Wireshark 4.4.2 Out Now!

What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer. It is used for troubleshooting, analysis, development and education.

Wireshark is used by government agencies, educational institutions, corporations, small businesses and nonprofits alike to troubleshoot network issues. Additionally, Wireshark can be used as a learning tool

Cybersecurity professionals often use Wireshark to trace connections, view the contents of suspect network transactions and identify bursts of network traffic. It is a key part of any IT pro’s toolkit - once they have mastered how to use it.

Wireshark does three things:

1. Packet Capture: Wireshark listens to a network connection in real time and then grabs entire streams of traffic – quite possibly tens of thousands of packets at a time.
2. Filtering: Wireshark is capable of slicing and dicing all of this random live data using filters. By applying a filter, you can obtain just the information you need to see.
3. Visualization: Wireshark, like any good packet sniffer, allows you to dive right into the very middle of a network packet. It also allows you to visualize entire conversations and network streams.

Wireshark is hosted by the Wireshark Foundation, a nonprofit which promotes protocol analysis education. Wireshark and the foundation depend on your contributions in order to do their work. If you or your organization would like to contribute or become a sponsor, visit wiresharkfoundation.org.

Wireshark Version 4.4.2 - What's New?

Bug Fixes

The following vulnerabilities have been fixed:

• wnpa-sec-2024-14 FiveCo RAP dissector infinite loop. Issue 20176.
• wnpa-sec-2024-15 ECMP dissector crash. Issue 20214.

The following bugs have been fixed:

• CIP I/O is not detected by "enip" filter anymore. Issue 19517.
• Fuzz job issue: fuzz-2024-09-03-7550.pcap. Issue 20041.
• OSS-Fuzz 71476: wireshark:fuzzshark_ip_proto-udp: Index-out-of-bounds in DOFObjectID_Create_Unmarshal. Issue 20065.
• JA4_c hashes an empty field to e3b0c44298fc when it should be 000000000000. Issue 20066.
• Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone Mirroring. Issue 20082.
• PTP analysis loses track of message associations in case of sequence number resets. Issue 20099.
• USB CCID: response packet in case SetParameters command is unsupported is flagged as malformed. Issue 20107.
• dumpcap crashes when run from TShark with a capture filter. Issue 20108.
• SRT dissector: The StreamID (SID) in the handshake extension is displayed without regarding the control characters and with NUL as terminating. Issue 20113.
• Ghost error message on POP3 packets. Issue 20124.
• Building against c-ares 1.34 fails. Issue 20125.
• D-Bus is not optional anymore. Issue 20126.
• macOS Intel DMGs aren’t fully notarized. Issue 20129.
• Incorrect name for MLD Capabilities and Operations Present flag in dissection of MLD Capabilities for MLO wifi-7 capture. Issue 20134.
• CQL Malformed Packet v4 S → C Type RESULT: Prepared[Malformed Packet] Issue 20142.
• Wi-Fi: 256 Block Ack (BA) is not parsed properly. Issue 20156.
• BACnet ReadPropertyMultiple request Maximum allowed recursion depth reached. Issue 20159.
• Statistics→I/O Graph crashes when using simple moving average. Issue 20163.
• HTTP2 body decompression fails on DATA with a single padded frame. Issue 20167.
• Compiler warning for ui/tap-rtp-common.c (ignoring return value) Issue 20169.
• SIP dissector bug due to "be-route" param in VIA header. Issue 20173.
• Coredump after trying to open 'Follow TCP stream' Issue 20174.
• Protobuf JSON mapping error. Issue 20182.
• Display filter "!stp.pvst.origvlan in { vlan.id }" causes a crash (Version 4.4.1) Issue 20183.
• Extcap plugins shipped with Wireshark Portable are not found in version 4.4.1. Issue 20184.
• IEEE 802.11be: Wrong regulatory info in HE Operation IE in Beacon frame. Issue 20187.
• Wireshark 4.4.1 does not decode RTCP packets. Issue 20188.
• Qt: Display filter sub-menu can only be opened on the triangle, not the full name. Issue 20190.
• Qt: Changing the display filter does not update the Conversations or Endpoints dialogs. Issue 20191.
• MODBUS Dissector bug. Issue 20192.
• Modbus dissector bug - Field Occurence and Layer Operator modbus.bitval field. Issue 20193.
• Wireshark crashes when a field is dragged from packet details towards the find input. Issue 20204.
• Lua DissectorTable("") : set ("10,11") unexpected behavior in locales with comma as decimal separator. Issue 20216.

The TCP dissector no longer falls back to using the client port as a criterion for selecting a payload dissector when the server port does not select a payload dissector (except for port 20, active FTP). This behavior can be changed using the "Client port dissectors" preference.

Display filters now correctly handle floating point conversion errors.

The Lua API now has better support for comma-separated ranges in different locales.

New and Updated Features

• The TShark syntax for dumping only fields with a certain prefix has changed from -G fields prefix to -G fields,prefix. This allows tshark -G fields to again support also specifying the configuration profile to use.

