include::attributes.asciidoc[]
+:stylesheet: ws.css
+:linkcss:
= Wireshark {wireshark-version} Release Notes
// AsciiDoc quick reference: http://powerman.name/doc/asciidoc
+// Asciidoctor Syntax Quick Reference:
+// http://asciidoctor.org/docs/asciidoc-syntax-quick-reference/
This is a semi-experimental release intended to test new features for
Wireshark 2.6.
== What is Wireshark?
-Wireshark is the world's most popular network protocol analyzer. It is
+Wireshark is the world’s most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.
-== What's New
+== What’s New
-* Display filter buttons can now be edited, disabled, and removed via a context
- menu directly from the toolbar
-
-* Drag&Drop filter fields to the display filter toolbar or edit to create
- a button on the fly or apply the filter as a display filter.
+Wireshark 2.6 is the last release that will support the legacy (GTK+)
+user interface. It will not be supported or available in Wireshark 3.0.
-* Application startup time has been reduced.
-
-* Some keyboard shortcut mix-up has been resolved by assigning new shortcuts
- to Edit -> Copy methods.
-
-* The installation step for Wireshark will now install headers required to
- build plugins. A pkg-config file is provided to help with this
- (see doc/plugins.example for details). Note you must still rebuild all
- plugins between minor releases (X.Y).
+Many user interface improvements have been made. See the “New and Updated
+Features” section below for more details.
//=== Bug Fixes
//The following bugs have been fixed:
-//* ws-buglink:5000[]
-//* ws-buglink:6000[Wireshark bug]
-//* cve-idlink:2014-2486[]
+//* ws_buglink:5000[]
+//* ws_buglink:6000[Wireshark bug]
+//* cve_idlink:2014-2486[]
//* Wireshark convinced you to switch seats on the plane while neglecting to tell you that its seat was noticeably moist.
//_Non-empty section placeholder._
=== New and Updated Features
+The following features are new (or have been significantly updated)
+since version 2.5.0:
+
+* HTTP Referer statistics are now supported.
+* Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite
+ Legacy databases has been removed.
+* The Windows packages are now built using Microsoft Visual Studio 2017.
+* The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed.
+
The following features are new (or have been significantly updated)
since version 2.4.0:
-* Add color support for TShark with --color option.
+
+* Display filter buttons can now be edited, disabled, and removed via a context
+ menu directly from the toolbar
+* Drag & Drop filter fields to the display filter toolbar or edit to create
+ a button on the fly or apply the filter as a display filter.
+* Application startup time has been reduced.
+* Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts
+ to Edit -> Copy methods.
+* TShark now supports color using the --color option.
* The "matches" display filter operator is now case-insensitive.
* Display expression (button) preferences have been converted to a UAT.
This puts the display expressions in their own file. Wireshark still
supports preference files that contain the old preferences, but new
preference files will be written without the old fields.
* SMI private enterprise numbers are now read from the "enterprises.tsv" configuration file.
-* QUIC dissector is renamed to G(oogle) QUIC (quic => gquic).
-* Selected packet number can now be shown in the Status Bar by enabling
+* The QUIC dissector has been renamed to **G**oogle QUIC (quic -> **g**quic).
+* The selected packet number can now be shown in the Status Bar by enabling
Preferences -> Appearance -> Layout -> Show selected packet number.
-* File load time in Status Bar is now disabled by default and can be enabled in
+* File load time in the Status Bar is now disabled by default and can be enabled in
Preferences -> Appearance -> Layout -> Show file load time.
-* Support for G.729 codec in the RTP Player (via the bcg729 library).
-* Support for hardware-timestamping of packets
+* Support for the G.729A codec in the RTP Player is now added via the bcg729 library.
+* Support for hardware-timestamping of packets has been added.
* Improved NetMon .cap support with comments, event tracing, network filter,
network info types and some Message Analyzer exported types.
-* Personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins.
-* Add Flow Graph functionality to TShark using -z
+* The personal plugins folder on Linux/Unix is now {tilde}/.local/lib/wireshark/plugins.
+* TShark can print flow graphs using `-z flow…`
* Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output
has been removed.
-* Packet editor has been removed (GTK only experimental feature).
+* The packet editor has been removed. (This was a GTK+ only experimental feature.)
* Support BBC micro:bit Bluetooth profile
+* The Linux and UNIX installation step for Wireshark will now install
+ headers required to build plugins. A pkg-config file is provided to
+ help with this (see doc/plugins.example for details). Note you must
+ still rebuild all plugins between minor releases (X.Y).
+* The Windows installers and packages now ship with Qt 5.9.4.
+* The generic data dissector can now uncompress zlib compressed data.
//=== Removed Dissectors
=== New Protocol Support
-// Add one protocol per line between the --sort-and-group-- delimiters.
---sort-and-group--
-LoRaTap
-LoRaWAN
-ISOBUS
+// Add one protocol per line between the -- delimiters.
+[commaize]
+--
+ActiveMQ Artemis Core Protocol
AMT (Automatic Multicast Tunneling)
-QUIC (IETF)
-Wi-Fi Device Provisioning Protocol
-PFCP (Packet Forwarding Control Protocol)
-Tibia
+Bluetooth Mesh
Broadcom tags (Broadcom Ethernet switch management frames)
-GRPC (gRPC)
-SolarEdge monitoring protocol
-Protobuf (Protocol Buffers)
+CVS password server
+CAN-ETH
+Excentis DOCSIS31 XRA header
FP Mux
-Network Functional Application Platform Interface (NFAPI) Protocol
-IEEE 1905.1a
-Bluetooth Mesh
-TWAMP and OWAMP
-ActiveMQ Artemis Core Protocol
+GRPC (gRPC)
IEEE 802.3br Frame Preemption Protocol
+IEEE 802.11ax (High Efficiency WLAN (HEW))
+IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams
+IEEE 1905.1a
+ISOBUS
+LoRaTap
+LoRaWAN
Lustre Network
+Lustre Filesystem
+Network Functional Application Platform Interface (NFAPI) Protocol
+New Radio Radio Resource Control protocol
NXP 802.15.4 Sniffer Protocol
---sort-and-group--
+PFCP (Packet Forwarding Control Protocol)
+Protobuf (Protocol Buffers)
+QUIC (IETF)
+RFC 4108 Using CMS to Protect Firmware Packages
+SolarEdge monitoring protocol
+Session Multiplex Protocol
+Steam In-Home Streaming Discovery Protocol
+Tibia
+TWAMP and OWAMP
+Wi-Fi Device Provisioning Protocol
+Wi-SUN FAN Protocol
+--
=== Updated Protocol Support
=== New and Updated Capture File Support
-_Non-empty section placeholder._
+//_Non-empty section placeholder._
// Add one file type per line between the --sort-and-group-- delimiters.
---sort-and-group--
---sort-and-group--
+[commaize]
+Microsoft Network Monitor
=== New and Updated Capture Interfaces support
-_Non-empty section placeholder._
---sort-and-group--
+//_Non-empty section placeholder._
+[commaize]
+--
LoRaTap
---sort-and-group--
+--
//=== Major API Changes
== Known Problems
Dumpcap might not quit if Wireshark or TShark crashes.
-(ws-buglink:1419[])
+(ws_buglink:1419[])
The BER dissector might infinitely loop.
-(ws-buglink:1516[])
+(ws_buglink:1516[])
Capture filters aren't applied when capturing from named pipes.
-(ws-buglink:1814[])
+(ws_buglink:1814[])
Filtering tshark captures with read filters (-R) no longer works.
-(ws-buglink:2234[])
+(ws_buglink:2234[])
Application crash when changing real-time option.
-(ws-buglink:4035[])
+(ws_buglink:4035[])
Wireshark and TShark will display incorrect delta times in some cases.
-(ws-buglink:4985[])
-
-Wireshark should let you work with multiple capture files. (ws-buglink:10488[])
+(ws_buglink:4985[])
-Dell Backup and Recovery (DBAR) makes many Windows applications crash,
-including Wireshark. (ws-buglink:12036[])
+Wireshark should let you work with multiple capture files. (ws_buglink:10488[])
== Getting Help
-Community support is available on https://ask.wireshark.org/[Wireshark's
+Community support is available on https://ask.wireshark.org/[Wireshark’s
Q&A site] and on the wireshark-users mailing list. Subscription
-information and archives for all of Wireshark's mailing lists can be
+information and archives for all of Wireshark’s mailing lists can be
found on https://www.wireshark.org/lists/[the web site].
Official Wireshark training and certification are available from
git.samba.org / metze / wireshark / wip.git / blobdiff