Zoom in on byte values in the packet details pane without touching menus.
    📍Hold CTRL and scroll the mouse wheel while the Show Packet Bytes tab is active
    • Adds CTRL + scroll zooming to the Show Packet Bytes pane in Qt builds
    • Supports retrieving the MSB 32 bits of the XPN for MKA/MACsec

    2 details in Everything

28. 39eb698c3f [Automatic update for 2026-03-29] Mar 29, 2026 · release notes

    Wireshark adds MKA XPN support, PROFINET SXP improvements, and multi-rule coloring

    • Implement XPN Cipher Suites for MKA/MACsec protocol analysis
    • Add ability to display multiple Coloring Rules simultaneously in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
    • Add new s6c AVPs and enhance S6c support for Diameter protocol dissector
    • Add Mailbox-VoE dissector for EtherCAT, with mailbox activation enabled
    • Add VNI and Group Policy ID to the VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. tree item display

    +3 more show less

    • Add MWD-Status Decode for the Diameter protocol
    • Add new TCP/IP Interface Object attributes support in the ENIP dissector
    • Add support for new QoS attributes in the ENIP dissector

    8 details in Everything

29. 8faae143d3 [Automatic update for 2026-03-22] Mar 22, 2026 · release notes

    Adds LS ELECTRIC XGT protocol dissector, TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. Ethertype support, and NATS Decode As handling

    └──▷ HOW TO FIND IT
    Inspect LS ELECTRIC XGT traffic by adding the Ethertype to the Decode As list in Wireshark Preferences > Protocols > decode as.
    📍Preferences › Protocols › decode as -> Add Ethernet Type = TTL (new) map to XGT
    Force NATS messages to be decoded as a specific protocol using the Decode As dialog.
    📍Right-click packet › Decode As › Select NATS and choose target protocol
    Enable payload inspection for TTL packets via the new preference.
    📍Preferences › Protocols › TTL › Check Dissect the payload
    • epan adds a new dissector for the LS ELECTRIC XGT protocol.
    • TTL adds a new Ethernet Type (Ethertype) for Traffic Tagged Link Layer with preference to dissect payload.
    • NATS adds Decode As handling to allow manual protocol selection.
    • CAN and LIN protocols add can_get_bus_id_from_interface_name and lin_get_bus_id_from_interface_name functions respectively.
    • TTL gains support for Segmented Message Entry reassembly.

    +1 more show less

    • Modbus dissector distinguishes between RTU over TCP and RTU only modes.

    6 details in Everything

30. 7fcd0ef267 [Automatic update for 2026-03-15] Mar 15, 2026 · release notes

    Adds new monero parsing commands via FCMP support in 7fcd0ef267

31. 3a808fee32 [Automatic update for 2026-03-01] Mar 1, 2026 · release notes

    New PROFINET PN-SXP dissector, IOGraph 100px move, and NFSv4 filename snooping

    └──▷ HOW TO FIND IT
    Quickly shift an IOGraph plot by large increments to inspect data further in the timeline without clicking repeatedly.
    📍Use Alt+Arrow keys in the io_graph window.
    Capture and decode PROFINET PN-SXP traffic using the new dissector.
    📍No extra steps; pn-sxp dissector is active by default in Wireshark.
    Analyze NFSv4 operations like SYMLINK or READDIRPLUS during traffic capture using filename snooping.
    📍No extra steps; filename snooping for NFSv4 is enabled by default in Wireshark.
    • io_graph window now supports moving plots by 100 pixels at a time using Alt+Arrow keys.
    • New pn-sxp dissector for PROFINET protocols added.
    • NFS dissection now includes filename snooping for NFSv4, with support for SYMLINK, MKNOD, and READDIRPLUS operations.

    3 details in Everything

32. b547532207 [Automatic update for 2026-02-22] Feb 22, 2026 · release notes

    Wireshark adds Lua bulk field API, strato exit codes, CAPWAP WTP IP, P4RPC time display, and DLMS/COSEM Green Book parsing

    • Adds WS_EXIT_ codes to tshark for granular process exit status reporting
    • Adds Lua functions for bulk field requests via the wireshark.field_requests API
    • Adds CAPWAP support for WTP Static IP Address Information message element decoding
    • Adds P4RPC display of haveRec fields and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-8601 time strings
    • Adds DLMS/COSEM address parsing compliance with the Green Book specification

    5 details in Everything

33. 51f787ea03 [Automatic update for 2026-02-08] Feb 8, 2026 · release notes

    Wireshark adds RESP Map support, mbim UICC padding fields, and fixes BLF crash

    • Adds Map and Attribute support for the RESP dissector protocol.
    • Expands mbim dissector to include UICC APDU padding field and combine UICC response APDU with status information.

    2 details in Everything

34. 1e164ad4d1 [Automatic update for 2026-01-11] Jan 11, 2026 · release notes

    Adds search bar to ExtCap multiselect and supports CAPWAP Image Identifier message element

    • extcap: add search bar to multiselect to improve usability when selecting from large lists of external capture tools
    • CAPWAP: Add support for Image Identifier message element in the dissector

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for converting from really old preferences is removed
35. 70848a8e14 [Automatic update for 2026-01-04] Jan 4, 2026 · release notes

    Adds MLO EAPOL decryption support and specific Stratoshark UI dialogs for macOS

    • dot11decrypt: Add MLO EAPOL decryption support
    • dot11decrypt: Support decrypting MLO packets using TK
    • dot11decrypt: Support AKM 18, 24, 25 with different PMK length
    • Create a main status bar specific to Stratoshark
    • Create a plot dialog specific to Stratoshark

    +2 more show less

    • Create an I/O graph dialog specific to Stratoshark
    • Create a welcome page specific to Stratoshark

    7 details in Everything

36. dd9add8a20 [Automatic update for 2025-12-21] Dec 21, 2025 · release notes

    Wireshark adds dissectors for Ultra Ethernet Transport, ORAN Tap improvements, and P4RPC support.

