Wireshark 4.7.3 Release Notes

The following features are either new or have been significantly updated since version 4.6.0:

Dumpcap’s TCP@host:port interface has been removed. Tools like socat, ncat, netcat, nc, and others can be used to redirect network interfaces to FIFOs and named pipes on UN*X and Windows to achieve the same interface. Many of those tools have additional security features like enabling TLS encryption.

Sharkd only supports binding to a loopback IPv4 or IPv6 address when listening on a TCP socket. (TCP sockets are only available by default on Windows systems, and are deprecated, since UNIX domain sockets are now supported. IPv6 support is new.) Sharkd now rejects connecting to a Linux abstract domain socket from peer processes with effective UID other than that of the sharkd process.

The individual color preferences under Appearance (marked and ignored packets, "Follow Stream" client and server text, display filter validity, and the selected packet) have been removed. These colors are now provided by the selected theme; see the "What’s New" section above.

Building with Qt 5 is no longer supported.

Bachmann M-Module

Apple Darwin Metadata, Axia Livewire, Controller Interface Transport Protocol (CITP), DCERPC SCARD_PACK, DECT NR+, ESUN, Generic UDP Encapsulation (GUE), JSON Dictionary, Linux mac80211_hwsim Netlink, Linux Open vSwitch Netlink (OVS), MCData, MCTP over SMBus/I2C, MIDI System Exclusive DigiTech, Mikrotik RoMON, Multicast Router Discovery (MRD), MySQL X Protocol (MySQLX), NATS, NMEA 2000, Object Transform Protocol (OTP), Perforce P4RPC, PosiStageNet (PSN), PROFINET SXP (PN-SXP), Qualcomm Diagnostic (QCDIAG), RDP Conctrl virtual channel Protocol (CONCTRL), RDP Video Capture Virtual Channel Extension (RDPECAM), Real-Time Tracking Protocol (RTTrP), TrueConf, TrueConf Protocol (TrueConf), UDX, Ultra Ethernet Transport (UET), XGT, and ZigBee ZCL Generic Tunnel

Too many protocol updates have been made to list them all here.

Of particular note, "ike" is now preferred to "isakmp" for filtering the Internet Key Exchange (IKE) protocol and its fields (both IKEv1 and IKEv2), including fields primarily associated with RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP) though "isakmp" remains as an alias for the protocol and all its fields.

The tvb new_subset and tvb length_remaining routines now take unsigned offset and length arguments. Negative offsets, indicating an offset relative to the end of the captured length of the buffer (not reported) are no longer permitted, nor is a length of -1 meaning "to the end of the buffer." For the latter, use tvb_new_subset_remaining instead. Internally, tvbuffer lengths have long been unsigned; this change should simplify dealing with 32-bit unsigned length fields and checking for offsets overflowing.

tvb find_line_end, tvb_find_uint8, tvb_find_uint16 and tvb_ws_mempbrk_pattern_uint8 has been changed in a similar fashion. They now return a boolean, true if found.

Functions tvb_get_string_uint[64] were added that can retrieve an unsigned integer encoded as an ASCII-like string from packet data similar to strtoul but without string copying or otherwise ensuring NUL termination.

Linking with the Heimdal Kerberos library is now deprecated, and support will likely be removed in a future release. Linking with the MIT Kerberos library is still supported.

The list of installed dissector header files has been reduced and is now restricted to ones that contain the following: - Functions marked WS_DLL_PUBLIC - Structs whose names contain "tap_" - The string "PUBLIC_HEADER"

On UN*X systems (excluding macOS when running from an app bundle, as with the official installer) extcap binaries are now searched for under the libexec directory by default, e.g., /usr/libexec/wireshark/extcap instead of /usr/lib64/wireshark/extcap or similar. This is the customary place for helper binaries, which as opposed to libraries do not need multiarch support. The location can be overridden via the environment variable WIRESHARK_EXTCAP_DIR. The extcap binaries shipped with Wireshark are installed in the new location, but third party extcaps may need packaging changes. This change was effective in version 4.6.0, but was not explicitly noted in the release notes previously. Note that some distributions do not use a libexec directory, such as Alpine Linux, which does not have multilib support. On such systems extcap binaries should be in the same location as before.

QUIT messages can now be sent over the optional control pipe to extcaps, which can be used to gracefully shutdown on all operating systems, not just those that support SIGTERM. This uses the existing optional control pipe interface, with the message type "Q" (as also supported by dumpcap.) Previously extcaps only used this pipe for "T" control messages. Extcaps signal support for the control pipe via adding a {control=N} entry to the interface description returned from --extcap-interfaces; N is a bitfield where 1 indicates support for the "T" toolbar messages and 2 indicates support for the "Q" quit message (and 3 indicates support for both.) For backwards compatibility, if an extcap describe toolbar controls in its interface configuration it will be assumed to have "T" support. More information is available in the Developer’s Guide.

Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.