[Wireshark announcements <wireshark-announce@xxxxxxxxxxxxx>]

I'm proud to announce the release of Wireshark 4.4.1.


 What is Wireshark?

  Wireshark is the world’s most popular network protocol analyzer. It is
  used for troubleshooting, analysis, development and education.

  Wireshark is hosted by the Wireshark Foundation, a nonprofit which
  promotes protocol analysis education. Wireshark and the foundation
  depend on your contributions in order to do their work. If you or your
  organization would like to contribute or become a sponsor, please
  visit wiresharkfoundation.org[1].

 What’s New

  Bug Fixes

   The following vulnerabilities have been fixed:

     • wnpa-sec-2024-12[2] ITS dissector crash. Issue 20026[3].

     • wnpa-sec-2024-13[4] AppleTalk and RELOAD Framing dissector
       crashes. Issue 20114[5].

   The following bugs have been fixed:

     • Refresh interface during live-capture leads to corrupt interface
       handling. Issue 11176[6].

     • Media type "application/octet-stream" registered for both Thread
       and UASIP. Issue 14729[7].

     • Extcap toolbar stops working when new interface is added. Issue
       19854[8].

     • Decoding error ITS CPM version 2.1.1. Issue 19886[9].

     • Build error in 4.3.0: sync_pipe_run_command_actual error:
       argument 2 is null but the corresponding size argument 3 value is
       512004 [-Werror=nonnull] Issue 19930[10].

     • html2text.py doesn’t handle the `<sup>` tag. Issue 20020[11].

     • Incorrect NetFlow v8 TOS AS aggregation dissection. Issue
       20021[12].

     • The Windows packages don’t ship with the IP address plugin. Issue
       20030[13].

     • O_PATH is Linux-and-FreeBSD-specific. Issue 20031[14].

     • Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the
       correct directory. Issue 20040[15].

     • OER dissector is not considering the preamble if ASN.1 SEQUENCE
       definition includes extension marker but no OPTIONAL items. Issue
       20044[16].

     • Bluetooth classic L2CAP incorrect dissection with connectionless
       reception channel. Issue 20047[17].

     • Profile auto switch filters : Grayed Display Filter Expression
       dialog box when opened from Configuration Profiles dialog box.
       Issue 20049[18].

     • TECMP Data Type passes too much data to sub dissectors. Issue
       20052[19].

     • Wireshark and tshark 4.4.0 ignore extcap options specified on the
       command line. Issue 20054[20].

     • Cannot open release notes due to incorrect path with duplicated
       directory components. Issue 20055[21].

     • Unable to open "Release Notes" from the "Help" menu. Issue
       20056[22].

     • No capture interfaces if Wireshark is started from command line
       with certain paths. Issue 20057[23].

     • Wireshark 4.4.0 extcap path change breaks third party extcap
       installers. Issue 20069[24].

     • Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue
       20071[25].

     • Unable to create larger files than 99 size units. Issue
       20079[26].

     • PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0
       (was working in 4.2.7) Issue 20088[27].

     • GUI lags because NetworkManager keeps turning 802.11 monitor mode
       off. Issue 20090[28].

     • Error while getting Bluetooth application process id by <shell:ps
       -A | grep com.*android.bluetooth> Issue 20100[29].

     • Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue
       20110[30].

 Known Bugs

    • Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue
      20051[31].

    • Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
      Mirroring. Issue 20082[32].

  New and Updated Features

     • The TShark syntax for dumping only fields with a certain prefix
       has changed from `-G fields prefix` to `-G fields,prefix`. This
       allows `tshark -G fields` to again support also specifying the
       configuration profile to use.

  New Protocol Support

   There are no new protocols in this release.

  Updated Protocol Support

   AppleTalk, ARTNET, BGP, BT L2CAP, CIGI, CIP Motion, CoAP, COSE,
   DISTCC, DMP, Ethernet OAM PDU, F5 FILEINFO, GIOP, GOOSE, GSM
   Management, GSM SIM, GTP, HTTP, HTTP2, ID3v2, IDN, IEEE 1609.2, IEEE
   802.11, IPPUSB, iRDMA, ISystemActivator, ITS, Kerberos, LwM2M-TLV,
   MMS, MQ, MySQL, NCP SSS, NetFlow, OER, OWAMP, QNET, RELOAD Framing,
   RTCP, RTLS, SANE, SMB2, SSyncP, Sysdig Event, T.124, TECMP, Thread,
   Thrift, and TWAMP

  New and Updated Capture File Support

   BLF, CLLOG, CommView, ERF, and pcap

  Updated File Format Decoding Support

   There is no updated file format support in this release.

 Prior Versions

  This document only describes the changes introduced in Wireshark
  4.4.1. You can find release notes for prior versions at the following
  locations:

  Wireshark 4.4.0 included the following changes. See the release
  notes[33] for details:

  Many improvements and fixes to the graphing dialogs, including I/O
  Graphs, Flow Graph / VoIP Calls, and TCP Stream Graphs.

  Wireshark now supports automatic profile switching. You can associate
  a display filter with a configuration profile, and when you open a
  capture file that matches the filter, Wireshark will automatically
  switch to that profile.

  Support for Lua 5.3 and 5.4 has been added, and support for Lua 5.1
  and 5.2 has been removed. The Windows and macOS installers now ship
  with Lua 5.4.6.

  Improved display filter support for value strings (optional string
  representations for numeric fields).

  Display filter functions can be implemented as plugins, similar to
  protocol dissectors and file parsers.

  Display filters can be translated to pcap filters using "Edit › Copy ›
  Display filter as pcap filter" if each display filter field has a
  corresponding pcap filter equivalent.

  Custom columns can be defined using any valid field expression, such
  as display filter functions, packet slices, arithmetic calculations,
  logical tests, raw byte addressing, and protocol layer modifiers.

  Custom output fields for `tshark -e` can also be defined using any
  valid field expression.

  Wireshark can be built with the zlib-ng instead of zlib for compressed
  file support. Zlib-ng is substantially faster than zlib. The official
  Windows and macOS packages include this feature.

 Getting Wireshark

  Wireshark source code and installation packages are available from
  https://www.wireshark.org/download.html.

  Vendor-supplied Packages

   Most Linux and Unix vendors supply their own Wireshark packages. You
   can usually install or upgrade Wireshark using the package management
   system specific to that platform. A list of third-party packages can
   be found on the download page[34] on the Wireshark web site.

 File Locations

  Wireshark and TShark look in several different locations for
  preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These
  locations vary from platform to platform. You can use "Help › About
  Wireshark › Folders" or `tshark -G folders` to find the default
  locations on your system.

 Getting Help

  The User’s Guide, manual pages and various other documentation can be
  found at https://www.wireshark.org/docs/

  Community support is available on Wireshark’s Q&A site[35] and on the
  wireshark-users mailing list. Subscription information and archives
  for all of Wireshark’s mailing lists can be found on the mailing list
  site[36].

  Bugs and feature requests can be reported on the issue tracker[37].

  You can learn protocol analysis and meet Wireshark’s developers at
  SharkFest[38].

 How You Can Help

  The Wireshark Foundation helps as many people as possible understand
  their networks as much as possible. You can find out more and donate
  at wiresharkfoundation.org[39].

 Frequently Asked Questions

  A complete FAQ is available on the Wireshark web site[40].

 References

   1. https://wiresharkfoundation.org
   2. https://www.wireshark.org/security/wnpa-sec-2024-12
   3. https://gitlab.com/wireshark/wireshark/-/issues/20026
   4. https://www.wireshark.org/security/wnpa-sec-2024-13
   5. https://gitlab.com/wireshark/wireshark/-/issues/20114
   6. https://gitlab.com/wireshark/wireshark/-/issues/11176
   7. https://gitlab.com/wireshark/wireshark/-/issues/14729
   8. https://gitlab.com/wireshark/wireshark/-/issues/19854
   9. https://gitlab.com/wireshark/wireshark/-/issues/19886
  10. https://gitlab.com/wireshark/wireshark/-/issues/19930
  11. https://gitlab.com/wireshark/wireshark/-/issues/20020
  12. https://gitlab.com/wireshark/wireshark/-/issues/20021
  13. https://gitlab.com/wireshark/wireshark/-/issues/20030
  14. https://gitlab.com/wireshark/wireshark/-/issues/20031
  15. https://gitlab.com/wireshark/wireshark/-/issues/20040
  16. https://gitlab.com/wireshark/wireshark/-/issues/20044
  17. https://gitlab.com/wireshark/wireshark/-/issues/20047
  18. https://gitlab.com/wireshark/wireshark/-/issues/20049
  19. https://gitlab.com/wireshark/wireshark/-/issues/20052
  20. https://gitlab.com/wireshark/wireshark/-/issues/20054
  21. https://gitlab.com/wireshark/wireshark/-/issues/20055
  22. https://gitlab.com/wireshark/wireshark/-/issues/20056
  23. https://gitlab.com/wireshark/wireshark/-/issues/20057
  24. https://gitlab.com/wireshark/wireshark/-/issues/20069
  25. https://gitlab.com/wireshark/wireshark/-/issues/20071
  26. https://gitlab.com/wireshark/wireshark/-/issues/20079
  27. https://gitlab.com/wireshark/wireshark/-/issues/20088
  28. https://gitlab.com/wireshark/wireshark/-/issues/20090
  29. https://gitlab.com/wireshark/wireshark/-/issues/20100
  30. https://gitlab.com/wireshark/wireshark/-/issues/20110
  31. https://gitlab.com/wireshark/wireshark/-/issues/20051
  32. https://gitlab.com/wireshark/wireshark/-/issues/20082
  33. https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html
  34. https://www.wireshark.org/download.html
  35. https://ask.wireshark.org/
  36. https://lists.wireshark.org/lists/
  37. https://gitlab.com/wireshark/wireshark/-/issues
  38. https://sharkfest.wireshark.org
  39. https://wiresharkfoundation.org
  40. https://www.wireshark.org/faq.html


Digests

wireshark-4.4.1.tar.xz: 46748700 bytes
SHA256(wireshark-4.4.1.tar.xz)=2b9e96572a7002c3e53b79683cf92f8172217e64c17ecaaf612eb68c2a7556ec
SHA1(wireshark-4.4.1.tar.xz)=18672f1faaf5bdd878a45fc8af9d527fd034152e

Wireshark-4.4.1-x64.exe: 87258896 bytes
SHA256(Wireshark-4.4.1-x64.exe)=456aec8658baee56ff4add4bcfd95ed532219536b568b5e45106a0120921e58d
SHA1(Wireshark-4.4.1-x64.exe)=2ec7a04154538d63dad26e9e527ad55fa50ccf01

Wireshark-4.4.1-arm64.exe: 68740880 bytes
SHA256(Wireshark-4.4.1-arm64.exe)=f6e58d24f6fd9aa6ef158265891afdafb4bdf92faa6e6503edd4da9df20c48e3
SHA1(Wireshark-4.4.1-arm64.exe)=6ab12a224ceb8cc6114cc068d9e1e46b04af6649

Wireshark-4.4.1-x64.msi: 63778816 bytes
SHA256(Wireshark-4.4.1-x64.msi)=4b96f32a423bd9a28e817a231663d647337762819cb6ebc2fb63ec84377c78c6
SHA1(Wireshark-4.4.1-x64.msi)=ab992814ae379cce4c4c11db7c6db9a0014e03a5

WiresharkPortable64_4.4.1.paf.exe: 73417384 bytes
SHA256(WiresharkPortable64_4.4.1.paf.exe)=4ab5316baac1532fd9a6977698f856cb704c1d1606f055b07f5cd8868d1daef2
SHA1(WiresharkPortable64_4.4.1.paf.exe)=2e3d0e066adf0c32eb25e5d846e561534807522b

Wireshark 4.4.1 Arm 64.dmg: 65319719 bytes
SHA256(Wireshark 4.4.1 Arm 64.dmg)=0b401cfc149d20858ef602e90edd98f8bad9795320d0953ed78b9e72f9e88fc8
SHA1(Wireshark 4.4.1 Arm 64.dmg)=eca528f9750eee6d35776101958932461d89c455

Wireshark 4.4.1 Intel 64.dmg: 69042117 bytes
SHA256(Wireshark 4.4.1 Intel 64.dmg)=267dcb2dd19d1ebb483e3cff150ad613b18437089c110754fe2ed74dc6c0e978
SHA1(Wireshark 4.4.1 Intel 64.dmg)=254c35571cbb75415982dccdb198957c58e249a8

You can validate these hashes using the following commands (among others):

    Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256
    Linux (GNU Coreutils): sha256sum wireshark-x.y.z.tar.xz
    macOS: shasum -a 256 "Wireshark x.y.z Arm 64.dmg"
    Other: openssl sha256 wireshark-x.y.z.tar.xz