[Gerald Combs <gerald@xxxxxxxxxxxxx>]

I'm proud to announce the release of Wireshark 4.4.2.


 What is Wireshark?

  Wireshark is the world’s most popular network protocol analyzer. It is
  used for troubleshooting, analysis, development and education.

  Wireshark is hosted by the Wireshark Foundation, a nonprofit which
  promotes protocol analysis education. Wireshark and the foundation
  depend on your contributions in order to do their work. If you or your
  organization would like to contribute or become a sponsor, please
  visit wiresharkfoundation.org[1].

 What’s New

  Bug Fixes

   The following vulnerabilities have been fixed:

     • wnpa-sec-2024-14[2] FiveCo RAP dissector infinite loop. Issue
       20176[3].

     • wnpa-sec-2024-15[4] ECMP dissector crash. Issue 20214[5].

   The following bugs have been fixed:

     • CIP I/O is not detected by "enip" filter anymore. Issue 19517[6].

     • Fuzz job issue: fuzz-2024-09-03-7550.pcap. Issue 20041[7].

     • OSS-Fuzz 71476: wireshark:fuzzshark_ip_proto-udp:
       Index-out-of-bounds in DOFObjectID_Create_Unmarshal. Issue
       20065[8].

     • JA4_c hashes an empty field to e3b0c44298fc when it should be
       000000000000. Issue 20066[9].

     • Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
       Mirroring. Issue 20082[10].

     • PTP analysis loses track of message associations in case of
       sequence number resets. Issue 20099[11].

     • USB CCID: response packet in case SetParameters command is
       unsupported is flagged as malformed. Issue 20107[12].

     • dumpcap crashes when run from TShark with a capture filter. Issue
       20108[13].

     • SRT dissector: The StreamID (SID) in the handshake extension is
       displayed without regarding the control characters and with NUL
       as terminating. Issue 20113[14].

     • Ghost error message on POP3 packets. Issue 20124[15].

     • Building against c-ares 1.34 fails. Issue 20125[16].

     • D-Bus is not optional anymore. Issue 20126[17].

     • macOS Intel DMGs aren’t fully notarized. Issue 20129[18].

     • Incorrect name for MLD Capabilities and Operations Present flag
       in dissection of MLD Capabilities for MLO wifi-7 capture. Issue
       20134[19].

     • CQL Malformed Packet v4 S → C Type RESULT: Prepared[Malformed
       Packet] Issue 20142[20].

     • Wi-Fi: 256 Block Ack (BA) is not parsed properly. Issue
       20156[21].

     • BACnet ReadPropertyMultiple request Maximum allowed recursion
       depth reached. Issue 20159[22].

     • Statistics→I/O Graph crashes when using simple moving average.
       Issue 20163[23].

     • HTTP2 body decompression fails on DATA with a single padded
       frame. Issue 20167[24].

     • Compiler warning for ui/tap-rtp-common.c (ignoring return value)
       Issue 20169[25].

     • SIP dissector bug due to "be-route" param in VIA header. Issue
       20173[26].

     • Coredump after trying to open 'Follow TCP stream' Issue
       20174[27].

     • Protobuf JSON mapping error. Issue 20182[28].

     • Display filter "!stp.pvst.origvlan in { vlan.id }" causes a crash
       (Version 4.4.1) Issue 20183[29].

     • Extcap plugins shipped with Wireshark Portable are not found in
       version 4.4.1. Issue 20184[30].

     • IEEE 802.11be: Wrong regulatory info in HE Operation IE in Beacon
       frame. Issue 20187[31].

     • Wireshark 4.4.1 does not decode RTCP packets. Issue 20188[32].

     • Qt: Display filter sub-menu can only be opened on the triangle,
       not the full name. Issue 20190[33].

     • Qt: Changing the display filter does not update the Conversations
       or Endpoints dialogs. Issue 20191[34].

     • MODBUS Dissector bug. Issue 20192[35].

