2019-02-14 23:23:05 +00:00
include::attributes.adoc[]
2018-02-20 01:13:08 +00:00
:stylesheet: ws.css
2018-02-25 17:17:14 +00:00
:linkcss:
2021-10-11 21:36:58 +00:00
:copycss: {stylesheet}
2016-11-01 21:35:29 +00:00
2016-07-16 07:53:37 +00:00
= Wireshark {wireshark-version} Release Notes
2018-02-06 20:35:21 +00:00
// Asciidoctor Syntax Quick Reference:
2019-07-20 15:13:59 +00:00
// https://asciidoctor.org/docs/asciidoc-syntax-quick-reference/
2014-04-15 16:31:24 +00:00
2022-01-04 19:16:38 +00:00
This is an experimental release intended to test new features for Wireshark 4.0.
2013-03-15 01:33:46 +00:00
== What is Wireshark?
2019-12-18 18:29:53 +00:00
Wireshark is the world’
It is used for troubleshooting, analysis, development and education.
2013-03-15 01:33:46 +00:00
2018-02-04 23:15:02 +00:00
== What’
2013-03-15 01:33:46 +00:00
2022-04-19 18:35:06 +00:00
NOTE: We no longer ship packages for 32-bit Windows. wsbuglink:17779[]
2021-12-27 21:28:37 +00:00
2021-11-12 10:11:25 +00:00
* The PCRE2 library (https://www.pcre.org/) is now a required dependency to build Wireshark.
2021-12-27 21:28:37 +00:00
* You must now have a compiler with C11 support in order to build Wireshark.
2021-11-12 10:11:25 +00:00
2019-12-18 18:29:53 +00:00
Many improvements have been made.
See the “New and Updated Features” section below for more details.
2017-09-02 23:42:00 +00:00
2019-02-06 19:33:12 +00:00
// === Bug Fixes
2013-03-15 01:33:46 +00:00
2019-02-06 19:33:12 +00:00
// The following bugs have been fixed:
2013-03-15 01:33:46 +00:00
2018-05-24 18:35:45 +00:00
//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
2021-11-19 02:36:37 +00:00
//* Wireshark insists on subscribing to two dozen streaming services but only watches three.
2018-03-12 15:49:12 +00:00
2013-03-15 01:33:46 +00:00
=== New and Updated Features
2021-11-19 02:36:37 +00:00
The following features are new (or have been significantly updated) since version 3.6.0:
2019-11-18 20:10:21 +00:00
2021-12-09 21:41:07 +00:00
* The Windows installers now ship with Npcap 1.60.
They previously shipped with Npcap 1.55.
2021-10-04 08:20:16 +00:00
2021-10-14 13:17:41 +00:00
* Display filter syntax:
2021-11-19 10:16:02 +00:00
** Set elements must be separated using a comma, e.g: {1, 2, "foo"}. Using only whitespace as separator was deprecated in 3.6 and is now a syntax error.
2021-11-19 02:36:37 +00:00
** Adds support for some additional character escape sequences in double quoted strings.
Besides octal and hex byte specification the following C escape sequences are now supported with the same meaning: \a, \b, \f, \n, \r, \t, \v.
Previously they were only supported with character constants.
2021-11-23 13:40:14 +00:00
** Unrecognized escape sequences are now treated as a syntax error. Previously they were treated as a literal character.
In addition to the sequences indicated above, backslash, single quotation and double quotation mark are also valid sequences: \\, \', \".
2021-11-19 02:36:37 +00:00
** The display filter engine now uses PCRE2 instead of GRegex (GLib bindings to the older end-of-life PCRE library).
PCRE2 is compatible with PCRE so the user-visible changes should be minimal.
Some exotic patterns may now be invalid and require rewriting.
2021-12-13 01:06:01 +00:00
** Adds a new strict equality operator "===" or "all_eq". The expression "a === b" is true if and only if all a's are equal to b.
2022-03-05 12:30:34 +00:00
The negation of "===" can now be written as "!==" (any_ne).
2021-12-22 09:36:46 +00:00
** Adds the aliases "any_eq" for "==" and "all_ne" for "!=".
2022-03-30 13:35:38 +00:00
** The operator "~=" is deprecated and will be removed in a future version. Use "!==" with the same meaning instead.
2021-12-24 14:24:28 +00:00
** Date and time can be given in UTC using ISO 8601 (with 'Z' timezone) or by appending the suffix "UTC" to the legacy formats.
Otherwise local time is used.
2022-02-23 17:02:53 +00:00
** Integer literal constants may be written in binary (in addition to decimal/octal/hexadecimal) using the prefix "0b" or "0B".
2022-02-22 21:55:05 +00:00
** New syntax to disambiguate literals from identifiers. Every value with a leading dot is a protocol or protocol field.
Every value with a leading colon or in between angle brackets is a literal value. See the User Guide for details.
** Floats must be written with a leading and ending digit. For example the values ".7" and "7." are now invalid as floats.
2022-03-30 13:35:38 +00:00
It must be written "0.7" and "7.0" respectively.
2022-02-25 19:37:53 +00:00
** The "bitwise and" operator is now a first-class bit operator, not a boolean operator. In particular this means
it is now possible to mask bits, e.g.: frame[0] & 0x0F == 3.
2022-04-04 15:52:11 +00:00
** Arithmetic is supported for numeric fields with the usual operators: +, -, *, /, %. Arithmetic expressions must be grouped using
curly brackets (not parenthesis).
2022-04-03 16:57:23 +00:00
** Logical AND now has higher precedence than logical OR, in line with most programming languages.
2022-04-13 14:30:36 +00:00
** Adds new display filter functions max(), min() and abs().
2022-04-16 01:42:20 +00:00
** Functions can accept expressions as arguments, including other functions. Previously only protocol
fields and slices were syntactically valid function arguments.
2022-04-09 22:03:40 +00:00
** New syntax to match a specific layer in the protocol stack. For example ip.addr#2 == 1.1.1.1
matches only the inner layer in an IP-over-IP packet.
2021-10-26 22:28:54 +00:00
2022-01-09 12:16:26 +00:00
* text2pcap and "Import from Hex Dump":
2022-01-03 14:46:44 +00:00
** text2pcap supports writing the output file in all the capture file formats
that wiretap library supports, using the same "-F" option as editcap,
mergecap, and tshark.
2022-01-13 04:11:01 +00:00
** text2pcap supports selecting the encapsulation type of the output file
format using the wiretap library short names with an "-E" option, similiar
to the "-T" option of editcap.
2022-01-03 14:46:44 +00:00
** text2pcap has been updated to use the new logging output options and the
2021-12-29 15:18:57 +00:00
"-d" flag has been removed. The "debug" log level corresponds to the old
"-d" flag, and the "noisy" log level corresponds to using "-d" multiple times.
2022-01-09 12:16:26 +00:00
** text2pcap and Import from Hex Dump support writing fake IP headers (and fake
TCP, UDP, and SCTP headers) to files with Raw IP, Raw IPv4, and Raw IPv6
encapsulations, in addition to Ethernet encapsulation as previously.
** text2pcap supports scanning the input file using a custom regular expression,
as supported in Import from Hex Dump in Wireshark 3.6.x.
** In general, text2pcap and wireshark's Import from Hex Dump have feature
parity.
2021-12-29 15:18:57 +00:00
2021-10-28 10:07:35 +00:00
* HTTP2 dissector now supports using fake headers to parse the DATAs of streams captured without first HEADERS frames of a long-lived stream (like
gRPC streaming call which allows sending many request or response messages in one HTTP2 stream). User can specify fake headers according to the
server port, stream id and direction of the long-lived stream that we start capturing packets after it is established.
2021-10-22 13:24:43 +00:00
* Mesh Connex (MCX) support in existing 802.11 packets.
2021-12-07 05:47:54 +00:00
* Capture Options dialog contains same configuration icon as Welcome Screen. It is possible to configure interface there.
2021-12-30 16:03:15 +00:00
* Extcap dialog remembers password items during runtime therefore it is possible to run extcap multiple times in row. Passwords are never stored to disk.
* It is possible to set extcap passwords on cli for tshark and other cli tools.
2022-01-06 03:48:27 +00:00
* Extcap configuration dialog now supports and remembers empty strings. There are new buttons to reset a value back to default value.
2022-01-23 15:30:44 +00:00
* Support to display JSON mapping for Protobuf message.
2022-02-26 23:14:36 +00:00
* macOS debugging symbols are now shipped in separate packages.
2022-03-26 15:40:50 +00:00
* ZigBee ZCL Messaging: rename zbee_zcl_se.msg.msg_ctrl.depreciated to zbee_zcl_se.msg.msg_ctrl.deprecated
2022-04-21 14:00:50 +00:00
* The interface list on the welcome page sorts active interfaces first and only displays the sparkline for active interfaces.
Additionally, the interfaces can now be hidden/unhidden via the context menu in the interface list
2022-01-13 18:54:01 +00:00
* ETW reader now supports to display IP packets from an event trace logfile or an event trace live session
2022-01-04 19:16:38 +00:00
=== Removed Features and Support
2021-12-30 01:05:57 +00:00
* CMake: The options starting with DISABLE_something were renamed ENABLE_something for consistency.
For example DISABLE_WERROR=On became ENABLE_WERROR=Off. The defaults are unchanged.
2018-05-10 15:53:42 +00:00
2021-04-18 19:04:57 +00:00
// === Removed Dissectors
2014-01-03 09:48:53 +00:00
2021-08-26 21:54:41 +00:00
=== New File Format Decoding Support
2018-12-11 23:17:53 +00:00
2021-08-26 21:54:41 +00:00
[commaize]
--
--
2014-01-03 09:48:53 +00:00
2013-03-15 01:33:46 +00:00
=== New Protocol Support
2016-06-03 16:21:21 +00:00
2020-10-22 19:13:21 +00:00
// Add one protocol per line between the -- delimiters in the format
2021-11-19 02:36:37 +00:00
// “Full protocol name (Abbreviation)”
// git log --oneline --diff-filter=A --stat v3.7.0rc0.. epan/dissectors plugins
Switch from AsciiDoc to Asciidoctor.
Switch the markup text processor for files in the docbook directory from
AsciiDoc to Asciidoctor. Asciidoctor has several useful features (such
as direct PDF output) and is actively developed. It's written in Ruby
but that dependency can be sidestepped with AsciidoctorJ, a
self-contained bundle that only depends on the JRE.
The current toolchain targets require Python, AsciiDoc, DocBook XML,
DocBook XSL, Java, FOP, xsltproc, lynx, and the HTMLHelp compiler:
HTML: AsciiDoc → DocBook XML → xsltproc + DocBook XSL
Chunked HTML: AsciiDoc → DocBook XML → xsltproc + DocBook XSL
PDF: AsciiDoc → DocBook XML → xsltproc + DocBook XSL → FOP
HTMLHelp: AsciiDoc → DocBook XML → xsltproc + DocBook XSL → HHC
This change removes the AsciiDoc and FOP requirements and adds either
AsciidoctorJ or Asciidoctor + Ruby:
HTML: Asciidoctor → DocBook XML → xsltproc + DocBook XSL
Chunked HTML: Asciidoctor → DocBook XML → xsltproc + DocBook XSL
PDF: Asciidoctor
HTMLHelp: Asciidoctor → DocBook XML → xsltproc + DocBook XSL → HHC
Ideally we could generate all of these using AsciidoctorJ, Java, and
lynx. Unfortunately we're not there yet.
The release notes depend on several macros (ws-buglink, ws-salink,
cve-idlink, sort-and-group). Add Asciidoctor (Ruby) equivalents.
Remove the BUILD_xxx_GUIDES CMake options and add various output targets
automatically. This means that you have to build the various documentation
targets explicitly.
Change-Id: I31930677a656b99b1c6839bb6c33a13db951eb9a
Reviewed-on: https://code.wireshark.org/review/25668
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-10-19 22:03:55 +00:00
[commaize]
--
2022-02-09 19:27:49 +00:00
Allied Telesis Loop Detection (AT LDF)
AUTOSAR I-PDU Multiplexer (AUTOSAR I-PduM)
DTN Bundle Protocol Version 7 (BPv7)
DTN Bundle Protocol Security (BPSec)
DTN TCP Convergence Layer Protocol (TCPCL)
DVB Selection Information Table (DVB SIT)
Enhanced Cash Trading Interface 10.0 (XTI)
Enhanced Order Book Interface 10.0 (EOBI)
Enhanced Trading Interface 10.0 (ETI)
FiveCo's Legacy Register Access Protocol (5co-legacy)
Generic Data Transfer Protocol (GDT)
2021-07-22 14:15:24 +00:00
Host IP Configuration Protocol (HICP)
2021-10-22 13:24:43 +00:00
Mesh Connex (MCX)
2022-01-27 21:15:49 +00:00
Microsoft Cluster Remote Control Protocol (RCP)
2022-02-09 19:27:49 +00:00
Realtek
2022-03-19 04:06:37 +00:00
REdis Serialization Protocol v2 (RESP)
2022-02-09 19:27:49 +00:00
Secure File Transfer Protocol (sftp)
Secure Host IP Configuration Protocol (SHICP)
USB Attached SCSI (UASP)
ZBOSS NCP
2022-02-22 16:37:28 +00:00
gRPC Web (gRPC-Web)
2018-05-28 13:16:35 +00:00
--
2013-03-15 01:33:46 +00:00
=== Updated Protocol Support
2016-08-16 14:50:37 +00:00
Too many protocols have been updated to list here.
