Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what"s going on inside a network cable, just like a voltmeter is used by an electrician to examine what"s going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.
- Deep inspection of hundreds of protocols, with more being added all the time
- Live capture and offline analysis
- Standard three-pane packet browser
- Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
- Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
- The most powerful display filters in the industry
- Rich VoIP analysis
- Read/write many different capture file formats
- Capture files compressed with gzip can be decompressed on the fly
- Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
- Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
- Coloring rules can be applied to the packet list for quick, intuitive analysis
- Output can be exported to XML, PostScript®, CSV, or plain text
Wireshark 4.0.4 changelog:
The following vulnerabilities have been fixed:
- wnpa-sec-2023-08 ISO 15765 and ISO 10681 dissector crash. Issue 18839.
The following bugs have been fixed:
- UTF-8 characters end up escaped in PSML output. Issue 10445.
- Export filtered displayed packets won’t save IP fragments of SCTP fragments needed to reassemble a displayed frame. Issue 12597.
- DICOM dissection in reassembled PDV goes wrong. Issue 13388.
- "Export Objects - IMF" produces incorrect file, TCP reassembly fails with retransmissions that have additional data. Issue 13523.
- The intelligent scroll bar or minimap is not predictable on locating and scrolling. Issue 13989.
- If you mark (or unmark) the currently-selected frame, the packet details still say it’s not marked (or it is marked) Issue 14330.
- An out-of-order packet incorrectly detected as retransmission breaks desegmentation of TCP stream. Issue 15993.
- Sorting Packet Loss Column is not sorting correct. Issue 16785.
- Some HTTPS packets cannot be decrypted. Issue 17406.
- SIP TCP decoding regression from Wireshark 1.99.0 to 3.6.8. Issue 18411.
- Frame comments not preserved when using filter to write new pcap from tshark. Issue 18693.
- ChmodBPF not working on macOS Ventura 13.1. Issue 18734.
- Wireshark GUI and window manager stuck after setting display filter. Issue 18809.
- Dissector bug, protocol H.261. Issue 18812.
- File extension heuristics are case-sensitive. Issue 18821.
- Symbolic links to packages in macOS dmg can’t be double-clicked to install on macOS 13.2. Issue 18830.
- Potential memory leak in tshark.c. Issue 18837.
- Fuzz job crash output: fuzz-2023-02-05-7303.pcap. Issue 18842.
- f5fileinfo: Hardware platforms missing descriptions. Issue 18848.
- The lines in the intelligent scrollbar are off by one. Issue 18850.
- Wireshark crashes on invalid UDS packet in Lua context. Issue 18865.
- TECMP dissector shows the wrong Voltage in Vendor Data. Issue 18871.
- UDS: Names of RDTCI subfunctions 0x0b … 0x0e are not correct. Issue 18873.
Updated Protocol Support
- ASTERIX, BGP, DHCP, ERF, F5 Ethernet trailer, GMR-1 RR, Gryphon, GSM SMS, H.261, H.450, ISO 10681, ISO 15765, MIPv6, NAS-5gs, NR RRC, NS Trace, OptoMMP, PDCP-LTE, PDCP-NR, QSIG, ROHC, RSVP, RTCP, SCTP, SIP, TCP, TECMP, TWAMP, UDS, and UMTS RLC
Download: Wireshark 4.0.4 | 75.0 MB (Open Source)
Download: Portable Wireshark 4.0.4 | Wireshark for macOS
View: Wireshark Website