     • Modbus dissector bug - Field Occurence and Layer Operator
       modbus.bitval field. Issue 20193[36].

     • Wireshark crashes when a field is dragged from packet details
       towards the find input. Issue 20204[37].

     • Lua DissectorTable("") : set ("10,11") unexpected behavior in
       locales with comma as decimal separator. Issue 20216[38].

   The TCP dissector no longer falls back to using the client port as a
   criterion for selecting a payload dissector when the server port does
   not select a payload dissector (except for port 20, active FTP). This
   behavior can be changed using the "Client port dissectors"
   preference.

   Display filters now correctly handle floating point conversion
   errors.

   The Lua API now has better support for comma-separated ranges in
   different locales.

  New and Updated Features

     • The TShark syntax for dumping only fields with a certain prefix
       has changed from `-G fields prefix` to `-G fields,prefix`. This
       allows `tshark -G fields` to again support also specifying the
       configuration profile to use.

  New Protocol Support

   There are no new protocols in this release.

  Updated Protocol Support

   ARTNET, ASN.1 PER, BACapp, BT BR/EDR, CQL, DOF, ECMP, ENIP, FiveCo
   RAP, Frame, FTDI FT, HSRP, HTTP/2, ICMPv6, IEEE 802.11, MBTCP, MMS,
   MPEG PES, PN-DCP, POP, ProtoBuf, PTP, RPC, RTCP, SIP, SRT, Syslog,
   TCP, UMTS RLC, USB CCID, Wi-SUN, and ZigBee ZCL

  New and Updated Capture File Support

   BLF

  Updated File Format Decoding Support

   There is no updated file format support in this release.

 Prior Versions

  Wireshark 4.4.1 included the following changes. See the release
  notes[39] for details:

    • wnpa-sec-2024-12[40] ITS dissector crash. Issue 20026[41].

    • wnpa-sec-2024-13[42] AppleTalk and RELOAD Framing dissector
      crashes. Issue 20114[43].

    • Refresh interface during live-capture leads to corrupt interface
      handling. Issue 11176[44].

    • Media type "application/octet-stream" registered for both Thread
      and UASIP. Issue 14729[45].

    • Extcap toolbar stops working when new interface is added. Issue
      19854[46].

    • Decoding error ITS CPM version 2.1.1. Issue 19886[47].

    • Build error in 4.3.0: sync_pipe_run_command_actual error: argument
      2 is null but the corresponding size argument 3 value is 512004
      [-Werror=nonnull] Issue 19930[48].

    • html2text.py doesn’t handle the `<sup>` tag. Issue 20020[49].

    • Incorrect NetFlow v8 TOS AS aggregation dissection. Issue
      20021[50].

    • The Windows packages don’t ship with the IP address plugin. Issue
      20030[51].

    • O_PATH is Linux-and-FreeBSD-specific. Issue 20031[52].

    • Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the
      correct directory. Issue 20040[53].

    • OER dissector is not considering the preamble if ASN.1 SEQUENCE
      definition includes extension marker but no OPTIONAL items. Issue
      20044[54].

    • Bluetooth classic L2CAP incorrect dissection with connectionless
      reception channel. Issue 20047[55].

    • Profile auto switch filters : Grayed Display Filter Expression
      dialog box when opened from Configuration Profiles dialog box.
      Issue 20049[56].

    • Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue
      20051[57].

    • TECMP Data Type passes too much data to sub dissectors. Issue
      20052[58].

    • Wireshark and tshark 4.4.0 ignore extcap options specified on the
      command line. Issue 20054[59].

    • Cannot open release notes due to incorrect path with duplicated
      directory components. Issue 20055[60].

    • Unable to open "Release Notes" from the "Help" menu. Issue
      20056[61].

    • No capture interfaces if Wireshark is started from command line
      with certain paths. Issue 20057[62].

    • Wireshark 4.4.0 extcap path change breaks third party extcap
      installers. Issue 20069[63].

    • Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue
      20071[64].

    • Unable to create larger files than 99 size units. Issue 20079[65].

    • Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
      Mirroring. Issue 20082[66].

    • PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0 (was
      working in 4.2.7) Issue 20088[67].

    • GUI lags because NetworkManager keeps turning 802.11 monitor mode
      off. Issue 20090[68].

    • Error while getting Bluetooth application process id by <shell:ps
      -A | grep com.*android.bluetooth> Issue 20100[69].

    • Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue 20110[70].

  Wireshark 4.4.0 included the following changes. See the release
  notes[71] for details:

  Many improvements and fixes to the graphing dialogs, including I/O
  Graphs, Flow Graph / VoIP Calls, and TCP Stream Graphs.

  Wireshark now supports automatic profile switching. You can associate
  a display filter with a configuration profile, and when you open a
  capture file that matches the filter, Wireshark will automatically
  switch to that profile.

  Support for Lua 5.3 and 5.4 has been added, and support for Lua 5.1
  and 5.2 has been removed. The Windows and macOS installers now ship
  with Lua 5.4.6.

  Improved display filter support for value strings (optional string
  representations for numeric fields).

  Display filter functions can be implemented as plugins, similar to
  protocol dissectors and file parsers.

  Display filters can be translated to pcap filters using "Edit › Copy ›
  Display filter as pcap filter" if each display filter field has a
  corresponding pcap filter equivalent.

  Custom columns can be defined using any valid field expression, such
  as display filter functions, packet slices, arithmetic calculations,
  logical tests, raw byte addressing, and protocol layer modifiers.

  Custom output fields for `tshark -e` can also be defined using any
  valid field expression.

  Wireshark can be built with the zlib-ng instead of zlib for compressed
  file support. Zlib-ng is substantially faster than zlib. The official
  Windows and macOS packages include this feature.

 Getting Wireshark

  Wireshark source code and installation packages are available from
  https://www.wireshark.org/download.html.

  Vendor-supplied Packages

   Most Linux and Unix vendors supply their own Wireshark packages. You
   can usually install or upgrade Wireshark using the package management
   system specific to that platform. A list of third-party packages can
   be found on the download page[72] on the Wireshark web site.

 File Locations

  Wireshark and TShark look in several different locations for
  preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These
  locations vary from platform to platform. You can use "Help › About
  Wireshark › Folders" or `tshark -G folders` to find the default
  locations on your system.

 Getting Help

  The User’s Guide, manual pages and various other documentation can be
  found at https://www.wireshark.org/docs/

  Community support is available on Wireshark’s Q&A site[73] and on the
  wireshark-users mailing list. Subscription information and archives
  for all of Wireshark’s mailing lists can be found on the mailing list
  site[74].

  Bugs and feature requests can be reported on the issue tracker[75].

  You can learn protocol analysis and meet Wireshark’s developers at
  SharkFest[76].

 How You Can Help

  The Wireshark Foundation helps as many people as possible understand
  their networks as much as possible. You can find out more and donate
  at wiresharkfoundation.org[77].

 Frequently Asked Questions

  A complete FAQ is available on the Wireshark web site[78].

