wireshark-4.0.0

[Bruce Dubbs]

New major version.

[Bruce Dubbs]

What’s New

• The display filter syntax is more powerful with many new extensions. See below for details.

• The Conversation and Endpoint dialogs have been redesigned. See below for details.

• The default main window layout has been changed so that the Packet Detail and Packet Bytes are side by side underneath the Packet List pane.

• Hex dump imports from Wireshark and from text2pcap have been improved. See below for details.

• Speed when using MaxMind geolocation has been greatly improved.

• The tools and libraries required to build Wireshark have changed. See “Other Development Changes” below for more details.

• Many other improvements have been made. See the “New and Updated Features” section below for more details.

New and Updated Features

The following features are new (or have been significantly updated) since version 4.0.0rc2:

Nothing of note.

The following features are new (or have been significantly updated) since version 4.0.0rc1:

• The macOS packages now ship with Qt 6.2.4 and require macOS 10.14. They previously shipped with Qt 5.15.3.

• The Windows installers now ship with Npcap 1.71. They previously shipped with Npcap 1.70.

The following features are new (or have been significantly updated) since version 3.7.2:

• The Windows installers now ship with Npcap 1.70. They previously shipped with Npcap 1.60.

The following features are new (or have been significantly updated) since version 3.7.1:

• The 'v' (lower case) and 'V' (upper case) switches have been swapped for editcap and mergecap to match the other command line utilities.

• The ip.flags field is now only the three high bits, not the full byte. Display filters and Coloring rules using the field will need to be adjusted.

• New address type AT_NUMERIC allows simple numeric addresses for protocols which do not have a more common-style address approach, analog to AT_STRINGZ.

The following features are new (or have been significantly updated) since version 3.7.0:

• The Windows installers now ship with Qt 6.2.3. They previously shipped with Qt 6.2.4.

• The Conversation and Endpoint dialogs have been redesigned with the following improvements:
  • The context menu now includes the option to resize all columns, as well as copying elements.
  • Data may be exported as JSON.
  • Tabs may be detached and reattached from the dialog.
  • Adding and removing tabs will keep them in the same order all the time.
  • If a filter is applied, two columns are shown in either dialog detailing the difference between unmatched and matched packets.
  • Columns are now sorted via secondary properties if an identical entry is found.
    • Conversations are sorted via second address and first port number.
    • Endpoints are sorted via port numbers.
    • IPv6 addresses are sorted correctly after IPv4 addresses.
  • The dialog elements have been moved to make it easier to handle for new users.
    • Selection of tap elements is done via a list.
    • All configurations and options are done via a left side button row.
  • Columns for the Conversations and Endpoint dialogs can be hidden by a context menu.
  • TCP and UDP conversations now include the stream ID and allow filtering on it.

• The display filter syntax has been updated and enhanced:
  • A syntax to match a specific layer in the protocol stack has been added. For example in an IP-over-IP packet “ip.addr#1 == 1.1.1.1” matches the outer layer addresses and “ip.addr#2 == 1.1.1.2” matches the inner layer addresses.
  • Universal quantifiers "any" and "all" have been added to any relational operator. For example the expression "all tcp.port {gt} 1024" is true if and only if all tcp.port fields match the condition. Previously only the default behaviour to return true if any one field matches was supported.
  • Field references, of the form ${some.field}, are now part of the syntax of display filters. Previously they were implemented as macros. The new implementation is more efficient and has the same properties as protocol fields, like matching on multiple values using quantifiers and support for layer filtering.
  • Arithmetic is supported for numeric fields with the usual operators “+”, “-”, “*”, “/”, and “%”. Arithmetic expressions must be grouped using curly brackets (not parenthesis).
  • New display filter functions max(), min() and abs() have been added.
  • Functions can accept expressions as arguments, including other functions. Previously only protocol fields and slices were syntactically valid function arguments.
  • A new syntax to disambiguate literals from identifiers has been added. Every value with a leading dot is a protocol or protocol field. Every value in between angle brackets is a literal value. See the ​https://www.wireshark.org/docs/wsug_html_chunked /ChWorkBuildDisplayFilterSection.html#_some_protocol_names_can_be_ambiguous[User’s Guide] for details.
  • The "bitwise and" operator is now a first-class bit operator, not a boolean operator. In particular this means it is now possible to mask bits, e.g.: frame[0] & 0x0F == 3.
  • Dates and times can be given in UTC using ISO 8601 (with 'Z' timezone) or by appending the suffix "UTC" to the legacy formats. Otherwise local time is used.
  • Integer literal constants may be written in binary (in addition to decimal/octal /hexadecimal) using the prefix "0b" or "0B".
  • Logical AND now has higher precedence than logical OR, in line with most programming languages.
  • It is now possible to index protocol fields from the end using negative indexes. For example the following expression tests the last two bytes of the TCP protocol field: tcp[-2:] == AA:BB. This was a longstanding bug that has been fixed in this release.
  • Set elements must be separated using a comma, e.g: {1, 2, "foo"}. Using only whitespace as a separator was deprecated in 3.6 and is now a syntax error.
  • Support for some additional character escape sequences in double quoted strings has been added. Along with octal (\<number>) and hex (\x<number>) encoding, the following C escape sequences are now supported with the same meaning: \a, \b, \f, \n, \r, \t, \v. Previously they were only supported with character constants.

See the release-notes.adoc file in the tarball for more.

[Bruce Dubbs]

Fixed at commit f78476cea6.