https://cybertoolchain.io/tools/wireshark New releases and features in Wireshark, tracked by The Cyber Toolchain. en Sun, 21 Jun 2026 00:00:00 GMT https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 21 Jun 2026 00:00:00 GMT Wireshark adds HTTP QUERY method support, SMB2 async comm, sharkd socket options, and more • Adds `QUERY` method and `Accept-Query` header field support in the HTTP dissector • Adds SMB2 support for asynchronous communications • Adds `--install-optional` argument handling to `haiku-setup.sh` script for Haiku OS setup • Enables Unix Domain Sockets on Windows via sharkd when available Breaking changes: • sharkd now restricts TCP socket connections to loopback addresses only (IPv4 or IPv6) • sharkd on Linux abstract sockets now only allows peers with the same eUID to connect Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 14 Jun 2026 00:00:00 GMT Wireshark adds support for injecting Encrypted Client Hello and TLS secrets from F5 Trailers. • Adds `tls.secrets` injection for Encrypted Client Hello (ECH) to improve ECH traffic decryption • Adds F5 Trailer dissector with TLS secrets extraction to capture handshake keys directly from F5-specific trailer fields Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 07 Jun 2026 00:00:00 GMT Wireshark auto-installs opencore DLLs on MSYS2 and makes Funnel plugins load at startup • Packaging now automatically installs the `opencore` DLLs for MSYS2 builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 31 May 2026 00:00:00 GMT Adds 'Stratoshark theme' to Qt UI, per-flavor default selection and new Bill Validator Dissector for mdb. • Adds the Stratoshark theme option in the Qt Profile Dialog alongside per-flavor default selection logic. • Introduces a named `Bill Validator` dissector under the `mdb` protocol tree in packet details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 24 May 2026 00:00:00 GMT Wireshark adds IEEE 802.11 WNM Sleep Mode dissection and Netlink MPR support • Adds `WNM Sleep Mode` subelement dissection for IEEE 802.11 frames • Adds MPR (Multi-Packet Reception) support to the nvme-mi dissector • Adds `NL80211_ATTR_PROTOCOL_FEATURES` value dissection to the nl80211 dissector Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 03 May 2026 00:00:00 GMT Wireshark adds HiPerConTracer timestamp presentation improvement, PROFINET PROFIsafe fixes, and wslua debug hook granularity. • Improved send timestamp presentation in the HiPerConTracer dissector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 26 Apr 2026 00:00:00 GMT New etype 0x8905 decoding, DIS radio stream analysis, and ENIP LLDP support • Adds `etype 0x8905` as Cisco TTAG by default in Kerberos decryption logic • Adds radio stream analysis support for the DIS protocol dissector • Adds LLDP management support to the ENIP dissector Breaking changes: • Removes the 3DES-only libnettle implementation from Kerberos support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 19 Apr 2026 00:00:00 GMT Adds Lua Debugger with editing and stepping capabilities; supports SM2/SM3/SM4 in RTPS security. • `Lua Debugger`: Adds `Step Over`, `Step In`, `Step Out`, editable script editor, and unsaved indicator to the Qt GUI under Tools menu • RTPS dissector: adds recognition of SM2, SM3, and SM4 algorithms in security attributes • sharkd protocol: requires mandatory comment parameter for `setcomment` action; implements skeleton for `cf_close` Breaking changes: • `sharkd setcomment` action now mandates a comment parameter, which will fail calls providing an empty or missing argument. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 05 Apr 2026 00:00:00 GMT Wireshark eba43a6f74 adds font zooming via scroll wheel, new Zigbee StringN support, and ORAN FH CUS dissector cleanup. • Adds `CTRL + scroll` zooming to the Show Packet Bytes pane in Qt builds • Supports retrieving the MSB 32 bits of the XPN for MKA/MACsec Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 29 Mar 2026 00:00:00 GMT Wireshark adds MKA XPN support, PROFINET SXP improvements, and multi-rule coloring • Implement `XPN Cipher Suites` for MKA/MACsec protocol analysis • Add ability to display multiple `Coloring Rules` simultaneously in the GUI • Add new `s6c AVPs` and enhance `S6c` support for Diameter protocol dissector • Add `Mailbox-VoE` dissector for EtherCAT, with mailbox activation enabled • Add `VNI` and `Group Policy ID` to the VXLAN tree item display • Add `MWD-Status Decode` for the Diameter protocol • Add new `TCP/IP Interface Object attributes` support in the ENIP dissector • Add support for new `QoS attributes` in the ENIP dissector Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 22 Mar 2026 00:00:00 GMT Adds LS ELECTRIC XGT protocol dissector, TTL Ethertype support, and NATS Decode As handling • `epan` adds a new dissector for the LS ELECTRIC XGT protocol. • `TTL` adds a new Ethernet Type (Ethertype) for Traffic Tagged Link Layer with preference to dissect payload. • `NATS` adds Decode As handling to allow manual protocol selection. • `CAN` and `LIN` protocols add `can_get_bus_id_from_interface_name` and `lin_get_bus_id_from_interface_name` functions respectively. • `TTL` gains support for Segmented Message Entry reassembly. • `Modbus` dissector distinguishes between "RTU over TCP" and "RTU only" modes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 15 Mar 2026 00:00:00 GMT Adds new monero parsing commands via FCMP support in 7fcd0ef267 • Adds new `FCMP` commands for Monero protocol dissection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 01 Mar 2026 00:00:00 GMT New PROFINET PN-SXP dissector, IOGraph 100px move, and NFSv4 filename snooping • `io_graph` window now supports moving plots by 100 pixels at a time using `Alt+Arrow` keys. • New `pn-sxp` dissector for PROFINET protocols added. • NFS dissection now includes filename snooping for NFSv4, with support for SYMLINK, MKNOD, and READDIRPLUS operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 22 Feb 2026 00:00:00 GMT Wireshark adds Lua bulk field API, strato exit codes, CAPWAP WTP IP, P4RPC time display, and DLMS/COSEM Green Book parsing • Adds `WS_EXIT_` codes to `tshark` for granular process exit status reporting • Adds Lua functions for bulk field requests via the `wireshark.field_requests` API • Adds CAPWAP support for WTP Static IP Address Information message element decoding • Adds P4RPC display of "haveRec" fields and ISO-8601 time strings • Adds DLMS/COSEM address parsing compliance with the Green Book specification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 08 Feb 2026 00:00:00 GMT Wireshark adds RESP Map support, mbim UICC padding fields, and fixes BLF crash • Adds Map and Attribute support for the RESP dissector protocol. • Expands mbim dissector to include UICC APDU padding field and combine UICC response APDU with status information. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 11 Jan 2026 00:00:00 GMT Adds search bar to ExtCap multiselect and supports CAPWAP Image Identifier message element • extcap: add search bar to multiselect to improve usability when selecting from large lists of external capture tools • CAPWAP: Add support for Image Identifier message element in the dissector Breaking changes: • Support for converting from really old preferences is removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 04 Jan 2026 00:00:00 GMT Adds MLO EAPOL decryption support and specific Stratoshark UI dialogs for macOS • `dot11decrypt`: Add MLO EAPOL decryption support • `dot11decrypt`: Support decrypting MLO packets using TK • `dot11decrypt`: Support AKM 18, 24, 25 with different PMK length • Create a main status bar specific to Stratoshark • Create a plot dialog specific to Stratoshark • Create an I/O graph dialog specific to Stratoshark • Create a welcome page specific to Stratoshark Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 21 Dec 2025 00:00:00 GMT Wireshark adds dissectors for Ultra Ethernet Transport, ORAN Tap improvements, and P4RPC support. • `dissectors`: Adds dissector for Ultra Ethernet Transport protocol • `ORAN Tap` improvement: Shows how many symbols appear to have taken too long Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 14 Dec 2025 00:00:00 GMT NATS dissector gains per-operation visibility and INFO column support • Adds a dedicated tree item for each NATS protocol operation to clarify message structure. • Adds `+OK` and `-ERR` as recognized NATS operations in the dissector. • Writes individual NATS operation names into the INFO column for easier filtering. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 07 Dec 2025 00:00:00 GMT Adds CMake target to rebuild corba IDL dissectors • Adds a new CMake target that allows developers to rebuild CORBA IDL dissectors automatically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Mon, 24 Nov 2025 00:00:00 GMT Wireshark 0.22.2 adds OTP dissector, new RDP channels (ECAM/DR), and support for Ixia/CAM Inspector file formats. • Adds `otp` dissector to parse One-Time Password protocol traffic • Adds initial implementation of the MS-RDPECAM RDP channel (`rdp_ecam`) with reassembly logic • Adds parsing for `rdp_dr` smartcard and printers commands along with capability packets • Adds support for reading Ixia VeriWave capture files in `wiretap` • Adds support for reading CAM Inspector capture files in `wiretap` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 23 Nov 2025 00:00:00 GMT Wireshark adds NL80211 MLO dissection and ORAN FH radio transport fragmentation support • Adds `nl80211` support for the new `NL80211_ATTR_MLO_LINKS` attribute, enabling Multi-Link Operation decoding in Wi-Fi captures. • Implements radio transport layer fragmentation handling in the `ORAN FH CUS` dissector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 16 Nov 2025 00:00:00 GMT Wireshark adds ORAN FH CUS ST9 field, DNS over DTLS disable for QUIC conflict, and BT L2CAP FCS check. • ORAN FH CUS: SE 24 reserved bit is now posMeas • ORAN FH CUS: SINR - create subtree for each PRB • DNS: disable experimental DNS over DTLS conflicting with DNS over QUIC • USB-HID: Add support for GET_DESCRIPTOR in bRequest field • PGSQL: Dissect CopyBoth response • NFLOG: Enhance nflog dissect Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 02 Nov 2025 00:00:00 GMT Wireshark/Stratoshark split with brand-specific dialogs and Falco file set support • `Split I/O graph for Wireshark and Stratoshark` allows separate graph configurations per application flavor. • `Create an profile dialog specific to Stratoshark` adds a dedicated UI dialog for Stratoshark settings. • `Create an search frame specific to Stratoshark` adds a dedicated search interface for Stratoshark. • `Create an Follow Stream dialog specific to Stratoshark` adds a dedicated follow stream view for Stratoshark. • `Create an About dialog specific to Stratoshark` adds a dedicated 'About' screen for Stratoshark. • Falco capture recordings are now recognized by `File sets: Add a pattern for Falco capture recordings`. • HiPerConTracer dissector gains `added "Decode As" support`. • NetPerfMeter dissector gains `added "Decode As" support` and `Improved retranstrials output`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 26 Oct 2025 00:00:00 GMT NetPerfMeter dissector adds QUIC support; Mongo displays command name. • Adds NetPerfMeter dissector with QUIC protocol support • `mongo` dissector now includes the command name in the Info column Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 19 Oct 2025 00:00:00 GMT Wireshark adds dsraddresstositenames dissection, GNSS Galileo OSNMA support, Bluetooth UUID registration, and Ubiquiti AP parsing. • `Netlogon` dissector now decodes `dsraddresstositenames[ex]w` fields • New support for dissecting `GNSS` Galileo OSNMA DSM-PKR • Register `Bluetooth UUID` type in the protocol hierarchy • Added parsing logic for `Ubiquiti` AP names • `TLS` dissector handles `Abbreviated Handshake Using New Session Ticket` (RFC 9132) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 12 Oct 2025 00:00:00 GMT Wireshark adds support for AMTRELAY DNS records, MS Procmon wiretap and dissector, and 24-bit linear audio decoding. • `DNS`: Add AMTRELAY resource record dissector • Initial `MS Procmon` wiretap and dissector • Codecs: Add a 24-bit linear audio decoder Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.6.0.html https://www.wireshark.org/docs/relnotes/wireshark-4.6.0.html Wed, 08 Oct 2025 00:00:00 GMT Wireshark 4.6.0 adds NTP over NTS decryption, Zstd HTTP compression, new 'Plots' dialog, and extensive protocol/decoding support. • Adds NTP packet decryption using Network Time Security (NTS), requiring NTS-KE packets and TLS client/exporter secrets. • Adds support for Zstandard (zstd) Content-Encoding in HTTP and HTTP/2 dissectors. • Adds a new 'Plots' dialog providing scatter plots, supporting multiple plots, markers, and automatic scrolling. • Adds X.509 certificate export via File › Export Objects ('X509AF') and TShark `--export-objects x509af`. • Adds `float` and `double` display filter functions for explicit type conversion in filters and custom columns. • Adds the `Conversation` object to the Lua API, exposing conversation data to scripts. • Adds support for importing hex dumps with 2-4 byte groups (little-endian option) and `0x` prefixes. Breaking changes: • `tshark -G` with no argument is removed; use `tshark -G fields` instead. • `tshark -G fields` syntax for prefix listing changed to `tshark -G fields,prefix`. • Wireshark and TShark no longer support WinPcap; Windows users must uninstall it and use Npcap. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 05 Oct 2025 00:00:00 GMT New CQLv5 dissector base, Asterix rewrite, GNSS OSNMA decoding, and wslua column separators. • Adds initial `packet-cql.c` implementation for CQLv5 protocol support • Rewrites the `asterix` dissector for improved parsing • Decodes Galileo OSNMA DSM-KROOT in GNSS traffic • Adds separator support to wslua column appending via `wslua` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 21 Sep 2025 00:00:00 GMT Adds `Time Display Format` option for capture start time and JSON Lines export support. • Adds `Time Display Format` option to show time relative to capture start Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 14 Sep 2025 00:00:00 GMT Wireshark 3217199 adds OSPF Multi-Instance extensions, Nokia PFCP IEs, and RTPS TypeObjectV2 annotation parsing • Adds support for OSPF Multi-Instance Extensions (`ospf` dissector now parses MI-Opaque TLVs) • Adds Nokia-specific Information Element dissectors to the `pfcp` protocol parser • Enables parsing of RTPS TypeObjectV2 built-in annotations in the `rtps` dissector Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Tue, 09 Sep 2025 00:00:00 GMT Wireshark adds http2 body decompression disable option and ORAN FH CUS beamspace/transaction index support • Adds `http2.disable_body_decompression` to control HTTP/2 payload expansion • Adds `ORAN FH CUS: support for beamspace I/II` to the Radio Layer dissection • Adds display of longest UL delay in the ORAN FH CUS command-line tap output • Adds display of correct trx index for BFW in ORAN FH CUS CLI tap • Adds dissection of Darwin metadata in pcapng files • Allows floating-point scale factors for Y-axis plots in Qt graphs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://github.com/wireshark/wireshark/blob/master/ChangeLog https://github.com/wireshark/wireshark/blob/master/ChangeLog Sun, 07 Sep 2025 00:00:00 GMT Wireshark adds CAN-XL packet support, GUI toggle for capture filter optimization, and Falco IP geolocation. • Adds `LINKTYPE_CANXL` dissector for decoding CAN-XL messages in captured traffic • Adds IP geolocation data to exported Falco event logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.4.8.html https://www.wireshark.org/docs/relnotes/wireshark-4.4.8.html Wed, 16 Jul 2025 00:00:00 GMT Wireshark 4.4.8 updates protocol dissection for ASTERIX, DNP3, DTLS, IPsec, and more. • Updated protocol support for ASTERIX • Updated protocol support for DLT • Updated protocol support for DNP 3.0 • Updated protocol support for DOF • Updated protocol support for DTLS • Updated protocol support for ETSI CAT • Updated protocol support for Gryphon • Updated protocol support for IPsec • Updated protocol support for ISObus VT • Updated protocol support for KRB5 • Updated protocol support for MBIM • Updated protocol support for RTCP • Updated protocol support for SLL • Updated protocol support for STCSIG • Updated protocol support for TETRA • Updated protocol support for UDS • Updated protocol support for URL Encoded Form Data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.4.5.html https://www.wireshark.org/docs/relnotes/wireshark-4.4.5.html Mon, 24 Feb 2025 00:00:00 GMT Wireshark 4.4.5 updates GNW, IPv4, NFAPI, ProtoBuf dissectors and fixes crashes. • Updated GNW protocol dissector with new dissection logic • Updated IPv4 protocol dissector with new dissection logic • Updated NFAPI protocol dissector with new dissection logic • Updated ProtoBuf dissector with new dissection logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.4.2.html https://www.wireshark.org/docs/relnotes/wireshark-4.4.2.html Wed, 20 Nov 2024 00:00:00 GMT Wireshark 4.4.2 changes TShark `tshark -G fields,prefix` syntax and restores profile switching. • Adds the `fields,prefix` comma-separated argument to the `tshark -G fields` command for dumping field lists with a specific prefix. Breaking changes: • The `tshark -G fields prefix` syntax is replaced by `tshark -G fields,prefix`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.4.1.html https://www.wireshark.org/docs/relnotes/wireshark-4.4.1.html Wed, 09 Oct 2024 00:00:00 GMT Wireshark 4.4.1 introduces TShark -G fields prefix syntax change and fixes several CVEs • TShark `-G fields,prefix` subcommand replaces the old `-G fields prefix` space-separated syntax for dumping field names with a specific prefix Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html Wed, 28 Aug 2024 00:00:00 GMT Wireshark 4.4 adds profile switching by filter, LZ4 compression support, and custom column expressions. • `automatic profile switching` allows Wireshark to associate a display filter with a configuration profile to automatically switch profiles when opening matching capture files • Capture files can now be saved with `LZ4` compression using the GUI or command-line tools, enabling fast random access for large captures • Custom columns in the GUI and custom output fields via `tshark -e` support valid field expressions including arithmetic, slices, logical tests, and display filter functions • `Edit > Copy > Display filter as pcap filter` now converts display filters to pcap filters when a corresponding equivalent exists for each field Breaking changes: • Support for Lua 5.1 and 5.2 has been removed; installers now ship with Lua 5.4.6 only • The `tvb_get_guintX` and `tvb_get_gintX` API functions have been renamed to `tvb_get_uintX` and `tvb_get_intX` respectively Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.2.0.html https://www.wireshark.org/docs/relnotes/wireshark-4.2.0.html Wed, 15 Nov 2023 00:00:00 GMT Wireshark 4.2.0 adds raw byte filtering, column text filtering, and new protocols. • Adds `@some.field == <bytes…>` display filter syntax to match raw packet data. • Enables filtering by configured column text using `_ws.col.<name>` fields in display filters. • Adds TShark option `--print-timers`. • Supports HTTP/3, ZigBee Direct (ZBD), Fibra UWB Controller Interface (UCI), and dozens of other protocols. • Adds Arm64 Windows installer. Breaking changes: • The bundled script "dtd_gen.lua" has been removed from the installation. • Wi-Fi NAN dissector filter name changed from 'nan' to 'wifi_nan'. • Lua function "package.prepend_path" has been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.0.6.html https://www.wireshark.org/docs/relnotes/wireshark-4.0.6.html Wed, 24 May 2023 00:00:00 GMT Wireshark 4.0.6 adds case-insensitive media type matching per RFC 6838 • The media type dissector table now properly treats