197 lines
6.6 KiB
Plaintext
197 lines
6.6 KiB
Plaintext
Wireshark 0.99.5 Release Notes
|
|
|
|
------------------------------------------------------------------
|
|
|
|
What is Wireshark?
|
|
|
|
Wireshark is the world's most popular network protocol analyzer.
|
|
It is used for troubleshooting, analysis, development, and
|
|
education.
|
|
|
|
What's New
|
|
|
|
Bug Fixes
|
|
|
|
The following vulnerabilities have been fixed. See the [1]security
|
|
advisory for details and a workaround.
|
|
|
|
o The TCP dissector could hang or crash while reassembling HTTP
|
|
packets. (Bug [2]1200)
|
|
|
|
Versions affected: 0.99.2 to 0.99.4
|
|
|
|
[3]CVE-2007-0459
|
|
|
|
o The HTTP dissector could crash.
|
|
|
|
Versions affected: 0.99.3 to 0.99.4
|
|
|
|
[4]CVE-2007-0458
|
|
|
|
o On some systems, the IEEE 802.11 dissector could crash.
|
|
|
|
Versions affected: 0.10.14 to 0.99.4
|
|
|
|
[5]CVE-2007-0457
|
|
|
|
o On some systems, the LLT dissector could crash.
|
|
|
|
Versions affected: 0.99.3 to 0.99.4
|
|
|
|
[6]CVE-2007-0456
|
|
|
|
The following bugs have been fixed:
|
|
|
|
o On Windows systems the packet list scroll bar could sometimes
|
|
disappear or become unusable. ([7]Bug 220)
|
|
|
|
o The end of HTTP chunked encoding wasn't being displayed.
|
|
([8]Bug 646)
|
|
|
|
o The Follow TCP Stream window could omit characters. ([9]Bug
|
|
1043)
|
|
|
|
o Opening a flow graph could crash Wireshark. ([10]Bug 1117)
|
|
|
|
o Follow TCP Stream would sometimes get the direction wrong.
|
|
([11]Bug 1138)
|
|
|
|
o The foreground text in the coloring rules editor was always
|
|
black.. ([12]Bug 1164)
|
|
|
|
o The CSV export format was incorrect. ([13]Bug 1173)
|
|
|
|
o On some Windows systems Wireshark could take a long time to
|
|
start up.
|
|
|
|
o Malformed UDLD packets could cause an exception.
|
|
|
|
o The ISUP statistics report could overflow a buffer and crash
|
|
when displaying IPv6 addresses.
|
|
|
|
New and Updated Features
|
|
|
|
The following features are new (or have been significantly
|
|
updated) since the last release:
|
|
|
|
o We are now offering Wireshark as a [14]U3 package for Windows.
|
|
U3 packages are suitable for using on USB drives and CD-ROMs.
|
|
It's still experimental, but you're welcome to try it out and
|
|
report any problems or successes.
|
|
|
|
o Decryption support for WPA/WPA2 and SNMPv3 has been added. The
|
|
TDS / MS SQL dissector now de-obfuscates passwords.
|
|
|
|
o 64-bit file handling has been improved.
|
|
|
|
o The Find function now selects the corresponding packet detail
|
|
item. Find functionality has been added to the TCP and SSL
|
|
stream dialogs.
|
|
|
|
o Main window keyboard navigation has been improved.
|
|
|
|
o Windows file dialogs now show the "places" bar (Desktop, My
|
|
Documents, My Computer, My Network Places, etc). File dialogs
|
|
now default to "My Documents" in accordance with Microsoft's
|
|
HIG.
|
|
|
|
o [15]AirPcap support (which provides raw mode capture under
|
|
Windows) has been enhanced to allow capturing on multiple
|
|
AirPcap adapters simultaneously.
|
|
|
|
o You can no longer install Wireshark on Windows 95, 98, or ME.
|
|
(OK, so it's not a feature per se, but it's an important
|
|
change). The last version known to work on these systems is
|
|
[16]Ethereal 0.99.0.
|
|
|
|
o ASN.1 BER-encoded files can now be dissected according to a
|
|
user-specified syntax.
|
|
|
|
New Protocol Support
|
|
|
|
DMP, Homeplug (INT51X1), NBD, OMAPI, PKCS#12, RGMP, Roofnet, STUN
|
|
v2
|
|
|
|
Updated Protocol Support
|
|
|
|
2dparityfec, ACN, AIM, AMR, ANSI 637, ANSI A, ANSI MAP, ARP, ASN.1
|
|
BER, ASN.1 PER, BACapp, BPDU, CAMEL, DCERPC (DCERPC, EFS,
|
|
EVENTLOG, NSPI, PN-IO, WINREG), DCOM CBA, DCP, DHCP, DHCPv6, DMP,
|
|
DNS, E.164, EAP, EPL, ETSI DCP, FCP, GIOP, GSM A, H.245, H.248,
|
|
HPSW, HTTP, ICMP, ICMPv6, IEEE 802.11, IMAP, INAP, IPMI, IPsec,
|
|
IRC, ISAKMP, iSCSI, ISIS LSP, IuUP, K12, Kerberos, LDAP, LLDP,
|
|
MEGACO, MGCP, MIME Multipart, MMS, MMSE, MSRP, MySQL, NetFlow,
|
|
NFS, NTLMSSP, NTP, OSPF, PN-PTCP, PPPoE, Q.931, Radiotap, RADIUS,
|
|
RPC, RSVP, RTCP, S4406, SCCP, SCSI, SDP, SES, sFlow, SIGCOMP, SIP,
|
|
SIR, Skinny, SMB (SMB, NETLOGON), SMTP, SNMP, SPNEGO, SSL, T.38,
|
|
TCP, TDS, text/media, TIPC, UDLD, UDP Lite, UDP, UMA, UMTS FP,
|
|
USB, VNC, WBXML, WLCCP, WSP, X.411, X.420, XML, XOT, YMSG
|
|
|
|
New and Updated Capture File Support
|
|
|
|
Catapult DCT2000, Netttl, Windows Sniffer / NetXray
|
|
|
|
Getting Wireshark
|
|
|
|
Wireshark source code and installation packages are available from
|
|
the [17]download page on the main web site.
|
|
|
|
Vendor-supplied Packages
|
|
|
|
Most Linux and Unix vendors supply their own Wireshark packages.
|
|
You can usually install or upgrade Wireshark using the package
|
|
management system specific to that platform. A list of third-party
|
|
packages can be found on the [18]download page on the Wireshark
|
|
web site.
|
|
|
|
File Locations
|
|
|
|
Wireshark and TShark look in several different locations for
|
|
preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
|
|
These locations vary from platform to platform. You can use
|
|
About->Folders to find the default locations on your system.
|
|
|
|
Known Problems
|
|
|
|
The Filter button is nonfunctional in the file dialogs under
|
|
Windows. ([19]Bug 942)
|
|
|
|
Getting Help
|
|
|
|
Community support is available on the wireshark-users mailing
|
|
list. Subscription information and archives for all of Wireshark's
|
|
mailing lists can be found on [20]the web site.
|
|
|
|
Commercial support, training, and development services are
|
|
available from [21]CACE Technologies.
|
|
|
|
Frequently Asked Questions
|
|
|
|
A complete FAQ is available on the [22]Wireshark web site.
|
|
|
|
References
|
|
|
|
Visible links
|
|
1. http://www.wireshark.org/security/wnpa-sec-2007-01.html
|
|
2. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1200
|
|
3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0459
|
|
4. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0458
|
|
5. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0457
|
|
6. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0456
|
|
7. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=220
|
|
8. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=646
|
|
9. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1043
|
|
10. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1117
|
|
11. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1138
|
|
12. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1164
|
|
13. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1173
|
|
14. http://www.u3.com/
|
|
15. http://www.cacetech.com/products/airpcap.htm
|
|
16. http://www.ethereal.com/
|
|
17. http://www.wireshark.org/download.html
|
|
18. http://www.wireshark.org/download.html#otherplat
|
|
19. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=942
|
|
20. http://www.wireshark.org/lists/
|
|
21. http://www.cacetech.com/
|
|
22. http://www.wireshark.org/faq.html
|