 References

   1. https://wiresharkfoundation.org
   2. https://www.wireshark.org/security/wnpa-sec-2024-14
   3. https://gitlab.com/wireshark/wireshark/-/issues/20176
   4. https://www.wireshark.org/security/wnpa-sec-2024-15
   5. https://gitlab.com/wireshark/wireshark/-/issues/20214
   6. https://gitlab.com/wireshark/wireshark/-/issues/19517
   7. https://gitlab.com/wireshark/wireshark/-/issues/20041
   8. https://gitlab.com/wireshark/wireshark/-/issues/20065
   9. https://gitlab.com/wireshark/wireshark/-/issues/20066
  10. https://gitlab.com/wireshark/wireshark/-/issues/20082
  11. https://gitlab.com/wireshark/wireshark/-/issues/20099
  12. https://gitlab.com/wireshark/wireshark/-/issues/20107
  13. https://gitlab.com/wireshark/wireshark/-/issues/20108
  14. https://gitlab.com/wireshark/wireshark/-/issues/20113
  15. https://gitlab.com/wireshark/wireshark/-/issues/20124
  16. https://gitlab.com/wireshark/wireshark/-/issues/20125
  17. https://gitlab.com/wireshark/wireshark/-/issues/20126
  18. https://gitlab.com/wireshark/wireshark/-/issues/20129
  19. https://gitlab.com/wireshark/wireshark/-/issues/20134
  20. https://gitlab.com/wireshark/wireshark/-/issues/20142
  21. https://gitlab.com/wireshark/wireshark/-/issues/20156
  22. https://gitlab.com/wireshark/wireshark/-/issues/20159
  23. https://gitlab.com/wireshark/wireshark/-/issues/20163
  24. https://gitlab.com/wireshark/wireshark/-/issues/20167
  25. https://gitlab.com/wireshark/wireshark/-/issues/20169
  26. https://gitlab.com/wireshark/wireshark/-/issues/20173
  27. https://gitlab.com/wireshark/wireshark/-/issues/20174
  28. https://gitlab.com/wireshark/wireshark/-/issues/20182
  29. https://gitlab.com/wireshark/wireshark/-/issues/20183
  30. https://gitlab.com/wireshark/wireshark/-/issues/20184
  31. https://gitlab.com/wireshark/wireshark/-/issues/20187
  32. https://gitlab.com/wireshark/wireshark/-/issues/20188
  33. https://gitlab.com/wireshark/wireshark/-/issues/20190
  34. https://gitlab.com/wireshark/wireshark/-/issues/20191
  35. https://gitlab.com/wireshark/wireshark/-/issues/20192
  36. https://gitlab.com/wireshark/wireshark/-/issues/20193
  37. https://gitlab.com/wireshark/wireshark/-/issues/20204
  38. https://gitlab.com/wireshark/wireshark/-/issues/20216
  39. https://www.wireshark.org/docs/relnotes/wireshark-4.4.1.html
  40. https://www.wireshark.org/security/wnpa-sec-2024-12
  41. https://gitlab.com/wireshark/wireshark/-/issues/20026
  42. https://www.wireshark.org/security/wnpa-sec-2024-13
  43. https://gitlab.com/wireshark/wireshark/-/issues/20114
  44. https://gitlab.com/wireshark/wireshark/-/issues/11176
  45. https://gitlab.com/wireshark/wireshark/-/issues/14729
  46. https://gitlab.com/wireshark/wireshark/-/issues/19854
  47. https://gitlab.com/wireshark/wireshark/-/issues/19886
  48. https://gitlab.com/wireshark/wireshark/-/issues/19930
  49. https://gitlab.com/wireshark/wireshark/-/issues/20020
  50. https://gitlab.com/wireshark/wireshark/-/issues/20021
  51. https://gitlab.com/wireshark/wireshark/-/issues/20030
  52. https://gitlab.com/wireshark/wireshark/-/issues/20031
  53. https://gitlab.com/wireshark/wireshark/-/issues/20040
  54. https://gitlab.com/wireshark/wireshark/-/issues/20044
  55. https://gitlab.com/wireshark/wireshark/-/issues/20047
  56. https://gitlab.com/wireshark/wireshark/-/issues/20049
  57. https://gitlab.com/wireshark/wireshark/-/issues/20051
  58. https://gitlab.com/wireshark/wireshark/-/issues/20052
  59. https://gitlab.com/wireshark/wireshark/-/issues/20054
  60. https://gitlab.com/wireshark/wireshark/-/issues/20055
  61. https://gitlab.com/wireshark/wireshark/-/issues/20056
  62. https://gitlab.com/wireshark/wireshark/-/issues/20057
  63. https://gitlab.com/wireshark/wireshark/-/issues/20069
  64. https://gitlab.com/wireshark/wireshark/-/issues/20071
  65. https://gitlab.com/wireshark/wireshark/-/issues/20079
  66. https://gitlab.com/wireshark/wireshark/-/issues/20082
  67. https://gitlab.com/wireshark/wireshark/-/issues/20088
  68. https://gitlab.com/wireshark/wireshark/-/issues/20090
  69. https://gitlab.com/wireshark/wireshark/-/issues/20100
  70. https://gitlab.com/wireshark/wireshark/-/issues/20110
  71. https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html
  72. https://www.wireshark.org/download.html
  73. https://ask.wireshark.org/
  74. https://lists.wireshark.org/lists/
  75. https://gitlab.com/wireshark/wireshark/-/issues
  76. https://sharkfest.wireshark.org
  77. https://wiresharkfoundation.org
  78. https://www.wireshark.org/faq.html