    • dissectors: Adds dissector for Ultra Ethernet Transport protocol
    • ORAN Tap improvement: Shows how many symbols appear to have taken too long

    2 details in Everything

37. 0d85cbc9c5 [Automatic update for 2025-12-14] Dec 14, 2025 · release notes

    NATS dissector gains per-operation visibility and INFO column support

    • Adds a dedicated tree item for each NATS protocol operation to clarify message structure.
    • Adds +OK and -ERR as recognized NATS operations in the dissector.
    • Writes individual NATS operation names into the INFO column for easier filtering.

    3 details in Everything

38. eb7ca7c27d [Automatic update for 2025-12-07] Dec 7, 2025 · release notes

    Adds CMake target to rebuild corba IDL dissectors

39. 0.22.2 Nov 24, 2025 · release notes

    Wireshark 0.22.2 adds OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. dissector, new RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. channels (ECAM/DR), and support for Ixia/CAM Inspector file formats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.22.2 https://github.com/wireshark/wireshark.git
    # already have the repo? check out this version:
    $ git checkout 0.22.2

    • Adds otp dissector to parse One-Time Password protocol traffic
    • Adds initial implementation of the MS-RDPECAM RDP channel (rdp_ecam) with reassembly logic
    • Adds parsing for rdp_dr smartcard and printers commands along with capability packets
    • Adds support for reading Ixia VeriWave capture files in wiretap
    • Adds support for reading CAM Inspector capture files in wiretap

    5 details in Everything

40. 08cfbf206a [Automatic update for 2025-11-23] Nov 23, 2025 · release notes

    Wireshark adds NL80211 MLO dissection and ORAN FH radio transport fragmentation support

    • Adds nl80211 support for the new NL80211_ATTR_MLO_LINKS attribute, enabling Multi-Link Operation decoding in Wi-Fi captures.
    • Implements radio transport layer fragmentation handling in the ORAN FH CUS dissector.

    2 details in Everything

41. f4591d260a [Automatic update for 2025-11-16] Nov 16, 2025 · release notes

    Wireshark adds ORAN FH CUS ST9 field, DNS over DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. disable for QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. conflict, and BT L2CAP FCS check.

    • ORAN FH CUS: SE 24 reserved bit is now posMeas
    • ORAN FH CUS: SINR - create subtree for each PRB
    • DNS: disable experimental DNS over DTLS conflicting with DNS over QUIC
    • USB-HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral.: Add support for GET_DESCRIPTOR in bRequest field
    • PGSQL: Dissect CopyBoth response

    +1 more show less

    • NFLOG: Enhance nflog dissect

    6 details in Everything

42. 07f3821021 [Automatic update for 2025-11-02] Nov 2, 2025 · release notes

    Wireshark/Stratoshark split with brand-specific dialogs and Falco file set support

    • Split I/O graph for Wireshark and Stratoshark allows separate graph configurations per application flavor.
    • Create an profile dialog specific to Stratoshark adds a dedicated UI dialog for Stratoshark settings.
    • Create an search frame specific to Stratoshark adds a dedicated search interface for Stratoshark.
    • Create an Follow Stream dialog specific to Stratoshark adds a dedicated follow stream view for Stratoshark.
    • Create an About dialog specific to Stratoshark adds a dedicated About screen for Stratoshark.

    +3 more show less

    • Falco capture recordings are now recognized by File sets: Add a pattern for Falco capture recordings.
    • HiPerConTracer dissector gains added "Decode As" support.
    • NetPerfMeter dissector gains added "Decode As" support and Improved retranstrials output.

    8 details in Everything

43. a5a6cb2653 [Automatic update for 2025-10-26] Oct 26, 2025 · release notes

    NetPerfMeter dissector adds QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. support; Mongo displays command name.

    • Adds NetPerfMeter dissector with QUIC protocol support
    • mongo dissector now includes the command name in the Info column

    2 details in Everything

44. afc63a5d8e [Automatic update for 2025-10-19] Oct 19, 2025 · release notes

    Wireshark adds dsraddresstositenames dissection, GNSS Galileo OSNMA support, Bluetooth UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. registration, and Ubiquiti AP parsing.

    • Netlogon dissector now decodes dsraddresstositenames[ex]w fields
    • New support for dissecting GNSS Galileo OSNMA DSM-PKR
    • Register Bluetooth UUID type in the protocol hierarchy
    • Added parsing logic for Ubiquiti AP names
    • TLS dissector handles Abbreviated Handshake Using New Session Ticket (RFC 9132)

    5 details in Everything

45. 9b4d49cd00 [Automatic update for 2025-10-12] Oct 12, 2025 · release notes

    Wireshark adds support for AMTRELAY DNS records, MS Procmon wiretap and dissector, and 24-bit linear audio decoding.

    • DNS: Add AMTRELAY resource record dissector
    • Initial MS Procmon wiretap and dissector
    • Codecs: Add a 24-bit linear audio decoder

    3 details in Everything

46. 4.6.0 Oct 8, 2025 · release notes

    Wireshark 4.6.0 adds NTP over NTS decryption, Zstd HTTP compression, new Plots dialog, and extensive protocol/decoding support.

    • Adds NTP packet decryption using Network Time Security (NTS), requiring NTS-KE packets and TLS client/exporter secrets.
    • Adds support for Zstandard (zstd) Content-Encoding in HTTP and HTTP/2 dissectors.
    • Adds a new Plots dialog providing scatter plots, supporting multiple plots, markers, and automatic scrolling.
    • Adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate export via File › Export Objects (X509AF) and TShark --export-objects x509af.
    • Adds float and double display filter functions for explicit type conversion in filters and custom columns.

    +2 more show less

    • Adds the Conversation object to the Lua API, exposing conversation data to scripts.
    • Adds support for importing hex dumps with 2-4 byte groups (little-endian option) and 0x prefixes.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !tshark -G with no argument is removed; use tshark -G fields instead.
    • !tshark -G fields syntax for prefix listing changed to tshark -G fields,prefix.
    • !Wireshark and TShark no longer support WinPcap; Windows users must uninstall it and use Npcap.
47. 93d102b8e7 [Automatic update for 2025-10-05] Oct 5, 2025 · release notes

    New CQLv5 dissector base, Asterix rewrite, GNSS OSNMA decoding, and wslua column separators.

    • Adds initial packet-cql.c implementation for CQLv5 protocol support
    • Rewrites the asterix dissector for improved parsing
    • Decodes Galileo OSNMA DSM-KROOT in GNSS traffic
    • Adds separator support to wslua column appending via wslua

    4 details in Everything

48. d876341b57 [Automatic update for 2025-09-21] Sep 21, 2025 · release notes

    Adds Time Display Format option for capture start time and JSON Lines export support.

49. 3217199f0a [Automatic update for 2025-09-14] Sep 14, 2025 · release notes

    Wireshark 3217199 adds OSPF Multi-Instance extensions, Nokia PFCP IEs, and RTPS TypeObjectV2 annotation parsing

    • Adds support for OSPF Multi-Instance Extensions (ospf dissector now parses MI-Opaque TLVs)
    • Adds Nokia-specific Information Element dissectors to the pfcp protocol parser
    • Enables parsing of RTPS TypeObjectV2 built-in annotations in the rtps dissector

    3 details in Everything

50. 95009130ee CMake+GitLab CI: Update Falco plugins to 2025-09-09 Sep 9, 2025 · release notes

    Wireshark adds http2 body decompression disable option and ORAN FH CUS beamspace/transaction index support

    • Adds http2.disable_body_decompression to control HTTP/2 payload expansion
    • Adds ORAN FH CUS: support for beamspace I/II to the Radio Layer dissection
    • Adds display of longest UL delay in the ORAN FH CUS command-line tap output
    • Adds display of correct trx index for BFW in ORAN FH CUS CLI tap
    • Adds dissection of Darwin metadata in pcapng files

    +1 more show less

    • Allows floating-point scale factors for Y-axis plots in Qt graphs

    6 details in Everything

51. dcee16148e [Automatic update for 2025-09-07] Sep 7, 2025 · release notes

    Wireshark adds CAN-XL packet support, GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. toggle for capture filter optimization, and Falco IP geolocation.

    • Adds LINKTYPE_CANXL dissector for decoding CAN-XL messages in captured traffic
    • Adds IP geolocation data to exported Falco event logs

    2 details in Everything

52. 4.4.8 Jul 16, 2025 · release notes

    Wireshark 4.4.8 updates protocol dissection for ASTERIX, DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches., DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic., IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., and more.

    • Updated protocol support for ASTERIX
    • Updated protocol support for DLT
    • Updated protocol support for DNP 3.0
    • Updated protocol support for DOF
    • Updated protocol support for DTLS

    +12 more show less

    • Updated protocol support for ETSI CAT
    • Updated protocol support for Gryphon
    • Updated protocol support for IPsec
    • Updated protocol support for ISObus VT
    • Updated protocol support for KRB5
    • Updated protocol support for MBIM
    • Updated protocol support for RTCP
    • Updated protocol support for SLL
    • Updated protocol support for STCSIG
    • Updated protocol support for TETRA
    • Updated protocol support for UDS
    • Updated protocol support for URL Encoded Form Data

    17 details in Everything

53. 4.4.5 Feb 24, 2025 · release notes

    Wireshark 4.4.5 updates GNW, IPv4, NFAPI, ProtoBuf dissectors and fixes crashes.

    • Updated GNW protocol dissector with new dissection logic
    • Updated IPv4 protocol dissector with new dissection logic
    • Updated NFAPI protocol dissector with new dissection logic
    • Updated ProtoBuf dissector with new dissection logic

    4 details in Everything

54. 4.4.2 Nov 20, 2024 · release notes

    Wireshark 4.4.2 changes TShark tshark -G fields,prefix syntax and restores profile switching.

    • Adds the fields,prefix comma-separated argument to the tshark -G fields command for dumping field lists with a specific prefix.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tshark -G fields prefix syntax is replaced by tshark -G fields,prefix.
55. 4.4.1 Oct 9, 2024 · release notes

    Wireshark 4.4.1 introduces TShark -G fields prefix syntax change and fixes several CVEs

    • TShark -G fields,prefix subcommand replaces the old -G fields prefix space-separated syntax for dumping field names with a specific prefix

    1 detail in Everything

56. 4.4.0 Aug 28, 2024 · release notes

    Wireshark 4.4 adds profile switching by filter, LZ4 compression support, and custom column expressions.

    • automatic profile switching allows Wireshark to associate a display filter with a configuration profile to automatically switch profiles when opening matching capture files
    • Capture files can now be saved with LZ4 compression using the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. or command-line tools, enabling fast random access for large captures
    • Custom columns in the GUI and custom output fields via tshark -e support valid field expressions including arithmetic, slices, logical tests, and display filter functions
    • Edit > Copy > Display filter as pcap filter now converts display filters to pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. filters when a corresponding equivalent exists for each field

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for Lua 5.1 and 5.2 has been removed; installers now ship with Lua 5.4.6 only
    • !The tvb_get_guintX and tvb_get_gintX API functions have been renamed to tvb_get_uintX and tvb_get_intX respectively
57. 4.2.0 Nov 15, 2023 · release notes

    Wireshark 4.2.0 adds raw byte filtering, column text filtering, and new protocols.