media types and subtypes as case-insensitive automatically • Removed official support for 32-bit Windows packages in the 4.0 series Breaking changes: • Wireshark 4.0 and later no longer ships official 32-bit Windows packages; users must use the latest 3.6 release for that platform Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.0.1.html https://www.wireshark.org/docs/relnotes/wireshark-4.0.1.html Wed, 26 Oct 2022 00:00:00 GMT Wireshark 4.0.1 adds BLF capture file support and updates multiple protocol dissectors in the Windows Qt build. • Windows installers now ship with Qt 5.12.2 instead of Qt 6.2.3 for better stability on legacy systems • Added new and updated support for BLF capture file format • Updated protocol support for ASN.1 PER, CFDP, Diameter, DirectPlay, F5 Ethernet Trailer, GTP, H.223, H.248, H.264, H.265, IEEE 802.11, IPv4, MBIM, O-RAN FH CUS, PFCP, RTCP, SCTP, SMB, TCP, and TRANSUM Breaking changes: • The experimental display filter syntax for literals using angle brackets <…​> introduced in Wireshark 4.0.0 is removed; use a colon prefix for byte arrays instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-4.0.0.html https://www.wireshark.org/docs/relnotes/wireshark-4.0.0.html Tue, 04 Oct 2022 00:00:00 GMT Wireshark 4.0 adds display filter extensions (arithmetic, layers), new protocols, and redesigned Conversation/Endpoint dialogs. • Adds support for layer-specific matching in display filters using the '#' operator (e.g., `ip.addr#1`) • Adds universal quantifiers `any` and `all` to display filter relational operators • Adds arithmetic operators (+, -, *, /, %) and functions (max, min, abs) to display filters • Adds support for negative indexing of protocol fields in display filters (e.g., `tcp[-2:]`) • Adds strict equality operator `===` and its negation `!==` to display filters • Redesigns the Conversation and Endpoint dialogs with detachable tabs and JSON export • Adds `zbee_zcl_se.msg.msg_ctrl.deprecated` field in ZigBee ZCL Messaging dissector • Adds support for IEEE 802.11 Mesh Connex (MCX) in the 802.11 dissector • Adds support for gRPC fake headers in HTTP2 dissector for streams without initial HEADERS frames • Adds `ciscodump` support for IOS, IOS-XE and ASA remote capturing • Adds `text2pcap` option `-F` to select output capture file format • Adds `text2pcap` option `-E` to select encapsulation type for output files • Adds `ETW` (Event Tracing for Windows) support for live sessions and IP packet display Breaking changes: • The 'v' switch in editcap is now uppercase 'V' to match other utilities. • The 'V' switch in mergecap is now lowercase 'v' to match other utilities. • The ip.flags field is now only the three high bits; displays/filters using the full byte need adjustment. • Whitespace-separated set elements (e.g., {1 2}) are now a syntax error; use commas instead. • Unrecognized escape sequences in display filter strings are now syntax errors. • Floats must have leading and trailing digits (e.g., 0.7 instead of .7). • PCRE2 replaces GRegex for display filter regex; some exotic patterns may need rewriting. • The `~=` operator is deprecated; use `!==` instead. • The `-n` flag in text2pcap to select pcapng is deprecated; pcapng is now the default. • The `-d` flag in text2pcap is removed; use log levels 'debug' or 'noisy' via `-o` instead. • CMake options starting with DISABLE_ are renamed to ENABLE_ (e.g., DISABLE_WERROR=On becomes ENABLE_WERROR=Off). • In proto.h, field display types STR_ASCII and STR_UNICODE are removed; use BASE_NONE. • In proto.h, the display type BASE_FLOAT is removed; use BASE_DEC, BASE_HEX, BASE_EXP, or BASE_CUSTOM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html https://www.wireshark.org/docs/relnotes/wireshark-3.6.4.html Wed, 04 May 2022 00:00:00 GMT Wireshark 3.6.4 updates protocol support for CQL, DHCPv6, ICMPv6, IEEE 802.11, NAS-5GS, NetFlow/IPFIX, RDP, and UDS. • Adds updated protocol dissection support for CQL, DHCPv6, ICMPv6, IEEE 802.11, NAS-5GS, NetFlow/IPFIX, RDP, and UDS. Breaking changes: • This is the last release branch with support for 32-bit Windows; updates will no longer be available after May 22, 2024. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-3.4.11.html https://www.wireshark.org/docs/relnotes/wireshark-3.4.11.html Wed, 29 Dec 2021 00:00:00 GMT Wireshark 3.4.11 adds RFC 7468 capture file support and updates protocol dissector coverage. • Adds `RFC 7468` to the list of supported capture file formats for reading and writing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html https://www.wireshark.org/docs/relnotes/wireshark-3.6.1.html Wed, 29 Dec 2021 00:00:00 GMT Wireshark 3.6.1 adds backward-compatible CLI flag `-o console.log.level:` to map to new logging subsystem. • Adds the `-o console.log.level:` CLI option in tshark and wireshark to provide backward compatibility with the removed `console.log.level` preference. • Adds support for parsing BLF capture file format. • Adds support for parsing RFC 7468 (PEM) file format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html https://www.wireshark.org/docs/relnotes/wireshark-3.6.0.html Mon, 22 Nov 2021 00:00:00 GMT Wireshark 3.6.0 adds new protocol dissectors, display filter syntax updates, and TShark TLS key export capability • TShark can now export TLS session keys with the `--export-tls-session-keys` option. • Display filter set elements must now be comma-separated (e.g., `{"GET", "HEAD"}`). • The display filter expression `a != b` now has the same meaning as !(a == b), with `a ~= b` or `a any_ne b` for previous behavior. • Wireshark supports dissecting OPUS payloads in RTP packets. • A new macOS Arm 64 (Apple Silicon) package is available for Wireshark. • Support for the syntax `a not in b` with the same meaning as `not a in b` has been added to display filters. • The macOS Intel packages require macOS 10.13 or later. • Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • New File Format Decoding Support for Vector Informatik Binary Log File (BLF). • Wireshark now supports dissecting Event Tracing for Windows (ETW) via a new extcap named ETW reader and `packet_etw` dissector. • A new `Follow DCCP stream` feature allows filtering and extracting contents of DCCP streams. • Importing captures from text files based on regular expressions is now possible with various data encodings (plain-hexadecimal, octal, binary, base64). • The RTP Player has been significantly redesigned: it can play many streams in row, mute or route audio, and save to multichannel .au or .wav. • VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are now non-modal. • The `Follow Stream` dialog can now follow SIP calls based on their Call-ID value. • The `Follow Stream` dialog’s YAML output format now includes timestamps and peers information. • IP fragments between public IPv4 addresses are reassembled even if they have different VLAN IDs, controlled by the "Enable stricter conversation tracking heuristics" preference. • USB Link Layer reassembly has been added for hardware captures. • Protobuf fields missing in capture files can now be displayed with default values via the `add_default_value` preference. • New Protocol Support for 5GLI, BT LMP, BPv7, BPSec, COSE, E2AP, ETW, EXEH, HiPerConTracer, ISO 10681, Kerberos SPAKE, Linux psample, LIN, Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane, OPUS, PDU Transport Protocol, R09.x, DRDYNVC, EGFX, RDPMT, RTPS-VT, RTPS-PROC, SMC, Signal PDU, SparkplugB, SSyncP, TIFF, TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, RDPUDP, VJC, WOWW, and xIRI. • Wireshark now supports the Turkish language. Breaking changes: • The display filter expression `a != b` no longer uses inconsistent logic for multi-value fields; use `a ~= b` or `a any_ne b` if the previous behavior is needed. • Display filter set elements must now be comma-separated; whitespace-only separation is deprecated and will be removed in a future version. • macOS Intel packages require macOS 10.13 or later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/wireshark