Wireshark is the world's foremost network protocol analyzer, and is the de facto standard across many industries and educational institutions.
- Deep inspection of hundreds of protocols, with more being added all the time
- Live capture and offline analysis
- Standard three-pane packet browser
- Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
- Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
- The most powerful display filters in the industry
- Rich VoIP analysis
- Read/write many different capture file formats
- Capture files compressed with gzip can be decompressed on the fly
- Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
- Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
- Coloring rules can be applied to the packet list for quick, intuitive analysis
- Output can be exported to XML, PostScript®, CSV, or plain text
The following bugs have been fixed:
MSDP dissector infinite loop.
Profinet I/O buffer overrun.
Modbus dissector crash.
IrCOMM dissector buffer overrun.
Incorrect presentation of Ascend-Data-Filter (RADIUS attribute 242).
Confusing "Apply a display filter <Command/>" keyboard shortcut.
Wireshark crashes at startup if it needs to display a dialog early in the startup process.
RADIUS dictionary: BEGIN-VENDOR does not support format=Extended-Vendor-Specific-\*.
Dumpcap on big-endian machines writes out corrupt, unreadable Enhanced Packet Blocks.
Interface Toolbar support for Windows.
Wireshark should behave better on high resolution displays on Windows.
Udpdump.pod missing from build.
RTP Player Format Error.
VNC Protocol disector : Framebuffer Updates.
DNS LOC RRs with out-of-range longitude or latitude aren’t shown as errors.
DIS Dissector Entity Appearance Record displayed in wrong location.
Win64 CMake bug - (CYGWIN_INSTALL_PATH redefinition) causing missing packages when using CMake 3.9.0.
APL records parsed incorrectly for IPv4 prefixes.
File?Merge dialog doesn’t show all options. Resizing doesn’t help.
TCAP SRT Analysis incorrectly matched TCAP begins and ends.
Error in MKA Distributed SAK parameter set dissection.
E.212: Check length before trying 3-digits MNC.
mpeg_descriptor: AC3 System A: Respect descriptor length.
Crash in Wireshark using Dumper:dump() from Lua.
MRCPv2 not decoded correctly.
UDP Checksum verification not working for 0x0000 checksum.
OSPF v3 LSA Type not well parsed.
GTPv2 - decoding issue for Packet Flow ID (type 123).
TRANSUM fails to calculate RTE figures for DCE-RPC where request Packet Type is zero.
BTLE Hop and SCA fields incorrectly dissected in BLE CONNECT_REQ.
[oss-fuzz] BGP memleak: ASAN: 276 byte(s) leaked in 5 allocation(s).
Some Infiniband Connect Req fields are not decoded correctly.
GTP: gtp.ext_comm_flags_II_pmtsmi bit not decoded correctly.
InfiniBand: sIP and dIP inside IP CM Private Data are decoded in the wrong order.
802.11 wlan.ft.subelem.r0kh_id should be sequence of bytes.
USB capture: Unrecognized libpcap format or not libpcap data.
SQ Header Pointer in NVMoF response capsule is decoded with the wrong endian.
Updated Protocol Support:
BGP, BT LE, DIS, DNS, E.212, EPL, GTP, GTPv2, IEEE 802.11, InfiniBand, IPv4, IrCOMM, MKA, Modbus, MPEG Descriptor, MRCPv2, MSDP, MTP2, Nordic BLE, NVMe, OSPF, pcapng MIME, PMIPv6, Profinet I/O, RADIUS, SML, TCAP, TRANSUM, UA3G, UDP, VNC, and ZigBee.