    • Adds @some.field == <bytes…> display filter syntax to match raw packet data.
    • Enables filtering by configured column text using _ws.col.<name> fields in display filters.
    • Adds TShark option --print-timers.
    • Supports HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer., ZigBee Direct (ZBD), Fibra UWB Controller Interface (UCI), and dozens of other protocols.
    • Adds Arm64 Windows installer.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The bundled script dtd_gen.lua has been removed from the installation.
    • !Wi-Fi NAN dissector filter name changed from nan to wifi_nan.
    • !Lua function package.prepend_path has been removed.
58. 4.0.6 May 24, 2023 · release notes

    Wireshark 4.0.6 adds case-insensitive media type matching per RFC 6838

    • The media type dissector table now properly treats media types and subtypes as case-insensitive automatically
    • Removed official support for 32-bit Windows packages in the 4.0 series

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Wireshark 4.0 and later no longer ships official 32-bit Windows packages; users must use the latest 3.6 release for that platform
59. 4.0.1 Oct 26, 2022 · release notes

    Wireshark 4.0.1 adds BLF capture file support and updates multiple protocol dissectors in the Windows Qt build.

    • Windows installers now ship with Qt 5.12.2 instead of Qt 6.2.3 for better stability on legacy systems
    • Added new and updated support for BLF capture file format
    • Updated protocol support for ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1 PER, CFDP, Diameter, DirectPlay, F5 Ethernet Trailer, GTP, H.223, H.248, H.264, H.265, IEEE 802.11, IPv4, MBIM, O-RAN FH CUS, PFCP, RTCP, SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking., SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., and TRANSUM

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The experimental display filter syntax for literals using angle brackets <…​> introduced in Wireshark 4.0.0 is removed; use a colon prefix for byte arrays instead
60. 4.0.0 Oct 4, 2022 · release notes

    Wireshark 4.0 adds display filter extensions (arithmetic, layers), new protocols, and redesigned Conversation/Endpoint dialogs.

    └──▷ TRY IT
    Match outer vs inner IP addresses in an IP-over-IP packet using the new layer syntax.
    copy

    $ ip.addr#1 == 1.1.1.1

    Check if ALL TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports are high ports (above 1024) in a packet.
    copy

    $ all tcp.port > 1024

    • Adds support for layer-specific matching in display filters using the '#' operator (e.g., ip.addr#1)
    • Adds universal quantifiers any and all to display filter relational operators
    • Adds arithmetic operators (+, -, *, /, %) and functions (max, min, abs) to display filters
    • Adds support for negative indexing of protocol fields in display filters (e.g., tcp[-2:])
    • Adds strict equality operator === and its negation !== to display filters

    +8 more show less

    • Redesigns the Conversation and Endpoint dialogs with detachable tabs and JSON export
    • Adds zbee_zcl_se.msg.msg_ctrl.deprecated field in ZigBee ZCL Messaging dissector
    • Adds support for IEEE 802.11 Mesh Connex (MCX) in the 802.11 dissector
    • Adds support for gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. fake headers in HTTP2 dissector for streams without initial HEADERS frames
    • Adds ciscodump support for IOS, IOS-XE and ASA remote capturing
    • Adds text2pcap option -F to select output capture file format
    • Adds text2pcap option -E to select encapsulation type for output files
    • Adds ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. (Event Tracing for Windows) support for live sessions and IP packet display

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The v switch in editcap is now uppercase V to match other utilities.
    • !The V switch in mergecap is now lowercase v to match other utilities.
    • !The ip.flags field is now only the three high bits; displays/filters using the full byte need adjustment.
    • !Whitespace-separated set elements (e.g., {1 2}) are now a syntax error; use commas instead.
    • !Unrecognized escape sequences in display filter strings are now syntax errors.
    • !Floats must have leading and trailing digits (e.g., 0.7 instead of .7).
    • !PCRE2 replaces GRegex for display filter regex; some exotic patterns may need rewriting.
    • !The ~= operator is deprecated; use !== instead.
    • !The -n flag in text2pcap to select pcapng is deprecated; pcapng is now the default.
    • !The -d flag in text2pcap is removed; use log levels debug or noisy via -o instead.
    • !CMake options starting with DISABLE_ are renamed to ENABLE_ (e.g., DISABLE_WERROR=On becomes ENABLE_WERROR=Off).
    • !In proto.h, field display types STR_ASCII and STR_UNICODE are removed; use BASE_NONE.
    • !In proto.h, the display type BASE_FLOAT is removed; use BASE_DEC, BASE_HEX, BASE_EXP, or BASE_CUSTOM.
61. 3.6.4 May 4, 2022 · release notes

    Wireshark 3.6.4 updates protocol support for CQL, DHCPv6, ICMPv6, IEEE 802.11, NAS-5GS, NetFlow/IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture., RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and UDS.

    └──▷ BREAKING ON UPGRADE

    • !This is the last release branch with support for 32-bit Windows; updates will no longer be available after May 22, 2024.
62. 3.4.11 Dec 29, 2021 · release notes

    Wireshark 3.4.11 adds RFC 7468 capture file support and updates protocol dissector coverage.

    • Adds RFC 7468 to the list of supported capture file formats for reading and writing.

    1 detail in Everything

63. 3.6.1 Dec 29, 2021 · release notes

    Wireshark 3.6.1 adds backward-compatible CLI flag -o console.log.level: to map to new logging subsystem.

    • Adds the -o console.log.level: CLI option in tshark and wireshark to provide backward compatibility with the removed console.log.level preference.
    • Adds support for parsing BLF capture file format.
    • Adds support for parsing RFC 7468 (PEM) file format.

    3 details in Everything

64. 3.6.0 Nov 22, 2021 · release notes

    Wireshark 3.6.0 adds new protocol dissectors, display filter syntax updates, and TShark TLS key export capability

    └──▷ HOW TO FIND IT
    Access the redesigned RTP Player via the menu to play and analyze VoIP streams.
    📍Telephony › RTP › RTP Player
    • TShark can now export TLS session keys with the --export-tls-session-keys option.
    • Display filter set elements must now be comma-separated (e.g., {"GET", "HEAD"}).
    • The display filter expression a != b now has the same meaning as !(a == b), with a ~= b or a any_ne b for previous behavior.
    • Wireshark supports dissecting OPUS payloads in RTP packets.
    • A new macOS Arm 64 (Apple Silicon) package is available for Wireshark.

    +17 more show less

    • Support for the syntax a not in b with the same meaning as not a in b has been added to display filters.
    • The macOS Intel packages require macOS 10.13 or later.
    • Windows installers now ship with Npcap 1.55.
    • A 64-bit Windows PortableApps package is now available.
    • New File Format Decoding Support for Vector Informatik Binary Log File (BLF).
    • Wireshark now supports dissecting Event Tracing for Windows (ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors.) via a new extcap named ETW reader and packet_etw dissector.
    • A new Follow DCCP stream feature allows filtering and extracting contents of DCCP streams.
    • Importing captures from text files based on regular expressions is now possible with various data encodings (plain-hexadecimal, octal, binary, base64).
    • The RTP Player has been significantly redesigned: it can play many streams in row, mute or route audio, and save to multichannel .au or .wav.
    • VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. Flows) are now non-modal.
    • The Follow Stream dialog can now follow SIP calls based on their Call-ID value.
    • The Follow Stream dialog’s YAML output format now includes timestamps and peers information.
    • IP fragments between public IPv4 addresses are reassembled even if they have different VLAN IDs, controlled by the Enable stricter conversation tracking heuristics preference.
    • USB Link Layer reassembly has been added for hardware captures.
    • Protobuf fields missing in capture files can now be displayed with default values via the add_default_value preference.
    • New Protocol Support for 5GLI, BT LMP, BPv7, BPSec, COSE, E2AP, ETW, EXEH, HiPerConTracer, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 10681, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. SPAKE, Linux psample, LIN, Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane, OPUS, PDU Transport Protocol, R09.x, DRDYNVC, EGFX, RDPMT, RTPS-VT, RTPS-PROC, SMC, Signal PDU, SparkplugB, SSyncP, TIFF, TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, RDPUDP, VJC, WOWW, and xIRI.
    • Wireshark now supports the Turkish language.

    22 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The display filter expression a != b no longer uses inconsistent logic for multi-value fields; use a ~= b or a any_ne b if the previous behavior is needed.
    • !Display filter set elements must now be comma-separated; whitespace-only separation is deprecated and will be removed in a future version.
    • !macOS Intel packages require macOS 10.13 or later.
65. 3.4.2 Dec 18, 2020 · release notes

    Wireshark 3.4.2 updates protocol support for DOCSIS, FC-dNS, FCoE, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking., SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. and USBHID.

66. 3.4.0 Oct 29, 2020 · release notes

    Wireshark 3.4.0 adds packet diagram view, HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. and numerous protocol dissectors, and Protobuf filtering.

    • The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram
    • Adds support for Protobuf fields to be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching.
    • Adds Dissectors based on protobuf_field dissector table, keyed with the full names of fields, for further parsing fields of BYTES or STRING type.
    • Supports decoding, playing, and saving iLBC payload on platforms where the iLBC library is available.
    • Supports decoding, playing, and saving opus payload on platforms where the opus library is available.

    +6 more show less

    • Adds Decode As entries can now be copied from other profiles using a button in the dialog.
    • Adds sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile.
    • Filter buttons (Preferences → Filter Buttons) can be grouped by using “//” as a path separator in the filter button label.
    • Adds IPP Over USB packets can now be dissected and displayed
    • Supports Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. (BT HCI ISO), Cisco MisCabling Protocol (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.), Community IDCommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources. Flow Hashing (CommunityID), DCE/RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER)
    • Adds support for MP4 (ISO/IEC 14496-12) capture file support.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency.
67. 3.0.11 May 19, 2020 · release notes

    Wireshark 3.0.11 updates Windows installer base to Qt 5.12.8 and refreshes protocol dissector support.

    • The Windows installers now ship with Qt 5.12.8 instead of the previous version 5.12.6.
    • Updated protocol support for AoE, APRS, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1 BER, FTP, GSM SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., Infiniband, ISObus VT, MAC LTE, NFS, ONC RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets., OSC, pcapng, PDCP LTE, SDP, SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic., Snort, STUN, and UMTS FP.

    2 details in Everything

68. 3.2.0 Dec 18, 2019 · release notes

    Wireshark 3.2.0 adds WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. pcapng key support, -z credentials tap, and drag-and-drop filter creation.

    • Adds the -z credentials option to tshark to extract credentials from capture files
    • Adds drag-and-drop support to create display filters or columns from packet fields

    2 details in Everything

69. 3.0.2 May 21, 2019 · release notes

    New QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. dissector added for IETF QUIC protocol analysis

    • Updated Protocol Support: QUIC.

    1 detail in Everything

70. 3.0.0 Feb 28, 2019 · release notes

    Wireshark 3.0.0 adds TShark elastic mapping, WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. decryption, and multiple new protocol dissectors.

    • Adds editcap --inject-secrets option to inject TLS Key Log files into pcapng files
    • Adds -G elastic-mapping option to TShark to generate ElasticSearch mapping files
    • Supports decryption for WireGuard using the new dissector (requires Libgcrypt 1.8)
    • Adds support for PKCS #11 tokens for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. decryption in TLS via Preferences > RSA Keys
    • Supports DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. and TLS decryption using pcapng Decryption Secrets Block containing TLS Key Log

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code.+ user interface has been removed
    • !TShark’s -z compare option was removed
    • !Lua logging functions (debug, info, message, warn, critical) have been removed; use print instead
    • !Building Wireshark requires CMake; Autotools is no longer supported
71. 2.6.5 Nov 28, 2018 · release notes

    Wireshark 2.6.5 adds sshdump capture interface and updates protocol dissectors.