Digests

wireshark-4.4.2.tar.xz: 46763620 bytes
SHA256(wireshark-4.4.2.tar.xz)=6053d97499c83feb87ce1d7f732d9c889c6c18bb334de67e65dca11483b0514e
SHA1(wireshark-4.4.2.tar.xz)=95e8dbc57e19c52ec8b41a06e49cfd70298d0037

Wireshark-4.4.2-x64.exe: 87277648 bytes
SHA256(Wireshark-4.4.2-x64.exe)=69a7f6e94e3744422efbb83528d42dd3ee19c12e253db040c33b75453152dce2
SHA1(Wireshark-4.4.2-x64.exe)=20a4304ff7153e38f07121a76a59f442b369cd42

Wireshark-4.4.2-arm64.exe: 68735248 bytes
SHA256(Wireshark-4.4.2-arm64.exe)=51965e0739799fe927a56befdbad5700e290130a2cb21afb87a9796a6b5c5c64
SHA1(Wireshark-4.4.2-arm64.exe)=ab37419e4918afabb1acea36b600f72a77ae5f02

Wireshark-4.4.2-x64.msi: 63852544 bytes
SHA256(Wireshark-4.4.2-x64.msi)=66406c4010f72d8623aa7a50e53acb1bef92919be5bf981840cffd3607d67014
SHA1(Wireshark-4.4.2-x64.msi)=8ff9b813b7f93974dc963b52a251186e020195c1

WiresharkPortable64_4.4.2.paf.exe: 72787488 bytes
SHA256(WiresharkPortable64_4.4.2.paf.exe)=937de59eb2ca8d9ec706e3b218f780ca6f3e9a209cb32a34e4557e381a17c895
SHA1(WiresharkPortable64_4.4.2.paf.exe)=904a20c7d86bc9ab9b94a88f93996f9edc517d39

Wireshark 4.4.2 Arm 64.dmg: 65429981 bytes
SHA256(Wireshark 4.4.2 Arm 64.dmg)=e60c577e9e2ffff7b2fc10d50c27f41a061d3140ae3bc2a223dba882da00c428
SHA1(Wireshark 4.4.2 Arm 64.dmg)=cde6dd2ed3eb60661caf05a2709c92d24d6744a5

Wireshark 4.4.2 Intel 64.dmg: 69155990 bytes
SHA256(Wireshark 4.4.2 Intel 64.dmg)=5f379065fa16424c68362346177b146b6050fcb77f2468b85cf197f09e399113
SHA1(Wireshark 4.4.2 Intel 64.dmg)=74b1d1ba6b57a1c7dc9308641e97b7525b758abc

You can validate these hashes using the following commands (among others):

    Windows: certutil -hashfile Wireshark-win64-x.y.z.exe SHA256
    Linux (GNU Coreutils): sha256sum wireshark-x.y.z.tar.xz
    macOS: shasum -a 256 "Wireshark x.y.z Arm 64.dmg"
    Other: openssl sha256 wireshark-x.y.z.tar.xz

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature