I'm proud to announce the release of Wireshark 4.4.5.
What is Wireshark?
Wireshark is the world’s most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.
Wireshark is hosted by the Wireshark Foundation, a nonprofit which
promotes protocol analysis education. Wireshark and the foundation
depend on your contributions in order to do their work! If you or your
organization would like to contribute or become a sponsor, please
visit wiresharkfoundation.org[1].
What’s New
Bug Fixes
The following bugs have been fixed:
• GRPC: protobuf_json only displays the truncated string value.
Issue 20392[2].
• Wireshark crashes when clicking on a column title/header. Issue
20403[3].
New and Updated Features
New Protocol Support
There are no new protocols in this release.
Updated Protocol Support
GNW, IPv4, NFAPI, and ProtoBuf
New and Updated Capture File Support
There is no new or updated capture file support in this release.
Updated File Format Decoding Support
There is no updated file format support in this release.
Prior Versions
Wireshark 4.4.4 included the following changes. See the release
notes[4] for details:
• wnpa-sec-2025-01[5] Bundle Protocol and CBOR dissector
{crash,infinite loop,memory leak}. Issue 20373[6].
• Crash when sorting columns during capture with display filter
active. Issue 20263[7].
• OSS-Fuzz 384757274: Invalid-bool-value in dissect_tcp. Issue
20300[8].
• Test failure in 4.4.2/4.4.3: test_sharkd_req_follow_http2. Issue
20330[9].
• Regression in extcap interface toolbar. Issue 20354[10].
• Clicking outside columns in TCP tab of Statistics → Conversations
window causes crash. Issue 20357[11].
• FTBFS with Ubuntu development (25.04) release. Issue 20359[12].
• DNS enable_qname_stats crash Wireshark when QDCOUNT == 0. Issue
20367[13].
• Windows: Android extcap plugin fails with "Broken socket
connection" if there are no new packets for 2sec. Issue 20386[14].
• TECMP: Calculation of lifecycle start in Status message is wrong.
Issue 20387[15].
• MQTT v5.0 properties total length presentation is incorrect. Issue
20389[16].
• TShark doesn’t resolve addresses in custom "hosts" files. Issue
20391[17].
• Incorrect JA4 fingerprint with empty ciphers. Issue 20394[18].
Wireshark 4.4.3 included the following changes. See the release
notes[19] for details:
• Potential mis-match in GSM MAP dissector for uncertainty radius
and its filter key. Issue 20247[20].
• Macro eNodeB ID and Extended Macro eNodeB ID not decoded by User
Location Information. Issue 20276[21].
• The NFSv2 Dissector appears to be swapping Character Special File
and Directory in mode decoding. Issue 20290[22].
• CMake discovers Strawberry Perl’s zlib DLL when it shouldn’t.
Issue 20304[23].
• VOIP Calls call flow displaying hours. Issue 20311[24].
• Fuzz job issue: fuzz-2024-12-26-7898.pcap. Issue 20313[25].
• sFlow: Incorrect length passed to header sample dissector. Issue
20320[26].
• wsutil: Should link against -lm due to missing fabs() when built
with -fno-builtin. Issue 20326[27].
Wireshark 4.4.2 included the following changes. See the release
notes[28] for details:
• wnpa-sec-2024-14[29] FiveCo RAP dissector infinite loop. Issue
20176[30].
• wnpa-sec-2024-15[31] ECMP dissector crash. Issue 20214[32].
• CIP I/O is not detected by "enip" filter anymore. Issue 19517[33].
• Fuzz job issue: fuzz-2024-09-03-7550.pcap. Issue 20041[34].
• OSS-Fuzz 71476: wireshark:fuzzshark_ip_proto-udp:
Index-out-of-bounds in DOFObjectID_Create_Unmarshal. Issue
20065[35].
• JA4_c hashes an empty field to e3b0c44298fc when it should be
000000000000. Issue 20066[36].
• Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
Mirroring. Issue 20082[37].
• PTP analysis loses track of message associations in case of
sequence number resets. Issue 20099[38].
• USB CCID: response packet in case SetParameters command is
unsupported is flagged as malformed. Issue 20107[39].
• dumpcap crashes when run from TShark with a capture filter. Issue
20108[40].
• SRT dissector: The StreamID (SID) in the handshake extension is
displayed without regarding the control characters and with NUL as
terminating. Issue 20113[41].
• Ghost error message on POP3 packets. Issue 20124[42].
• Building against c-ares 1.34 fails. Issue 20125[43].
