include::attributes.adoc[]
:stylesheet: ws.css
:linkcss:
:copycss: {css_dir}/{stylesheet}

= Wireshark {wireshark-version} Release Notes
// Asciidoctor Syntax Quick Reference:
// https://asciidoctor.org/docs/asciidoc-syntax-quick-reference/

== What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer.
It is used for troubleshooting, analysis, development and education.

Wireshark is hosted by the Wireshark Foundation, a nonprofit which promotes protocol analysis education.
Wireshark and the foundation depend on your contributions in order to do their work.
If you or your organization would like to contribute or become a sponsor, please visit https://wiresharkfoundation.org[wiresharkfoundation.org].

== What’s New

=== Bug Fixes

The following vulnerabilities have been fixed:

* wssalink:2024-12[]
ITS dissector crash.
wsbuglink:20026[].
// cveidlink:2024-xxx[].
// Fixed in master: 6d22bfced6
// Fixed in release-4.4: 733544bb66
// Fixed in release-4.2: n/a
// CVSS AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
// CWE-456
// * Fuzz job crash: fuzz-2024-08-29-7609.pcap. wsbuglink:20026[].

* wssalink:2024-13[]
AppleTalk and RELOAD Framing dissector crashes.
wsbuglink:20114[].
// cveidlink:2024-xxx[].
// Fixed in master: 3de741321f, 636ab9da8b, 692f9bed05
// Fixed in release-4.4: 418fd5fe4b, d17a2febc5, 9f33105c74
// Fixed in release-4.2: cad248ce3b, 681cb0521e, 1c5e4b8cf4
// CVSS AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
// CWE-230
// * Fuzz job crash: fuzz-2024-10-08-7201.pcap. wsbuglink:20114[].

// * wssalink:2024-14[]
// Foo dissector {crash,infinite loop,memory leak}.
// wsbuglink:xxx[].
// cveidlink:2024-xxx[].
// Fixed in master: xxx
// Fixed in release-4.4: xxx
// Fixed in release-4.2: xxx
// CVSS AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
// CWE-824

The following bugs have been fixed:

//The following bugs have been fixed:
//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
//* Wireshark took a bite out of each of your freshly baked muffins until it found the perfect one.

* Refresh interface during live-capture leads to corrupt interface handling. wsbuglink:11176[].
* Media type "application/octet-stream" registered for both Thread and UASIP. wsbuglink:14729[].
* Extcap toolbar stops working when new interface is added. wsbuglink:19854[].
* Decoding error ITS CPM version 2.1.1. wsbuglink:19886[].
* Build error in 4.3.0: sync_pipe_run_command_actual error: argument 2 is null but the corresponding size argument 3 value is 512004 [-Werror=nonnull] wsbuglink:19930[].
* html2text.py doesn't handle the `<sup>` tag. wsbuglink:20020[].
* Incorrect NetFlow v8 TOS AS aggregation dissection. wsbuglink:20021[].
* The Windows packages don't ship with the IP address plugin. wsbuglink:20030[].
* O_PATH is Linux-and-FreeBSD-specific. wsbuglink:20031[].
* Wireshark 4.4.0 doesn't install USBcap USBcapCMD.exe in the correct directory. wsbuglink:20040[].
* OER dissector is not considering the preamble if ASN.1 SEQUENCE definition includes extension marker but no OPTIONAL items. wsbuglink:20044[].
* Bluetooth classic L2CAP incorrect dissection with connectionless reception channel. wsbuglink:20047[].
* Profile auto switch filters : Grayed Display Filter Expression dialog box when opened from Configuration Profiles dialog box. wsbuglink:20049[].
* TECMP Data Type passes too much data to sub dissectors. wsbuglink:20052[].
* Wireshark and tshark 4.4.0 ignore extcap options specified on the command line. wsbuglink:20054[].
* Cannot open release notes due to incorrect path with duplicated directory components. wsbuglink:20055[].
* Unable to open "Release Notes" from the "Help" menu. wsbuglink:20056[].
* No capture interfaces if Wireshark is started from command line with certain paths. wsbuglink:20057[].
* Wireshark 4.4.0 extcap path change breaks third party extcap installers. wsbuglink:20069[].
* Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. wsbuglink:20071[].
* Unable to create larger files than 99 size units. wsbuglink:20079[].
* PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0 (was working in 4.2.7) wsbuglink:20088[].
* GUI lags because NetworkManager keeps turning 802.11 monitor mode off. wsbuglink:20090[].
* Error while getting Bluetooth application process id by <shell:ps -A | grep com.*android.bluetooth> wsbuglink:20100[].
* Fuzz job assertion: randpkt-2024-10-05-7200.pcap. wsbuglink:20110[].