2013-03-15 01:33:46 +00:00
=== New and Updated Capture File Support
2019-07-24 21:29:13 +00:00
// There is no new or updated capture file support in this release.
// Add one file type per line between the -- delimiters.
Switch from AsciiDoc to Asciidoctor.
Switch the markup text processor for files in the docbook directory from
AsciiDoc to Asciidoctor. Asciidoctor has several useful features (such
as direct PDF output) and is actively developed. It's written in Ruby
but that dependency can be sidestepped with AsciidoctorJ, a
self-contained bundle that only depends on the JRE.
The current toolchain targets require Python, AsciiDoc, DocBook XML,
DocBook XSL, Java, FOP, xsltproc, lynx, and the HTMLHelp compiler:
HTML: AsciiDoc → DocBook XML → xsltproc + DocBook XSL
Chunked HTML: AsciiDoc → DocBook XML → xsltproc + DocBook XSL
PDF: AsciiDoc → DocBook XML → xsltproc + DocBook XSL → FOP
HTMLHelp: AsciiDoc → DocBook XML → xsltproc + DocBook XSL → HHC
This change removes the AsciiDoc and FOP requirements and adds either
AsciidoctorJ or Asciidoctor + Ruby:
HTML: Asciidoctor → DocBook XML → xsltproc + DocBook XSL
Chunked HTML: Asciidoctor → DocBook XML → xsltproc + DocBook XSL
PDF: Asciidoctor
HTMLHelp: Asciidoctor → DocBook XML → xsltproc + DocBook XSL → HHC
Ideally we could generate all of these using AsciidoctorJ, Java, and
lynx. Unfortunately we're not there yet.
The release notes depend on several macros (ws-buglink, ws-salink,
cve-idlink, sort-and-group). Add Asciidoctor (Ruby) equivalents.
Remove the BUILD_xxx_GUIDES CMake options and add various output targets
automatically. This means that you have to build the various documentation
targets explicitly.
Change-Id: I31930677a656b99b1c6839bb6c33a13db951eb9a
Reviewed-on: https://code.wireshark.org/review/25668
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2017-10-19 22:03:55 +00:00
[commaize]
2018-08-27 15:17:32 +00:00
--
--
2013-03-15 01:33:46 +00:00
2019-02-06 19:33:12 +00:00
// === New and Updated Capture Interfaces support
2015-04-08 14:09:03 +00:00
2018-01-06 01:02:57 +00:00
//_Non-empty section placeholder._
2018-10-01 17:20:38 +00:00
2021-12-03 03:09:31 +00:00
=== Major API Changes
* proto.h: The field display types "STR_ASCII" and "STR_UNICODE" were removed. Use "BASE_NONE" instead.
2014-02-22 19:16:44 +00:00
2013-03-15 01:33:46 +00:00
== Getting Wireshark
Wireshark source code and installation packages are available from
2014-09-17 00:15:56 +00:00
https://www.wireshark.org/download.html.
2013-03-15 01:33:46 +00:00
=== Vendor-supplied Packages
2020-09-15 20:56:25 +00:00
Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package management system specific to that platform.
A list of third-party packages can be found on the
2021-10-07 03:53:17 +00:00
https://www.wireshark.org/download.html[download page]
2013-03-15 01:33:46 +00:00
on the Wireshark web site.
== File Locations
2020-09-15 20:56:25 +00:00
Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform.
2021-10-07 03:53:17 +00:00
You can use menu:Help[About Wireshark,Folders] or `tshark -G folders` to find the default locations on your system.
2013-03-15 01:33:46 +00:00
== Getting Help
2020-09-15 20:56:25 +00:00
The User’
https://www.wireshark.org/docs/
2018-08-09 15:43:47 +00:00
2020-09-15 20:56:25 +00:00
Community support is available on
2021-03-19 23:37:53 +00:00
https://ask.wireshark.org/[Wireshark’
2020-09-15 20:56:25 +00:00
and on the wireshark-users mailing list.
Subscription information and archives for all of Wireshark’
https://www.wireshark.org/lists/[the web site].
2013-03-15 01:33:46 +00:00
2020-09-15 20:56:25 +00:00
Bugs and feature requests can be reported on
https://gitlab.com/wireshark/wireshark/-/issues[the issue tracker].
2018-08-09 15:43:47 +00:00
2019-11-20 22:55:57 +00:00
// Official Wireshark training and certification are available from
// https://www.wiresharktraining.com/[Wireshark University].
2013-03-15 01:33:46 +00:00
== Frequently Asked Questions
A complete FAQ is available on the
2014-09-17 00:15:56 +00:00
https://www.wireshark.org/faq.html[Wireshark web site].
