Wireshark (64-bit) 歷史版本列表
更新時間：2011-07-19
更新細節：
What's new in this version:
# The following bugs have been fixed:
* TCP dissector doesn't decode TCP segments of length 1.
* wireshark 1.4.0rc1 and python - spurious message.
* Missing LUA function.
* Lua API description about creating a new Tvb from a bytearray is not correct in wireshark's user guide.
* Character echo pauses in Capture Filter field in Capture Options.
* White space in protocol field abbreviation causes runtime failure while registering Lua dissector.
* "File not found" box uses wrong filename encoding.
* capinfos: #ifdef HAVE_LIBGCRYPT block includes a line too many .
* Wireshark crashes if Lua contains "Pref.range()" with missing arguments.
* The "range" field in Lua's "Pref.range()" serves as default while the "default" field does nothing .
* Wireshark crashes when calling TreeItem:set_len() on TreeItem without tvb.
* TvbRange_string(lua_State* L) call a wrong function.
* VoIP call flow graph displays BICC APM as a BICC ANM.
* Cannot Live-capture VirtualBox network packets with Wireshark; pipe problem.
* Interface list in Capture Options isn't cleared when selecting other host.
* H323 rate multiplier wrong.
* Inclusion of config.h is too late in lex-files resulting in wrong definition of _FILE_OFFSET_BITS.
* tshark crashes when loading Lua script that contains GUI function.
* 802.11 Disassociation Packet's "Reason Code" field is imprecisely decoded/described.
* Wireshark crashes when setting custom column's field name with conditional.
* Crash after applying "expert.severity" field as column.
* GTS Descriptor count limited to 3 instead of 7.
* The SSL dissector can not resemble correctly the frames after TCP zero window probe packet.
* Packet parser takes too long for this trace.
* The SSL dissector can not resemble correctly the frames after TCP zero window probe packet.
* Wireshark crashes after repeating "File -> Import -> Cancel".
* Decoding of MQ ASCII and EBCDIC Traffic Flow - ASCII shows fine, EBCDIC does not.
* 802.11 Association Response Packet's "Status Code" field is imprecisely decoded/described.
* Abis interface not correctly handled in gsmtap dissector.
* Wrong decoding of RLC/MAC EGPRS Packet Downlink Ack/Nack (3GPP TS 44.060).
* CSN Ack/Nack Description wrongly handled in gsm_rlcmac_dl dissector (3GPP TS 44.060).
* wireshark 1.6.0 and python support: installer fails to create the wspy_dissectors subdirectory and .
* Wireshark crash during RTP stream analysis.
* Tshark custom columns: Why don't I get an error message?
# New and Updated Capture File Support
* Network Monitor.
更新時間：2011-06-08
更新細節：
What's new in this version:
- Wireshark is unresponsive when capturing from named pipes on Windows.
- Crash when sorting column while capturing.
- Ring buffers are no longer turned on by default when using multiple capture files.
New and Updated Features:
- Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets.
- Large file (greater than 2 GB) support has been improved.
- Wireshark and TShark can import text dumps, similar to text2pcap.
- You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window.
- Wireshark can export SSL session keys via File?Export?SSL Session Keys...
- TShark can show a specific occurrence of a field when using '-T fields'.
- Custom columns can show a specific occurrence of a field.
- You can hide columns in the packet list.
- Wireshark can now export SMB objects.
- dftest and randpkt now have manual pages.
- TShark can now display iSCSI, ICMP and ICMPv6 service response times.
- Dumpcap can now save files with a user-specified group id.
- Syntax checking is done for capture filters.
- You can display the compiled BPF code for capture filters in the Capture Options dialog.
- You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. .
- Packet length is (finally) a default column.
- TCP window size is now avaiable both scaled and unscaled. A TCP window scaling graph is available in the GUI.
- 802.1q VLAN tags are now shown in the Ethernet II protocol tree instead of a separate tree.
- Various dissectors now display some UTF-16 strings as proper Unicode including the DCE/RPC and SMB dissectors.
- The RTP player now has an option to show the time of day in the graph in addition to the seconds since beginning of capture.
- The RTP player now shows why media interruptions occur.
- Graphs now save as PNG images by default.
- TShark can read and write host name information from and to pcapng-formatted files. Wireshark can read it. TShark can dump host name information via [-z hosts].
- TShark's -z option now uses the [-z <proto>,srt] syntax instead of [-z <proto>,rtt] for all protocols that support service response time statistics. This matches Wireshark's syntax for this option.
- Wireshark and TShark can now read compressed Windows Sniffer files.
New Protocol Support:
- ADwin, ADwin-Config, Apache Etch, Aruba PAPI, Babel Routing Protocol, Broadcast/Multicast Control, Constrained Application Protocol (COAP), Digium TDMoE, Erlang Distribution Protocol, Ether-S-I/O, FastCGI, Fibre Channel over InfiniBand (FCoIB), Gopher, Gigamon GMHDR, IDMP, Infiniband Socket Direct Protocol (SDP), JSON, LISP Control, LISP Data, LISP, MikroTik MAC-Telnet, MRP Multiple Mac Registration Protocol (MMRP) Mongo Wire Protocol, MUX27010, Network Monitor 802.11 radio header, OPC UA ExtensionObjects, openSAFETY, PPI-GEOLOCATION-GPS, ReLOAD, ReLOAD Framing, RObust Header Compression (ROHC), RSIP, SAMETIME, SCoP, SGSAP, Tektronix Teklink, USB/AT Commands, uTorrent Transport Protocol, WAI authentication, Wi-Fi P2P (Wi-Fi Direct)
New and Updated Capture File Support:
- Apple PacketLogger, Catapult DCT2000, Daintree SNA, Endace ERF, HP OpenVMS TCPTrace, IPFIX (the file format, not the protocol), Lucent/Ascend debug, Microsoft Network Monitor, Network Instruments, TamoSoft CommView
更新時間：2011-06-01
更新細節：
What's new in this version:
The following bugs have been fixed:
- AIM dissector has some endian issues.
- Telephony?MTP3?MSUS doesn't display window.
- Support for MS NetMon 3.x traces containing raw IPv6 ("Type 7") packets.
- Service Indicator in M3UA protocol data.
- IEC60870-5-104 protocol, incorrect decoding of timestamp type CP56Time2a.
- DNP3 dissector incorrect constants AL_OBJ_FCTR_16NF _FDCTR_32NF _FDCTR_16NF.
- 3GPP QoS: Traffic class is not decoded properly.
- Wireshark crashes when creating ProtoField.framenum in Lua.
- Fix a wrong mask to extract FMID from DECT packets dissector.
- Incorrect DHCPv6 remote identifier option parsing.
Updated Protocol Support
- DICOM, IEC104, M3UA, TCP
New and Updated Capture File Support
- Network Monitor.
更新時間：2011-04-19
更新細節：
What's new in this version:
The following bugs have been fixed:
- Wireshark and TShark can crash while analyzing TCP packets.
Updated Protocol Support
- TCP
更新時間：2011-04-16
更新細節：
What's new in this version:
The following bugs have been fixed:
- Cygwin make fails after updating to bash v 4.1.9.2
- Export HTTP > All - System Appears Hung (but isn't).
- Some HTTP responses don't decode with TCP reassembly on.
- Wireshark crashes when cancelling a large sort operation.
- Wireshark crashes if SSL preferences RSA key is actually a DSA key.
- tshark incorrectly calculates TCP stream for some syn packets.
- Wireshark not able to decode the PPP frame in a sflow (RFC3176) flow sample packet because Wireshark incorrectly read the protocol in PPP frame header.
- Mysql protocol dissector: all fields should be little endian.
- Error when opening snoop from Juniper SSG-140.
- svnversion: command not found.
- capinfos: #ifdef HAVE_LIBGCRYPT block includes a line too many.
- Value of TCP segment data cannot be copied. (Bug 5811)
- proto_field_is_referenced() is not exported in libwireshark.dll.
- Wireshark ver. 1.4.4 not displayed "Granted QoS" field in a A11 packet.
Updated Protocol Support
- HTTP, LDAP, MySQL, NFS, sFlow, SSL, TCP
更新時間：2011-03-02
更新細節：
What's new in this version:
The following bugs have been fixed:
* A TCP stream would not always be recognized as the same stream. (Bug 2907)
* Wireshark Crashing by pressing 2 Buttons. (Bug 4645)
* A crash can occur in the NTLMSSP dissector. (Bug 5157)
* The column texts from a Lua dissector could be mangled. (Bug 5326) (Bug 5630)
* Corrections to ANSI MAP ASN.1 specifications. (Bug 5584)
* When searching in packet bytes, the field and bytes are not immediately shown. (Bug 5585)
* Malformed Packet: ULP reported when dissecting ULP SessionID PDU. (Bug 5593)
* Wrong IEI in container of decode_gtp_mm_cntxt. (Bug 5598)
* Display filter does not work for expressions of type BASE_DEC, BASE_DEC_HEX and BASE_HEX_DEC. (Bug 5606)
* NTLMSSP dissector may fail to compile due to space embedded in C comment delimiters. (Bug 5614)
* Allow for name resolution of link-scope and multicast IPv6 addresses from local host file. (Bug 5615)
* DHCPv6 dissector formats DUID_LLT time incorrectly. (Bug 5627)
* Allow for IEEE 802.3bc-2009 style PoE TLVs. (Bug 5639)
* Various fixes to the HIP packet dissector. (Bug 5646)
* Display "Day of Year" for January 1 as 1, not 0. (Bug 5653)
* Accommodate the CMake build on Ubuntu 10.10. (Bug 5665)
* E.212 MCC 260 Poland update according to local national regulatory. (Bug 5668)
* IPP on ports other than 631 not recognized. (Bug 5677)
* Potential access violation when writing to LANalyzer files. (Bug 5698)
* IEEE 802.15.4 Superframe Specification - Final CAP Slot always 0. (Bug 5700)
* Peer SRC and DST AS numbers are swapped for cflow. (Bug 5702)
* dumpcap: -q option behavior doesn't match documentation. (Bug 5716)
* Updated Protocol Support
- ANSI MAP, BitTorrent, DCM, DHCPv6, DTAP, DTPT, E.212, GSM Management, GTP, HIP, IEEE 802.15.4, IPP, LDAP, LLDP, Netflow, NTLMSSP, P_Mul, Quake, Skinny, SMB, SNMP, ULP
* New and Updated Capture File Support
- LANalyzer, Nokia DCT3, Pcap-ng
更新時間：2011-01-12
更新細節：
What's new in this version:
# The following bugs have been fixed:
* AMQP failed assertion. (Bug 4048)
* Reassemble.c leaks memory for GLIB > 2.8. (Bug 4141)
* Fuzz testing reports possible dissector bug: TCP. (Bug 4211)
* Wrong length calculation in new_octet_aligned_subset_bits() (PER dissector). (Bug 5393)
* Function dissect_per_bit_string_display might read more bytes than available (PER dissector). (Bug 5394)
* Cannot load wpcap.dll & packet.dll from Wireshark program directory. (Bug 5420)
* Wireshark crashes with Copy -> Description on date/time fields. (Bug 5421)
* DHCPv6 OPTION_CLIENT_FQDN parse error. (Bug 5426)
* Information element Error for supported channels. (Bug 5430)
* Assert when using ASN.1 dissector with loading a 'type table'. (Bug 5447)
* Bug with RWH parsing in Infiniband dissector. (Bug 5444)
* Help->About Wireshark mis-reports OS. (Bug 5453)
* Delegated-IPv6-Prefix(123) is shown incorrect as X-Ascend-Call-Attempt-Limit(123). (Bug 5455)
* tshark -r file -T fields is truncating exported data. (Bug 5463)
* gsm_a_dtap: incorrect Extraneous Data when decoding Packet Flow Identifier. (Bug 5475)
* Improper decode of TLS 1.2 packet containing both CertificateRequest and ServerHelloDone messages. (Bug 5485)
* LTE-PDCP UL and DL problem. (Bug 5505)
* CIGI 3.2/3.3 support broken. (Bug 5510)
* Prepare Filter in RTP Streams dialog does not work correctly. (Bug 5513)
* Wrong decode at ethernet OAM Y.1731 ETH-CC. (Bug 5517)
* WPS: RF bands decryption. (Bug 5523)
* Incorrect LTP SDNV value handling. (Bug 5521)
* LTP bug found by randpkt. (Bug 5323)
* Buffer overflow in SNMP EngineID preferences. (Bug 5530)
# Updated Protocol Support
* AMQP, ASN.1 BER, ASN.1 PER, CFM, CIGI, DHCPv6, Diameter, ENTTEC, GSM A GM, IEEE 802.11, InfiniBand, LTE-PDCP, LTP, MAC-LTE, MP2T, RADIUS, SAMR, SCCP, SIP, SNMP, TCP, TLS, TN3270, UNISTIM, WPS
# New and Updated Capture File Support
* Endace ERF, Microsoft Network Monitor, VMS TCPtrace.
更新時間：2010-11-21
更新細節：
What's new in this version:
* The following bugs have been fixed:
- File-Open Display Filter is overwritten by Save-As Filename. (Bug 3894)
- Wireshark crashes with Gtk-ERROR **: Byte index 6 is off the end of the line if click on last PDU. (Bug 5285)
- GTK-ERROR can occur in packets when there are multiple Netbios/SMB headers in a single frame. (Bug 5289)
- Tshark -G values crashes on Windows. (Bug 5296)
- PROFINET I&M0FilterData packet not fully decoded. (Bug 5299)
- PROFINET MRP linkup/linkdown decoding incorrect. (Bug 5300)
- [lua] Dumper:close() will cause a segfault due later GC of the Dumper. (Bug 5320)
- Network Instruments' trace files sometimes cannot be read with an error message of Observer: bad record: Invalid magic number. (Bug 5330)
- IO Graph Time of Day times incorrect for filtered data. (Bug 5340)
- Wireshark tools do not detect and read some ERF files correctly. (Bug 5344)
- editcap -h sends some lines to stderr and others to stdout. (Bug 5353)
- IP Timestamp Option: flag=3 variant (prespecified) not displayed correctly. (Bug 5357)
- AgentX PDU Header 'hex field highlighting' incorrectly spans extra bytes. (Bug 5364)
- AgentX dissector cannot handle null OID in Open-PDU. (Bug 5368)
- Crash with Gtk-ERROR **: Byte index 6 is off the end of the line. (Bug 5374)
- ANCP Portmanagment TLV wrong decoded. (Bug 5388)
- Crash during startup because of Python SyntaxError in wspy_libws.py. (Bug 5389)
更新時間：2010-10-12
更新細節：
What's new in this version:
# The following bugs have been fixed:
* Wireshark may appear offscreen on multi-monitor Windows systems. (Bug 553)
* Incorrect behavior using sorting in the packet list. (Bug 2225)
* Cooked-capture dissector should omit the source address field if empty. (Bug 2519)
* MySQL dissector doesn't dissect MySQL stream. (Bug 2691)
* Wireshark crashes if active display filter macro is renamed. (Bug 5002)
* Incorrect dissection of MAP V2 PRN_ACK. (Bug 5076)
* TCP bytes_in_flight becomes inflated with lost packets. (Bug 5132)
* Wireshark fails to start on Windows XP 64bit. (Bug 5160)
* GTP header is exported in PDML with an incorrect size. (Bug 5162)
* Packet list hidden columns will not be parsed correctly from preferences file. (Bug 5163)
* Wireshark does not display the t.38 graph. (Bug 5165)
* Wireshark don't show mgcp calls in Telephony ? VoIP calls. (Bug 5167)
* Wireshark 1.4.0 & VoIP calls Prepare Filter problem. (Bug 5172)
* GTPv2: IMSI is decoded improperly. (Bug 5179)
* [NAS EPS] EPS Quality of Service IE decoding is wrong. (Bug 5186)
* Wireshark mistakenly writes not all data available for IPv4 checksum. (Bug 5194)
* GSM: Cell Channel Description, range 1024 format. (Bug 5214)
* Wrong SDP interpretation on VoIP call flow chart. (Bug 5220)
* The CLDAP attribute value on a CLDAP reply is no longer being decoded. (Bug 5239)
* [NAS EPS] Traffic Flow Template IE dissection bugs. (Bug 5243)
* [NAS EPS] Use Request Type IE defined in 3GPP 24.008. (Bug 5246)
* NTLMSSP_AUTH domain and username truncated to first letter with IE8/Windows7 (generating the NTLM packet). (Bug 5251)
* IPv6 RH0: dest addr is to be used i.s.o. last RH address when 0 segments remain. (Bug 5252)
* EIGRP dissection error in Flags field in external route TLVs. (Bug 5261)
* MRP packet is not correctly parsed in PROFINET multiple write record request. (Bug 5267)
* MySQL Enhancement: support of Show Fields and bug fix. (Bug 5271)
* [NAS EPS] Fix TFT decoding when having several Packet Filters defined. (Bug 5274)
* Crash if using ssl.debug.file with no password for ssl.keys_list. (Bug 5277)
# Updated Protocol Support
* ASN.1 BER, ASN.1 PER, EIGRP, GSM A RR, GSM Management, GSM MAP,GTP, GTPv2, ICMPv6, Interlink, IPv4, IPv6, IPX, LDAP, LLC, MySQL,NAS EPS, NTLMSSP, PN-IO, PPP, RPC, SDP, SLL, SSL, TCP
更新時間：2010-08-31
更新細節：
What's new in this version:
# The following bugs have been fixed:
* Update time display in background. (Bug 1275)
* Wireshark is unresponsive when capturing from named pipes on Windows. (Bug 1759)
* Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735)
# New and Updated Features
* The packet list internals have been rewritten and are now more efficient.
* Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header.
* Preliminary Python scripting support has been added.
* Many memory leaks have been fixed.
* Wireshark 1.4 does not support Windows 2000. Please use Wireshark 1.2 or 1.0 on those systems.
* Packets can now be ignored (excluded from dissection), similar to the way they can be marked.
* Manual IP address resolution is now supported.
* Columns with seconds can now be displayed as hours, minutes and seconds.
* You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater.
* TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now.
* Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater.
* You can play RTP streams directly from the RTP Analysis window.
* Capinfos and editcap now respectively support time order checking and forcing.
* Wireshark now has a "jump to timestamp" command-line option.
* You can open JPEG files directly in Wireshark.
# New Protocol Support
* 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library
# New and Updated Capture File Support
* Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks