Wireshark 4.4.1

Wireshark

Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

Deep inspection of hundreds of protocols, with more being added all the time
Live capture and offline analysis
Standard three-pane packet browser
Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
The most powerful display filters in the industry
Rich VoIP analysis
Read/write many different capture file formats
Capture files compressed with gzip can be decompressed on the fly
Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
Coloring rules can be applied to the packet list for quick, intuitive analysis
Output can be exported to XML, PostScript®, CSV, or plain text

Wireshark 4.4.1 changelog:

The following vulnerabilities have been fixed

wnpa-sec-2024-12 ITS dissector crash. Issue 20026.
wnpa-sec-2024-13 AppleTalk and RELOAD Framing dissector crashes. Issue 20114.

The following bugs have been fixed

Refresh interface during live-capture leads to corrupt interface handling. Issue 11176.
Media type "application/octet-stream" registered for both Thread and UASIP. Issue 14729.
Extcap toolbar stops working when new interface is added. Issue 19854.
Decoding error ITS CPM version 2.1.1. Issue 19886.
Build error in 4.3.0: sync_pipe_run_command_actual error: argument 2 is null but the corresponding size argument 3 value is 512004 [-Werror=nonnull] Issue 19930.
html2text.py doesn’t handle the ^{tag. Issue 20020.}
Incorrect NetFlow v8 TOS AS aggregation dissection. Issue 20021.
The Windows packages don’t ship with the IP address plugin. Issue 20030.
O_PATH is Linux-and-FreeBSD-specific. Issue 20031.
Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the correct directory. Issue 20040.
OER dissector is not considering the preamble if ASN.1 SEQUENCE definition includes extension marker but no OPTIONAL items. Issue 20044.
Bluetooth classic L2CAP incorrect dissection with connectionless reception channel. Issue 20047.
Profile auto switch filters : Grayed Display Filter Expression dialog box when opened from Configuration Profiles dialog box. Issue 20049.
Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue 20051.
TECMP Data Type passes too much data to sub dissectors. Issue 20052.
Wireshark and tshark 4.4.0 ignore extcap options specified on the command line. Issue 20054.
Cannot open release notes due to incorrect path with duplicated directory components. Issue 20055.
Unable to open "Release Notes" from the "Help" menu. Issue 20056.
No capture interfaces if Wireshark is started from command line with certain paths. Issue 20057.
Wireshark 4.4.0 extcap path change breaks third party extcap installers. Issue 20069.
Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue 20071.
Unable to create larger files than 99 size units. Issue 20079.
Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone Mirroring. Issue 20082.
PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0 (was working in 4.2.7) Issue 20088.
GUI lags because NetworkManager keeps turning 802.11 monitor mode off. Issue 20090.
Error while getting Bluetooth application process id by Issue 20100.
Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue 20110.

New and Updated Features

The TShark syntax for dumping only fields with a certain prefix has changed from -G fields prefix to -G fields,prefix. This allows tshark -G fields to again support also specifying the configuration profile to use.

Updated Protocol Support

AppleTalk, ARTNET, BGP, BT L2CAP, CIGI, CIP Motion, CoAP, COSE, DISTCC, DMP, Ethernet OAM PDU, F5 FILEINFO, GIOP, GOOSE, GSM Management, GSM SIM, GTP, HTTP, HTTP2, ID3v2, IDN, IEEE 1609.2, IEEE 802.11, IPPUSB, iRDMA, ISystemActivator, ITS, Kerberos, LwM2M-TLV, MMS, MQ, MySQL, NCP SSS, NetFlow, OER, OWAMP, QNET, RELOAD Framing, RTCP, RTLS, SANE, SMB2, SSyncP, Sysdig Event, T.124, TECMP, Thread, Thrift, and TWAMP

New and Updated Capture File Support