• D-Bus is not optional anymore. Issue 20126[44].
• macOS Intel DMGs aren’t fully notarized. Issue 20129[45].
• Incorrect name for MLD Capabilities and Operations Present flag in
dissection of MLD Capabilities for MLO wifi-7 capture. Issue
20134[46].
• CQL Malformed Packet v4 S → C Type RESULT: Prepared[Malformed
Packet] Issue 20142[47].
• Wi-Fi: 256 Block Ack (BA) is not parsed properly. Issue 20156[48].
• BACnet ReadPropertyMultiple request Maximum allowed recursion
depth reached. Issue 20159[49].
• Statistics→I/O Graph crashes when using simple moving average.
Issue 20163[50].
• HTTP2 body decompression fails on DATA with a single padded frame.
Issue 20167[51].
• Compiler warning for ui/tap-rtp-common.c (ignoring return value)
Issue 20169[52].
• SIP dissector bug due to "be-route" param in VIA header. Issue
20173[53].
• Coredump after trying to open 'Follow TCP stream' Issue 20174[54].
• Protobuf JSON mapping error. Issue 20182[55].
• Display filter "!stp.pvst.origvlan in { vlan.id }" causes a crash
(Version 4.4.1) Issue 20183[56].
• Extcap plugins shipped with Wireshark Portable are not found in
version 4.4.1. Issue 20184[57].
• IEEE 802.11be: Wrong regulatory info in HE Operation IE in Beacon
frame. Issue 20187[58].
• Wireshark 4.4.1 does not decode RTCP packets. Issue 20188[59].
• Qt: Display filter sub-menu can only be opened on the triangle,
not the full name. Issue 20190[60].
• Qt: Changing the display filter does not update the Conversations
or Endpoints dialogs. Issue 20191[61].
• MODBUS Dissector bug. Issue 20192[62].
• Modbus dissector bug - Field Occurence and Layer Operator
modbus.bitval field. Issue 20193[63].
• Wireshark crashes when a field is dragged from packet details
towards the find input. Issue 20204[64].
• Lua DissectorTable("") : set ("10,11") unexpected behavior in
locales with comma as decimal separator. Issue 20216[65].
The TCP dissector no longer falls back to using the client port as a
criterion for selecting a payload dissector when the server port does
not select a payload dissector (except for port 20, active FTP). This
behavior can be changed using the "Client port dissectors" preference.
Display filters now correctly handle floating point conversion errors.
The Lua API now has better support for comma-separated ranges in
different locales.
Wireshark 4.4.1 included the following changes. See the release
notes[66] for details:
• wnpa-sec-2024-12[67] ITS dissector crash. Issue 20026[68].
• wnpa-sec-2024-13[69] AppleTalk and RELOAD Framing dissector
crashes. Issue 20114[70].
• Refresh interface during live-capture leads to corrupt interface
handling. Issue 11176[71].
• Media type "application/octet-stream" registered for both Thread
and UASIP. Issue 14729[72].
• Extcap toolbar stops working when new interface is added. Issue
19854[73].
• Decoding error ITS CPM version 2.1.1. Issue 19886[74].
• Build error in 4.3.0: sync_pipe_run_command_actual error: argument
2 is null but the corresponding size argument 3 value is 512004
[-Werror=nonnull] Issue 19930[75].
• html2text.py doesn’t handle the `<sup>` tag. Issue 20020[76].
• Incorrect NetFlow v8 TOS AS aggregation dissection. Issue
20021[77].
• The Windows packages don’t ship with the IP address plugin. Issue
20030[78].
• O_PATH is Linux-and-FreeBSD-specific. Issue 20031[79].
• Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the
correct directory. Issue 20040[80].
• OER dissector is not considering the preamble if ASN.1 SEQUENCE
definition includes extension marker but no OPTIONAL items. Issue
20044[81].
• Bluetooth classic L2CAP incorrect dissection with connectionless
reception channel. Issue 20047[82].
• Profile auto switch filters : Grayed Display Filter Expression
dialog box when opened from Configuration Profiles dialog box.
Issue 20049[83].
• Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue
20051[84].
• TECMP Data Type passes too much data to sub dissectors. Issue
20052[85].
• Wireshark and tshark 4.4.0 ignore extcap options specified on the
command line. Issue 20054[86].
• Cannot open release notes due to incorrect path with duplicated
directory components. Issue 20055[87].
• Unable to open "Release Notes" from the "Help" menu. Issue
20056[88].
• No capture interfaces if Wireshark is started from command line
with certain paths. Issue 20057[89].
• Wireshark 4.4.0 extcap path change breaks third party extcap
installers. Issue 20069[90].
• Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue
20071[91].
• Unable to create larger files than 99 size units. Issue 20079[92].
• Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
Mirroring. Issue 20082[93].
• PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0 (was
working in 4.2.7) Issue 20088[94].
• GUI lags because NetworkManager keeps turning 802.11 monitor mode
off. Issue 20090[95].
• Error while getting Bluetooth application process id by <shell:ps
-A | grep com.*android.bluetooth> Issue 20100[96].
• Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue 20110[97].
Wireshark 4.4.0 included the following changes. See the release
notes[98] for details:
Many improvements and fixes to the graphing dialogs, including I/O
Graphs, Flow Graph / VoIP Calls, and TCP Stream Graphs.
Wireshark now supports automatic profile switching. You can associate
a display filter with a configuration profile, and when you open a
capture file that matches the filter, Wireshark will automatically
switch to that profile.
Support for Lua 5.3 and 5.4 has been added, and support for Lua 5.1
and 5.2 has been removed. The Windows and macOS installers now ship
with Lua 5.4.6.
Improved display filter support for value strings (optional string
representations for numeric fields).
Display filter functions can be implemented as plugins, similar to
protocol dissectors and file parsers.
Display filters can be translated to pcap filters using "Edit › Copy ›
Display filter as pcap filter" if each display filter field has a
corresponding pcap filter equivalent.
Custom columns can be defined using any valid field expression, such
as display filter functions, packet slices, arithmetic calculations,
logical tests, raw byte addressing, and protocol layer modifiers.
Custom output fields for `tshark -e` can also be defined using any
valid field expression.
Wireshark can be built with the zlib-ng instead of zlib for compressed
file support. Zlib-ng is substantially faster than zlib. The official
Windows and macOS packages include this feature.
Getting Wireshark
Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.
Vendor-supplied Packages
Most Linux and Unix vendors supply their own Wireshark packages. You
can usually install or upgrade Wireshark using the package management
system specific to that platform. A list of third-party packages can
be found on the download page[99] on the Wireshark web site.
File Locations
Wireshark and TShark look in several different locations for
preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These
locations vary from platform to platform. You can use "Help › About
Wireshark › Folders" or `tshark -G folders` to find the default
locations on your system.
Getting Help
The User’s Guide, manual pages and various other documentation can be
found at https://www.wireshark.org/docs/
Community support is available on Wireshark’s Q&A site[100] and on the
wireshark-users mailing list. Subscription information and archives
for all of Wireshark’s mailing lists can be found on the mailing list
site[101].
Bugs and feature requests can be reported on the issue tracker[102].
You can learn protocol analysis and meet Wireshark’s developers at
SharkFest[103].
How You Can Help
The Wireshark Foundation helps as many people as possible understand
their networks as much as possible. You can find out more and donate
at wiresharkfoundation.org[104].
Frequently Asked Questions
A complete FAQ is available on the Wireshark web site[105].
References
1. https://wiresharkfoundation.org
2. https://gitlab.com/wireshark/wireshark/-/issues/20392
3. https://gitlab.com/wireshark/wireshark/-/issues/20403
4. https://www.wireshark.org/docs/relnotes/wireshark-4.4.4.html
5. https://www.wireshark.org/security/wnpa-sec-2025-01
6. https://gitlab.com/wireshark/wireshark/-/issues/20373
7. https://gitlab.com/wireshark/wireshark/-/issues/20263
8. https://gitlab.com/wireshark/wireshark/-/issues/20300
9. https://gitlab.com/wireshark/wireshark/-/issues/20330
10. https://gitlab.com/wireshark/wireshark/-/issues/20354
11. https://gitlab.com/wireshark/wireshark/-/issues/20357
12. https://gitlab.com/wireshark/wireshark/-/issues/20359
13. https://gitlab.com/wireshark/wireshark/-/issues/20367
14. https://gitlab.com/wireshark/wireshark/-/issues/20386
15. https://gitlab.com/wireshark/wireshark/-/issues/20387
16. https://gitlab.com/wireshark/wireshark/-/issues/20389
17. https://gitlab.com/wireshark/wireshark/-/issues/20391
18. https://gitlab.com/wireshark/wireshark/-/issues/20394
19. https://www.wireshark.org/docs/relnotes/wireshark-4.4.3.html
20. https://gitlab.com/wireshark/wireshark/-/issues/20247
21. https://gitlab.com/wireshark/wireshark/-/issues/20276
22. https://gitlab.com/wireshark/wireshark/-/issues/20290
23. https://gitlab.com/wireshark/wireshark/-/issues/20304
24. https://gitlab.com/wireshark/wireshark/-/issues/20311
25. https://gitlab.com/wireshark/wireshark/-/issues/20313
26. https://gitlab.com/wireshark/wireshark/-/issues/20320
27. https://gitlab.com/wireshark/wireshark/-/issues/20326
28. https://www.wireshark.org/docs/relnotes/wireshark-4.4.2.html
29. https://www.wireshark.org/security/wnpa-sec-2024-14
30. https://gitlab.com/wireshark/wireshark/-/issues/20176
31. https://www.wireshark.org/security/wnpa-sec-2024-15
32. https://gitlab.com/wireshark/wireshark/-/issues/20214
33. https://gitlab.com/wireshark/wireshark/-/issues/19517
34. https://gitlab.com/wireshark/wireshark/-/issues/20041
35. https://gitlab.com/wireshark/wireshark/-/issues/20065
36. https://gitlab.com/wireshark/wireshark/-/issues/20066
37. https://gitlab.com/wireshark/wireshark/-/issues/20082
38. https://gitlab.com/wireshark/wireshark/-/issues/20099
39. https://gitlab.com/wireshark/wireshark/-/issues/20107
40. https://gitlab.com/wireshark/wireshark/-/issues/20108
41. https://gitlab.com/wireshark/wireshark/-/issues/20113
42. https://gitlab.com/wireshark/wireshark/-/issues/20124
43. https://gitlab.com/wireshark/wireshark/-/issues/20125
44. https://gitlab.com/wireshark/wireshark/-/issues/20126
45. https://gitlab.com/wireshark/wireshark/-/issues/20129
46. https://gitlab.com/wireshark/wireshark/-/issues/20134
47. https://gitlab.com/wireshark/wireshark/-/issues/20142
48. https://gitlab.com/wireshark/wireshark/-/issues/20156
49. https://gitlab.com/wireshark/wireshark/-/issues/20159
50. https://gitlab.com/wireshark/wireshark/-/issues/20163
51. https://gitlab.com/wireshark/wireshark/-/issues/20167
52. https://gitlab.com/wireshark/wireshark/-/issues/20169
53. https://gitlab.com/wireshark/wireshark/-/issues/20173
54. https://gitlab.com/wireshark/wireshark/-/issues/20174
55. https://gitlab.com/wireshark/wireshark/-/issues/20182
56. https://gitlab.com/wireshark/wireshark/-/issues/20183
57. https://gitlab.com/wireshark/wireshark/-/issues/20184
58. https://gitlab.com/wireshark/wireshark/-/issues/20187
59. https://gitlab.com/wireshark/wireshark/-/issues/20188
60. https://gitlab.com/wireshark/wireshark/-/issues/20190
61. https://gitlab.com/wireshark/wireshark/-/issues/20191
62. https://gitlab.com/wireshark/wireshark/-/issues/20192
63. https://gitlab.com/wireshark/wireshark/-/issues/20193
64. https://gitlab.com/wireshark/wireshark/-/issues/20204
65. https://gitlab.com/wireshark/wireshark/-/issues/20216
66. https://www.wireshark.org/docs/relnotes/wireshark-4.4.1.html
67. https://www.wireshark.org/security/wnpa-sec-2024-12
68. https://gitlab.com/wireshark/wireshark/-/issues/20026
69. https://www.wireshark.org/security/wnpa-sec-2024-13
70. https://gitlab.com/wireshark/wireshark/-/issues/20114
71. https://gitlab.com/wireshark/wireshark/-/issues/11176
72. https://gitlab.com/wireshark/wireshark/-/issues/14729
73. https://gitlab.com/wireshark/wireshark/-/issues/19854
74. https://gitlab.com/wireshark/wireshark/-/issues/19886
75. https://gitlab.com/wireshark/wireshark/-/issues/19930
76. https://gitlab.com/wireshark/wireshark/-/issues/20020
77. https://gitlab.com/wireshark/wireshark/-/issues/20021
78. https://gitlab.com/wireshark/wireshark/-/issues/20030
79. https://gitlab.com/wireshark/wireshark/-/issues/20031
80. https://gitlab.com/wireshark/wireshark/-/issues/20040
81. https://gitlab.com/wireshark/wireshark/-/issues/20044
82. https://gitlab.com/wireshark/wireshark/-/issues/20047
83. https://gitlab.com/wireshark/wireshark/-/issues/20049
84. https://gitlab.com/wireshark/wireshark/-/issues/20051
85. https://gitlab.com/wireshark/wireshark/-/issues/20052
86. https://gitlab.com/wireshark/wireshark/-/issues/20054
87. https://gitlab.com/wireshark/wireshark/-/issues/20055
88. https://gitlab.com/wireshark/wireshark/-/issues/20056
89. https://gitlab.com/wireshark/wireshark/-/issues/20057
90. https://gitlab.com/wireshark/wireshark/-/issues/20069
91. https://gitlab.com/wireshark/wireshark/-/issues/20071
92. https://gitlab.com/wireshark/wireshark/-/issues/20079
93. https://gitlab.com/wireshark/wireshark/-/issues/20082
94. https://gitlab.com/wireshark/wireshark/-/issues/20088
95. https://gitlab.com/wireshark/wireshark/-/issues/20090
96. https://gitlab.com/wireshark/wireshark/-/issues/20100
97. https://gitlab.com/wireshark/wireshark/-/issues/20110
98. https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html
99. https://www.wireshark.org/download.html
100. https://ask.wireshark.org/
101. https://lists.wireshark.org/lists/
102. https://gitlab.com/wireshark/wireshark/-/issues
103. https://sharkfest.wireshark.org
104. https://wiresharkfoundation.org
105. https://www.wireshark.org/faq.html
Digests
wireshark-4.4.5.tar.xz: 46776736 bytes
SHA256(wireshark-4.4.5.tar.xz)=02346f7de3d50678c200189a2ecbf4747fd83fbfc5850cadfd428fd9b1544428
SHA1(wireshark-4.4.5.tar.xz)=39f9faf6e4d982d6d5fce5614f0d46dddd81e66f
Wireshark-4.4.5-arm64.exe: 68772760 bytes
SHA256(Wireshark-4.4.5-arm64.exe)=3757a95f945239e927fcc8226e3f7b12ecbe1a3bae4905a152c3f6d4f9e856a4
SHA1(Wireshark-4.4.5-arm64.exe)=3125c0ecd97e1a90de5ce259f5bac28475d104f6
Wireshark-4.4.5-x64.exe: 87299296 bytes
SHA256(Wireshark-4.4.5-x64.exe)=2dfdd1116d1f2c5a916a223b3e421f43fd15a6d2fdb7e2be23ce280d2062e19f
SHA1(Wireshark-4.4.5-x64.exe)=ac0063f772a126c2d8d46e2342b465281580311c
Wireshark-4.4.5-x64.msi: 63877120 bytes
SHA256(Wireshark-4.4.5-x64.msi)=f9e69893e72bd99495f7311df11265df64fb13e2536755915acc0f0130958503
SHA1(Wireshark-4.4.5-x64.msi)=ac5387de693486e23effdb72cf4a2efd4b82154d
WiresharkPortable64_4.4.5.paf.exe: 64456952 bytes
SHA256(WiresharkPortable64_4.4.5.paf.exe)=9ddf1720d31707daa4f57fa61f43861602bd0f11f1298dcf56ea3cfc96f07a31
SHA1(WiresharkPortable64_4.4.5.paf.exe)=4170d03763860d812c087a117de87ae90ac945ab
Wireshark 4.4.5 Arm 64.dmg: 65450117 bytes
SHA256(Wireshark 4.4.5 Arm
64.dmg)=2250360b04aa04412c6f0339fb6e93069a6acfd02cb7474708bf655f927f7976
SHA1(Wireshark 4.4.5 Arm 64.dmg)=faac05f5e1422a12ad4d90af194be9e2548ef1a5
Wireshark 4.4.5 Intel 64.dmg: 69176974 bytes
SHA256(Wireshark 4.4.5 Intel
64.dmg)=af2eb698e9bea714436822a1d0f6257c3960a0b1c2f61dc8f8dfffa830657060
SHA1(Wireshark 4.4.5 Intel 64.dmg)=5b6560efbb356d7cec812e5c8d10ce1e9d198864
You can validate these hashes using the following commands (among others):
Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256
Linux (GNU Coreutils): sha256sum wireshark-x.y.z.tar.xz
macOS: shasum -a 256 "Wireshark x.y.z Arm 64.dmg"
Other: openssl sha256 wireshark-x.y.z.tar.xz
_______________________________________________
Wireshark-dev mailing list -- wireshark-dev@wireshark.org
To unsubscribe send an email to wireshark-dev-le...@wireshark.org