== Known Bugs

* Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. wsbuglink:20051[].
* Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone Mirroring. wsbuglink:20082[].

=== New and Updated Features

* The TShark syntax for dumping only fields with a certain prefix has changed
  from `-G fields prefix` to `-G fields,prefix`. This allows `tshark -G fields`
  to again support also specifying the configuration profile to use.

// === Removed Features and Support

// === Removed Dissectors

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

// Add one protocol per line between the -- delimiters.
// ag -A1 '(define PSNAME|proto_register_protocol[^_])' $(git diff --name-only v4.4.0.. | ag packet- | sort -u)
[commaize]
--
AppleTalk
ARTNET
BGP
BT L2CAP
CoAP
CIGI
CIP Motion
COSE
DISTCC
DMP
Ethernet OAM PDU
F5 FILEINFO
GIOP
GOOSE
GSM Management
GSM SIM
GTP
HTTP
HTTP2
ID3v2
IDN
IEEE 1609.2
IEEE 802.11
IPPUSB
iRDMA
ISystemActivator
ITS
Kerberos
LwM2M-TLV
MMS
MQ
MySQL
NCP SSS
NetFlow
OER
OWAMP
QNET
RELOAD Framing
RTCP
RTLS
SANE
SMB2
SSyncP
Sysdig Event
T.124
TECMP
Thread
Thrift
TWAMP
--

=== New and Updated Capture File Support

// There is no new or updated capture file support in this release.
// Add one file type per line between the -- delimiters.
[commaize]
--
BLF
CLLOG
CommView
ERF
pcap
--

=== Updated File Format Decoding Support

There is no updated file format support in this release.
// Add one file type per line between the -- delimiters.
// [commaize]
// --
// --

// === New and Updated Capture Interfaces support

// === New and Updated Codec support

// === Major API Changes

== Prior Versions

This document only describes the changes introduced in Wireshark {wireshark-version}.
You can find release notes for prior versions at the following locations:

Wireshark 4.4.0 included the following changes.
See the
https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html[release notes]
for details:

Many improvements and fixes to the graphing dialogs, including
I/O Graphs, Flow Graph / VoIP Calls, and TCP Stream Graphs.

Wireshark now supports automatic profile switching.
You can associate a display filter with a configuration profile, and when you open a capture file that matches the filter, Wireshark will automatically switch to that profile.

Support for Lua 5.3 and 5.4 has been added, and support for Lua 5.1 and 5.2 has been removed.
The Windows and macOS installers now ship with Lua 5.4.6.

Improved display filter support for value strings (optional string representations for numeric fields).

Display filter functions can be implemented as plugins, similar to protocol dissectors and file parsers.

Display filters can be translated to pcap filters using menu:Edit[Copy,Display filter as pcap filter] if each display filter field has a corresponding pcap filter equivalent.

Custom columns can be defined using any valid field expression, such as
display filter functions, packet slices, arithmetic calculations, logical tests,
raw byte addressing, and protocol layer modifiers.

Custom output fields for `tshark -e` can also be defined using any
valid field expression.

Wireshark can be built with the zlib-ng instead of zlib for compressed file support.
Zlib-ng is substantially faster than zlib.
The official Windows and macOS packages include this feature.

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package management system specific to that platform.
A list of third-party packages can be found on the
https://www.wireshark.org/download.html[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform.
You can use menu:Help[About Wireshark,Folders] or `tshark -G folders` to find the default locations on your system.

== Getting Help

The User’s Guide, manual pages and various other documentation can be found at
https://www.wireshark.org/docs/

Community support is available on
https://ask.wireshark.org/[Wireshark’s Q&A site]
and on the wireshark-users mailing list.
Subscription information and archives for all of Wireshark’s mailing lists can be found on https://lists.wireshark.org/lists/[the mailing list site].

Bugs and feature requests can be reported on
https://gitlab.com/wireshark/wireshark/-/issues[the issue tracker].

You can learn protocol analysis and meet Wireshark’s developers at
https://sharkfest.wireshark.org[SharkFest].

// Official Wireshark training and certification are available from
// https://www.wiresharktraining.com/[Wireshark University].

== How You Can Help

The Wireshark Foundation helps as many people as possible understand their networks as much as possible.
You can find out more and donate at https://wiresharkfoundation.org[wiresharkfoundation.org].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
