Wireshark 2.4.0rc1 Released

June 7, 2017

Wireshark 2.4.0rc1 has been released. This is the first release candidate for Wireshark 2.4.0. Installers for Windows, macOS, and source code are now available.

New or significantly updated features since version 2.2.0

  • Experimental 32-bit and 64-bit Windows Installer (.msi) packages are available. It is recommended that you use these independently of the NSIS (.exe) installers. That is, you should make sure the NSIS package is completely uninstalled before installing the Windows Installer package and vice-versa.
  • Source packages are now compressed using xz instead of bzip2.
  • The legacy (GTK+) UI is disabled by default in the Windows installer.
  • The legacy (GTK+) UI is disabled by default in Autotools and CMake.
  • SS7 Point Codes can now be resolved into names with a hosts-like file.
  • Wireshark can now go fullscreen to have more room for packets.
  • TShark can now export objects like the other GUI interfaces.
  • Support for G.722 and G.726 codecs in the RTP Player (via the SpanDSP library).
  • You can now choose the output device when playing RTP streams.
  • Added support for dissectors to include a unit name natively in their hf field. A field can now automatically append "seconds" or "ms" to its value without additional printf-style APIs.
  • The Default profile can now be reset to default values.
  • You can move back and forth in the selection history in the Qt UI.
  • IEEE 802.15.4 dissector now uses an UAT for decryption keys. The original decryption key preference has been obsoleted.
  • Extcap utilities can now provide configuration for a GUI interface toolbar to control the extcap utility while capturing.
  • Extcap utilities can now validate the capture filter.
  • Display filter function len() can now be used on all string and byte fields.
  • Added timeline view for 802.11 wireless packet data.

New Protocol Support

(Facebook) Zero, Bluetooth HCI Vendor Intel, CAN FD, DirectPlay 8 protocol, Ericsson A-bis P-GSL, Ericsson A-bis TFP (Traffic Forwarding Protocol), Fc00/cjdns Protocol, Generic Netlink (genl), GSM Osmux, GSMTAP based logging, Health Level 7 (HL7), High-speed SECS message service (HSMS), HomePNA, IndigoCare iCall protocol, IndigoCare Netrix protocol, iPerf2, ISO 15765, Linux 802.11 Netlink (nl80211), Local Service Discovery (LSD), M2 Application Protocol, Mesh Link Establishment (MLE), Netgear Ensemble Protocol, NetScaler HA Protocol, NetScaler Metric Exchange Protocol, NetScaler RPC Protocol, NM protocol, Nordic BLE Sniffer, NVMe, NVMe Fabrics RDMA, OBD-II PIDs, OpenThread simulator, RFTap Protocol, SCTE-35 Digital Program Insertion Messages, Snort Post-dissector, Thread CoAP, Unified Diagnostic Services (UDS), vSocket, Windows Cluster Management API (clusapi), and X-Rite i1 Display Pro (and derivatives) USB protocol

Official releases are available right now from the download page.

Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More