    • Updates protocol support for BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes., DCERPC, DCOM, DNS, EAP, ESP, GSM A BSSMAP, IEEE 802.11, IPv4, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., ISUP, LBMPDM, LISP, MLE, MMSE, OpcUa, PVFS, SLL, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS, SV, TACACS+, TCAP, Wi-SUN, XRA, and ZigBee ZCL.

    1 detail in Everything

72. 2.6.0 Apr 24, 2018 · release notes

    Wireshark 2.6.0 adds hardware-timestamp support, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. dissector, MaxMind DB, and many new protocols.

    • --color option added to TShark for colored output
    • Hardware-timestamping of packets now supported
    • MaxMind DB files now supported (GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services./Legacy removed)
    • Capinfos now prints SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes (MD5 output removed)
    • Display filter membership operator now supports ranges (e.g., tcp.port in {4430..4434})

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GeoIP and GeoLite Legacy database support removed; use MaxMind DB instead
73. 2.4.0 Jul 19, 2017 · release notes

    Wireshark 2.4.0 adds 39 new protocols, TLS 1.3 support, and TShark object export

    • Enables TShark object export via the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.-style interface, matching other interfaces.
    • Adds experimental fullscreen mode for wider packet view in the GUI.
    • Adds support for SS7 Point Code name resolution using a hosts-like file.
    • Adds G.722 and G.726 codec support in the RTP Player (via SpanDSP library).
    • Allows selection of output device when playing RTP streams in the GUI.

    +12 more show less

    • Adds unit name capability to dissectors, allowing automatic seconds or ms suffixes for hf fields.
    • Enables resetting the Default profile to default values in the GUI preferences.
    • Adds forward and backward navigation in selection history within the Qt UI.
    • Introduces UAT for IEEE 802.15.4802.15.4An IEEE standard defining the physical and MAC layers for low-rate wireless personal area networks, used as the radio foundation for protocols like Zigbee and Thread in embedded and IoT device research. decryption keys, obsoleting the original preference key.
    • Allows extcap utilities to provide configuration for GUI toolbar controls during capture.
    • Enables validation of capture filters by extcap utilities.
    • Expands len() display filter function to work on all string and byte fields.
    • Adds experimental timeline view for 802.11 wireless packets via 802.11 radio information preferences.
    • Adds TLS 1.3 (draft 21) dissection and decryption support.
    • Allows changing the Application Layer Protocol (e.g., HTTP, CoAP) for (D)TLS in the Decode As dialog.
    • Improves RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. keys dialog feedback for invalid settings and removes mandatory IP/Port/Protocol fields when Key File is set.
    • Enhances TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Analysis to detect and flag more spurious retransmissions.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The wlan_mgt display filter element is renamed to wlan in IEEE 802.11 dissectors, breaking filters that rely on the old name.
74. 2.2.0 Sep 7, 2016 · release notes

    Wireshark 2.2.0 adds TLS decode-as, JSON export for GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. and TShark, and -d CLI flag.

    • Adds -d option to enable Decode As support from the command line in Wireshark.
    • Adds support for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. (TLS) over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. in the Decode As feature.
    • Enables the Qt GUI, GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code.+ GUI, and TShark to export captured packets as JSON.
    • Allows TShark to export packets as Elasticsearch-compatible JSON.
    • Adds -U flag to TShark for exporting PDUs.

    +1 more show less

    • Adds new protocol support including Apache Cassandra CQL 3.0, Zigbee Protocol Clusters, and Intel Omni-Path Architecture.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Wireshark no longer provides packages for 32-bit versions of OS X.
75. 2.0.0 Nov 18, 2015 · release notes

    Wireshark 2.0 introduces a new Qt UI, external capture interfaces (extcap), and Lua plugin reload support.

    • wireshark command now defaults to the new Qt user interface instead of Gtk+.
    • Lua plugins can be reloaded at runtime from the Analyze menu without restarting the application.
    • TShark ring-buffer mode now correctly resets its state when switching files in a ring.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python bindings support has been removed; use Lua for custom dissectors.
    • !The emem framework and all ep_/se_ memory allocation routines have been removed in the libwireshark API.
76. 1.12.0 Jul 31, 2014 · release notes

    Wireshark 1.12.0 adds Qt dialogs, HTTP2/QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. support, editcap offset/choplen, and libwireshark API updates

    • Adds editcap -L flag to adjust original frame length alongside -C choplen or -s snaplen.
    • Allows passing the -C option to editcap multiple times in a single invocation for chopping bytes from both packet start and end.
    • Adds optional offset parameter to the editcap -C flag to start chopping from a specific byte position rather than absolute boundaries.
    • Adds new expert information filterable API, replacing the old expert info handling mechanism.
    • New libwireshark modular memory manager (wmem) is now mature and replaces the deprecated emem API.

    +8 more show less

    • Renames tvb_length to tvb_captured_length and deprecates tvb_get_string/tvb_get_stringz in favor of _enc variants in the libwireshark API.
    • Changes dissector_try_heuristic() signature to return heur_dtbl_entry_t for saving and reusing entries to reduce overhead.
    • Adds Number column support to show related packets and protocol conversation spans (Qt only).
    • Adds several new Qt dialogs: About, Capture Interfaces, Decode As, Export PDU, Statistics tree, I/O Graph, and Flow Graph (sequence diagram).
    • Follow Stream dialog in Qt now supports packet and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream selection.
    • Main window now respects geometry preferences in the Qt port.
    • Support for all versions of the DCBx protocol.
    • Adds support for 29West, 802.1AE Secure tag, A21, HTTP2, QUIC, Kafka, and many other protocols (see full list in release notes).

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tvb_length function is renamed to tvb_captured_length.
    • !The tvb_get_string and tvb_get_stringz functions are deprecated in favor of tvb_get_string_enc and tvb_get_stringz_enc.
    • !The dissector_try_heuristic() signature has changed to return heur_dtbl_entry_t instead of its previous return type.
77. 1.10.0 Jun 5, 2013 · release notes

    Wireshark 1.10.0 adds HTTP response time correlation, hex-only Tshark output, and 47 new protocol dissectors.

    • Adds HTTP response time calculation and links between request and response frames in the Wireshark UI
    • Adds support for 47 new protocols including Bitcoin, WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. Datachannel (RTCDC), Skype, and OpenVPN
    • Adds ability to open a referenced packet (such as a matched request or response) in a new window from the Wireshark interface
    • Updates Tshark’s -G fields option to include previous fields2/fields3 content, eliminating -G fields2 and -G fields3 subcommands

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tshark flags -G fields2 and -G fields3 have been eliminated; use -G fields instead
78. 1.8.0 Jun 21, 2012 · release notes

    Wireshark 1.8.0 introduces multi-interface capture, pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-ng default, TShark -P/-S flags, annotations, and dozens of new protocol dissection capabilities.

    • Adds multiple interface capture support to allow capturing from several network interfaces simultaneously
    • Changes the default capture file format from pcap to pcap-ng for Wireshark and TShark
    • Renames the undocumented -P command-line option in TShark to -2 for two-pass analysis
    • Introduces the -P flag in TShark to print packets even when writing to a file, replacing the former behavior of -S
    • Introduces the -S flag in TShark to specify a different line separator between packets

    +4 more show less

    • Adds the ability to add, edit, and save packet and capture file annotations via the UI
    • Enables OID resolution on 64-bit Windows platforms
    • Adds support for GeoIP IPv6 databases
    • Adds new protocol dissection support including WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments., GlusterFS, HDFS, CANopen, and others listed in the release notes

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !TShark's command-line options have changed: the previously undocumented -P option is now -2 for two-pass analysis; the former -S option is now -P for printing packets; and -S now specifies a line separator.
79. 1.6.0 Jun 7, 2011 · release notes

    Wireshark 1.6.0 adds named protocol support, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. key export, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. object export, and TShark service time stats.

    • Adds File -> Export -> SSL Session Keys... menu item to export SSL session keys.
    • Adds SMB object export capability.
    • TShark -z option uses [-z <proto>,srt] syntax for service response time statistics across all supported protocols.
    • TShark can display iSCSI, ICMP and ICMPv6 service response times.
    • TShark can read and write host name information from/to pcapng-formatted files via [-z hosts] dump option.

    5 details in Everything

80. 1.4.0 Aug 30, 2010 · release notes

    Wireshark 1.4.0 adds Python scripting support, 802.11 monitor mode via CLI, direct JPEG opening, and jump-to-timestamp command.

    • Adds jump to timestamp command-line option for Wireshark
    • Enables 802.11 monitor mode directly in Wireshark/TShark with libpcap 1.0.0+
    • Adds support for opening JPEG files directly in Wireshark
    • Adds TShark privilege separation allowing interface listing without elevated privileges
    • Adds time order checking and forcing in Capinfos and editcap

    +5 more show less

    • Adds columns with seconds displayed as hours, minutes, and seconds
    • Adds manual IP address resolution capability
    • Adds packets ignoring (exclusion) functionality similar to marking
    • Adds new protocol dissection support for 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, and dozens of other protocols
    • Adds new capture file format support including pcapng, Endace ERF, and JPEG/JFIF

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Wireshark 1.4 does not support Windows 2000; users must use Wireshark 1.2 or 1.0 on those systems.
81. 1.2.6 Jan 27, 2010 · release notes

    Wireshark 1.2.6 improves feature parity for 64-bit Windows installers with new support for matches, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services., and decryption.

    • The 64-bit Windows installer now supports the matches operator for display filters
    • The 64-bit Windows installer now supports GeoIP location resolution
    • The 64-bit Windows installer now supports most types of packet decryption

    3 details in Everything

82. 1.2.0 Jun 15, 2009 · release notes

    Wireshark 1.2.0 adds display filter autocomplete, PcapPcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-ng support, OpenStreetMapOpenStreetMapA free, community-maintained world map database anyone can query or download, giving cyber tools access to geographic and infrastructure data without licensing fees or API rate limits tied to commercial providers. integration, and hundreds of new protocol dissectors.

    • Adds autocomplete to Display Filters so filter expressions complete as you type
    • Introduces Pcap-NG as a supported capture file format for both capture and playback
    • Adds OpenStreetMap integration combined with GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. database lookups to visualize traffic on maps
    • Provides Capinfos output that includes the average packet rate statistic
    • Adds support for saving column widths and the last used configuration profile between sessions

    +3 more show less

    • Enables changing Protocol Preferences directly from the Packet Details context menu without navigating the global preferences dialog
    • Supports IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture.-based process information correlation for mapping packets to local processes
    • Allows IP packet comparison capabilities for analyzing duplicate or altered payloads

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GTK1 is no longer supported, requiring users to have GTK2 or later installed to run the cyber tool
83. 1.0.1 Jun 30, 2008 · release notes

    Wireshark 1.0.1 adds custom columns and experimental Mac OS X package support.

    • Includes an experimental Mac OS X package for installation.

    1 detail in Everything

84. 1.0.0 Mar 31, 2008 · release notes

    Wireshark 1.0.0 adds custom columns and new protocol support for IEEE 802.15.4802.15.4An IEEE standard defining the physical and MAC layers for low-rate wireless personal area networks, used as the radio foundation for protocols like Zigbee and Thread in embedded and IoT device research.

    • Adds support for custom columns in the packet list view.
    • Adds IEEE 802.15.4 to the list of supported protocols.
    • Adds Infiniband protocol dissection capability.
    • Adds Parallel Redundancy Protocol support.
    • Adds RedBack Lawful Intercept support.

    +2 more show less

    • Adds Xcsl protocol support.
    • Introduces an experimental Mac OS X package.