New Protocol Support

There are no new protocols in this release.

Updated Protocol Support

ARTNET, ASN.1 PER, BACapp, BT BR/EDR, CQL, DOF, ECMP, ENIP, FiveCo RAP, Frame, FTDI FT, HSRP, HTTP/2, ICMPv6, IEEE 802.11, MBTCP, MMS, MPEG PES, PN-DCP, POP, ProtoBuf, PTP, RPC, RTCP, SIP, SRT, Syslog, TCP, UMTS RLC, USB CCID, Wi-SUN, and ZigBee ZCL

New and Updated Capture File Support

BLF

Updated File Format Decoding Support

There is no updated file format support in this release.

Prior Versions

Wireshark 4.4.1 included the following changes. See the release notes for details:

• wnpa-sec-2024-12 ITS dissector crash. Issue 20026.
• wnpa-sec-2024-13 AppleTalk and RELOAD Framing dissector crashes. Issue 20114.
• Refresh interface during live-capture leads to corrupt interface handling. Issue 11176.
• Media type "application/octet-stream" registered for both Thread and UASIP. Issue 14729.
• Extcap toolbar stops working when new interface is added. Issue 19854.
• Decoding error ITS CPM version 2.1.1. Issue 19886.
• Build error in 4.3.0: sync_pipe_run_command_actual error: argument 2 is null but the corresponding size argument 3 value is 512004 [-Werror=nonnull] Issue 19930.
• html2text.py doesn’t handle the <sup> tag. Issue 20020.
• Incorrect NetFlow v8 TOS AS aggregation dissection. Issue 20021.
• The Windows packages don’t ship with the IP address plugin. Issue 20030.
• O_PATH is Linux-and-FreeBSD-specific. Issue 20031.
• Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the correct directory. Issue 20040.
• OER dissector is not considering the preamble if ASN.1 SEQUENCE definition includes extension marker but no OPTIONAL items. Issue 20044.
• Bluetooth classic L2CAP incorrect dissection with connectionless reception channel. Issue 20047.
• Profile auto switch filters : Grayed Display Filter Expression dialog box when opened from Configuration Profiles dialog box. Issue 20049.
• Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue 20051.
• TECMP Data Type passes too much data to sub dissectors. Issue 20052.
• Wireshark and tshark 4.4.0 ignore extcap options specified on the command line. Issue 20054.
• Cannot open release notes due to incorrect path with duplicated directory components. Issue 20055.
• Unable to open "Release Notes" from the "Help" menu. Issue 20056.
• No capture interfaces if Wireshark is started from command line with certain paths. Issue 20057.
• Wireshark 4.4.0 extcap path change breaks third party extcap installers. Issue 20069.
• Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue 20071.
• Unable to create larger files than 99 size units. Issue 20079.
• Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone Mirroring. Issue 20082.
• PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0 (was working in 4.2.7) Issue 20088.
• GUI lags because NetworkManager keeps turning 802.11 monitor mode off. Issue 20090.
• Error while getting Bluetooth application process id by <shell:ps -A | grep com.*android.bluetooth> Issue 20100.
• Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue 20110.

Wireshark 4.4.0 included the following changes. See the release notes for details:

Many improvements and fixes to the graphing dialogs, including I/O Graphs, Flow Graph / VoIP Calls, and TCP Stream Graphs.

Wireshark now supports automatic profile switching. You can associate a display filter with a configuration profile, and when you open a capture file that matches the filter, Wireshark will automatically switch to that profile.

Support for Lua 5.3 and 5.4 has been added, and support for Lua 5.1 and 5.2 has been removed. The Windows and macOS installers now ship with Lua 5.4.6.

Improved display filter support for value strings (optional string representations for numeric fields).

Display filter functions can be implemented as plugins, similar to protocol dissectors and file parsers.

Display filters can be translated to pcap filters using Edit?? Copy?? Display filter as pcap filter if each display filter field has a corresponding pcap filter equivalent.

Custom columns can be defined using any valid field expression, such as display filter functions, packet slices, arithmetic calculations, logical tests, raw byte addressing, and protocol layer modifiers.

Custom output fields for tshark -e can also be defined using any valid field expression.

Wireshark can be built with the zlib-ng instead of zlib for compressed file support. Zlib-ng is substantially faster than zlib. The official Windows and macOS packages include this feature.

Getting Wireshark

Wireshark source code and installation packages are available from https://www.wireshark.org/download.html.

Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.

File Locations

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use Help?? About Wireshark?? Folders or tshark -G folders to find the default locations on your system.

Getting Help

The User’s Guide, manual pages and various other documentation can be found at https://www.wireshark.org/docs/

Community support is available on Wireshark’s Q&A site and on the wireshark-users mailing list. Subscription information and archives for all of Wireshark’s mailing lists can be found on the mailing list site.

Bugs and feature requests can be reported on the issue tracker.

You can learn protocol analysis and meet Wireshark’s developers at SharkFest.