wireshark/docbook/release-notes.asciidoc

include::attributes.asciidoc[]

= Wireshark {wireshark-version} Release Notes
// AsciiDoc quick reference: http://powerman.name/doc/asciidoc

This is a semi-experimental release intended to test new features for
Wireshark 2.4.

== What is Wireshark?

Wireshark is the world's most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.

== What's New

//=== Bug Fixes

//The following bugs have been fixed:

//* ws-buglink:5000[]
//* ws-buglink:6000[Wireshark bug]
//* cve-idlink:2014-2486[]
//* Wireshark convinced you to switch seats on the plane while neglecting to tell you that its seat was noticeably moist.

//_Non-empty section placeholder._

=== New and Updated Features

The following features are new (or have been significantly updated)
since version 2.2.0:

* Experimental 32-bit and 64-bit Windows Installer (.msi) packages are available.
  It is recommended that you use these independently of the NSIS (.exe) installers.
  That is, you should make sure the NSIS package is completely uninstalled before
  installing the Windows Installer package and vice-versa.
* Source packages are now compressed using xz instead of bzip2.
* The legacy (GTK+) UI is disabled by default in the Windows installer.
* The legacy (GTK+) UI is disabled by default in Autotools and CMake.
* SS7 Point Codes can now be resolved into names with a hosts-like file.
* Wireshark can now go fullscreen to have more room for packets.
* TShark can now export objects like the other GUI interfaces.
* Support for G.722 and G.726 codecs in the RTP Player (via the SpanDSP library).
* You can now choose the output device when playing RTP streams.
* Added support for dissectors to include a unit name natively in their hf field.
  A field can now automatically append "seconds" or "ms" to its value without
  additional printf-style APIs.
* The Default profile can now be reset to default values.
* You can move back and forth in the selection history in the Qt UI.
* IEEE 802.15.4 dissector now uses an UAT for decryption keys. The original
  decryption key preference has been obsoleted.
* Extcap utilities can now provide configuration for a GUI interface toolbar to
  control the extcap utility while capturing.
* Extcap utilities can now validate the capture filter.
* Display filter function len() can now be used on all string and byte fields.

//=== Removed Dissectors

//=== New File Format Decoding Support

=== New Protocol Support

// Add one protocol per line between the --sort-and-group-- delimiters.
--sort-and-group--
Bluetooth HCI Vendor Intel
CAN FD
Ericsson A-bis P-GSL
Ericsson A-bis TFP (Traffic Forwarding Protocol)
Fc00/cjdns Protocol
Generic Netlink (genl)
GSM Osmux
Health Level 7 (HL7)
High-speed SECS message service (HSMS)
iPerf2
ISO 15765
Linux 802.11 Netlink (nl80211)
Local Service Discovery (LSD)
M2 Application Protocol
Mesh Link Establishment (MLE)
Nordic BLE Sniffer
NVMe Fabrics RDMA
NVMe
OpenThread simulator
RFTap Protocol
SCTE-35 Digital Program Insertion Messages
Snort Post-dissector
Thread CoAP
Unified Diagnostic Services (UDS)
vSocket
Windows Cluster Management API (clusapi)
GSMTAP based logging
HomePNA
X-Rite i1 Display Pro (and derivatives) USB protocol
IndigoCare iCall protocol
IndigoCare Netrix protocol
NetScaler HA Protocol
NetScaler Metric Exchange Protocol
NetScaler RPC Protocol
DirectPlay 8 protocol
NM protocol
Netgear Ensemble Protocol
OBD-II PIDs
(Facebook) Zero
--sort-and-group--

=== Updated Protocol Support

Too many protocols have been updated to list here.

=== New and Updated Capture File Support

_Non-empty section placeholder._
// Add one file type per line between the --sort-and-group-- delimiters.
--sort-and-group--
--sort-and-group--

=== New and Updated Capture Interfaces support

_Non-empty section placeholder._
--sort-and-group--
--sort-and-group--

//=== Major API Changes
IEEE802.11: wlan_mgt display filter element got renamed to wlan.
Libgcrypt is now a required dependency.

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages. You can
usually install or upgrade Wireshark using the package management system
specific to that platform. A list of third-party packages can be found
on the https://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference
files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary
from platform to platform. You can use About→Folders to find the default
locations on your system.

== Known Problems

Dumpcap might not quit if Wireshark or TShark crashes.
(ws-buglink:1419[])

The BER dissector might infinitely loop.
(ws-buglink:1516[])

Capture filters aren't applied when capturing from named pipes.
(ws-buglink:1814[])

Filtering tshark captures with read filters (-R) no longer works.
(ws-buglink:2234[])

Application crash when changing real-time option.
(ws-buglink:4035[])

Wireshark and TShark will display incorrect delta times in some cases.
(ws-buglink:4985[])

Wireshark should let you work with multiple capture files. (ws-buglink:10488[])

Dell Backup and Recovery (DBAR) makes many Windows applications crash,
including Wireshark. (ws-buglink:12036[])

== Getting Help

Community support is available on https://ask.wireshark.org/[Wireshark's
Q&A site] and on the wireshark-users mailing list. Subscription
information and archives for all of Wireshark's mailing lists can be
found on https://www.wireshark.org/lists/[the web site].

Official Wireshark training and certification are available from
http://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].