    7 details in Everything

85. 0.99.8 Feb 27, 2008 · release notes

    Multiple configuration profiles and temporary coloring rules for conversations

    • Adds support for multiple configuration profiles to save and switch settings sets
    • Adds WLAN traffic statistics view in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
    • Adds RPCAP support to the Wireshark GUI for remote capture

    3 details in Everything

86. 0.99.7 Dec 18, 2007 · release notes

    Wireshark 0.99.7 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. OID filtering, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. stream following, graph export, and new protocol coverage.

    • Adds snmp.object-id display filter support for filtering directly on SNMP OIDs
    • Enables follow UDP streams in addition to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. streams
    • Adds graph export capability to IO graphs
    • Allows disabling coloring rules without deleting them
    • New Protocol Support: ANSI TCAP, EtherCAT, Wake on LAN, and others

    +1 more show less

    • Capture code refactored out of GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.; Wireshark no longer requires root privileges

    6 details in Everything

87. 0.99.6 Jul 5, 2007 · release notes

    Wireshark 0.99.6 adds HTTP object export, display filter macros, and extensive new protocol support.

    • Adds File → Export → Objects → HTTP to export HTTP objects directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    • Supports display filter macros for complex filter reuse.
    • Adds frame.time_delta_displayed display filter to match delta time between current and previous displayed packet.
    • Enables case-insensitive matching with the contains operator via standardization of upper() usage, e.g., upper(http.request.method) contains "GET".
    • Adds new protocol dissector support for AMQP, BCTP Q.1990, Borland StarTeam, Cisco ERSPANERSPANA Cisco-originated GRE-based tunneling protocol that encapsulates mirrored network traffic and ships it across Layer 3 to a remote capture point, letting cyber tools analyze traffic from distant segments without local tap hardware., CTDB, DRDA, DTPT, EPMD, FCoE, Firebird/Interbase, FMP, H.248.10, H.248.7, IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications./ISAKMP over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., Kingfisher, MIKEY, MPEG, NSRP, OpcUa Binary Protocol, PPI, Q.932, QSIG, TAPA, WiMAX, and WiMAX M2M.

    +2 more show less

    • Adds new capture file support for DCT2000, Endace ERF, iSeries, K12, MPEG Audio (.mp3), NetMon, pppdump, snoop, Visual Networks, and Windows Sniffer (NetXRay).
    • Removes need to restart Wireshark after changing column preferences.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The configure script will now fail, rather than automatically building only TShark, if run on a system that does not have GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code.+ headers and libraries installed; users must explicitly pass --disable-wireshark to build TShark in this environment.
88. 0.99.5 Feb 1, 2007 · release notes

    Wireshark 0.99.5 adds WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2 and SNMPv3 decryption, new protocol support, and TDS password de-obfuscation.

    • Adds decryption support for WPA/WPA2 networks
    • Adds decryption support for SNMPv3 communications
    • Enables TDS / MS SQL dissector to de-obfuscate passwords
    • Allows capturing on multiple AirPcap adapters simultaneously in raw mode under Windows
    • Adds user-specified ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1 syntax for dissecting ASN.1 BER-encoded files

    +4 more show less

    • Makes the Find function select the corresponding packet detail item
    • Adds Find functionality to the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream dialog
    • Adds Find functionality to the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. stream dialog
    • New protocol support for DMP, Homeplug (INT51X1), NBD, OMAPI, PKCS#12PKCS#12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file., RGMP, Roofnet, and STUN v2

    9 details in Everything

89. 0.99.4 Oct 31, 2006 · release notes

    Wireshark 0.99.4 adds new protocol dissectors including USB, PNG, and LINX, plus multi-channel AirPcap capture.

    • Adds support for live USB packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. via the usbmon module on Linux (kernel >= 2.6.11)
    • Adds new protocol dissector for Enea LINX
    • Adds new protocol dissector for Ethernet Powerlink (v1 and v2)
    • Adds new protocol dissector for H.248 Q.1950 Annex A
    • Adds new protocol dissector for Linux pktgen

    +11 more show less

    • Adds new protocol dissector for MP2T
    • Adds new protocol dissector for NEWMAIL
    • Adds new protocol dissector for PNG
    • Adds new protocol dissector for SCSI OSD
    • Adds new protocol dissector for UDLD
    • Adds new protocol dissector for UMTS FP
    • Adds new protocol dissector for USB
    • Adds new protocol dissector for WLCCP
    • Adds new protocol dissector for WZCSVC
    • Enhances AirPcap support to allow capturing on multiple adapters simultaneously using the Multi-Channel Aggregator
    • Enhances VoIP call playback to allow G.711 conversation playback when linked with PortAudio

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Save button is removed from the Ok / Apply / Cancel button group in Edit/Preferences, View/Coloring Rules, Capture/Capture Filters, Analyze/Display Filters, and Analyze/Enabled Protocols dialogs; it can be resurrected in User Interface preferences if needed
90. 0.99.3 Aug 23, 2006 · release notes

    Wireshark 0.99.3 adds AirPcap support, firewall ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. generation, and Windows decryption

    • Adds AirPcap support, including raw 802.11 captures under Windows
    • Enables generating ACL rules for several popular firewall products
    • Adds ESP, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. decryption to the Windows installer

    3 details in Everything

91. 0.99.2 Jul 17, 2006 · release notes

    Wireshark 0.99.2 adds multicast stream analysis, RTP listening via PortAudio, and new protocol support including Bluetooth HCI and DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic..

    • Adds Statistics -> Multicast Streams for burst size, buffer size, and loss analysis
    • Adds support for Bluetooth HCI (ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., Command, Event, L2CAP, H4, RFCOMM, SCO, SDP), Cisco WIDS, DTLS, Ether-S-Bus, OMA ULP, PN-MRP, PN-MRRT, REXEC, RRLP, RSerPool, Telkonet, and TiVoConnect Discovery Protocol
    • Adds BER-encoded file read support in New and Updated Capture File Support

    3 details in Everything