= Wireshark wireshark-version:[] Release Notes

== What is Wireshark?

Wireshark is the world's most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.

== What's New

=== Bug Fixes

// Link templates: ws-buglink:5000[]  ws-buglink:6000[Wireshark bug]  cve-idlink:2013-2486[]

The following vulnerabilities have been fixed.

* ws-salink:2015-06[]
+
The ATN-CPDLC dissector could crash.
// Fixed in master: g1a3dd34
// Fixed in master-1.12: g572ce10
(ws-buglink:9952[])
cve-idlink:2015-2187[]

* ws-salink:2015-07[]
+
The WCP dissector could crash.
// Fixed in master: gb204ff4
// Fixed in master-1.12: gc59e0a8
// Fixed in master-1.10: gabebbb9
(ws-buglink:10844[])
cve-idlink:2015-2188[]

* ws-salink:2015-08[]
+
The pcapng file parser could crash.
// Fixed in master: ga835c85
// Fixed in master-1.12: g175ede4
// Fixed in master-1.10: gde0eeb5
(ws-buglink:10895[])
cve-idlink:2015-2189[]

* ws-salink:2015-09[]
+
The LLDP dissector could crash.
// Fixed in master: gd1865e0
// Fixed in master-1.12: gafc48b4
(ws-buglink:10983[])
cve-idlink:2015-2190[]

* ws-salink:2015-10[]
+
The TNEF dissector could go into an infinite loop. Discovered by Vlad Tsyrklevich.
// Fixed in master: g608cf32
// Fixed in master-1.12: gc654450
// Fixed in master-1.10: g44a46a1
(ws-buglink:11023[])
cve-idlink:2015-2191[]

* ws-salink:2015-11[]
+
The SCSI OSD dissector could go into an infinite loop. Discovered by Vlad Tsyrklevich.
// Fixed in master: gc35ca6c
// Fixed in master-1.12: g957412f
(ws-buglink:11024[])
cve-idlink:2015-2192[]


The following bugs have been fixed:

//* Wireshark always manages to score tickets for Burning Man, Coachella, and
//  SXSW while you end up working double shifts. (ws-buglink:0000[])
// cp /dev/null /tmp/buglist.txt ; for bugnumber in `git log --stat v1.12.5rc0..| grep ' Bug:' | cut -f2 -d: | sort -n -u ` ; do gen-bugnote $bugnumber; pbpaste >> /tmp/buglist.txt; done

* RTP player crashes on decode of long call: BadAlloc (insufficient resources for operation). (ws-buglink:2630[])

* "Telephony->SCTP->Analyse This Association" crashes Wireshark on manufactured SCTP packet. (ws-buglink:9849[])

* IPv6 Mobility Header Link Layer Address is parsed incorrectly. (ws-buglink:10006[])

* DNS NXT RR is parsed incorrectly. (ws-buglink:10615[])

* IPv6 AUTH mobility option parses Mobility SPI and Authentication Data incorrectly. (ws-buglink:10626[])

* IPv6 Mobility Header Link-Layer Address Mobility Option is parsed incorrectly. (ws-buglink:10627[])

* HTTP chunked response includes data beyond the chunked response. (ws-buglink:10707[])

* DHCP Option 125 Suboption: (1) option-len always expects 1 but specification allows for more. (ws-buglink:10784[])

* Incorrect decoding of IPv4 Interface/Neighbor Address sub-TLVs in Extended IS Reachability TLV of IS-IS. (ws-buglink:10837[])

* Little-endian OS X Bluetooth PacketLogger files aren't handled. (ws-buglink:10861[])

* X.509 certificate serial number incorrectly interpreted as negative number. (ws-buglink:10862[])

* Malformed Packet on rsync-version with length 2. (ws-buglink:10863[])

* ZigBee epoch time is incorrectly displayed in OTA cluster. (ws-buglink:10872[])

* BGP EVPN - Route Type 4 - "Invalid length of IP Address" - "Expert Info" shows a false error. (ws-buglink:10873[])

* Bad bytes read for extended rnc id value in GTP dissector. (ws-buglink:10877[])

* "ServiceChangeReasonStr" messages are not shown in txt generated by tshark. (ws-buglink:10879[])

* Clang ASAN : AddressSanitizer: global-buffer-overflow ANSI. (ws-buglink:10897[])

* MEGACO wrong decoding on media port. (ws-buglink:10898[])

* Wrong media format. (ws-buglink:10899[])

* BSSGP Status PDU decoding fault (missing Mandatory element (0x04) BVCI for proper packet). (ws-buglink:10903[])

* DNS LOC Precision missing units. (ws-buglink:10940[])

* Packets on OpenBSD loopback decoded as raw not null. (ws-buglink:10956[])

* Display Filter Macro unable to edit. (ws-buglink:10957[])

* IPv6 Local Mobility Anchor Address mobility option code is treated incorrectly. (ws-buglink:10961[])

* SNTP server list improperly formatted in DHCPv6 packet details. (ws-buglink:10964[])

* Juniper Packet Mirror dissector expects ipv6 flow label = 0. (ws-buglink:10976[])

* NS Trace (NetScaler Trace) file format is not able to export specified packets. (ws-buglink:10998[])

=== New and Updated Features

There are no new features in this release.

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

--sort-and-group--
ACN
ANSI IS-637-A
AppleMIDI
ATN-CPDLC
BGP
BSSGP
CMIP
DHCP
DHCPv6
DIS
DLM3
DMP
DNS
Extreme Networks
ForCES
FTAM
GMHDR
GSM A-bis OML
GSM A BSSMAP
GSM MAP
GSM RLC MAC
GTP
H.248
H.264
HTTP
IEEE 802.11
IPv6
IS-IS
ISMACryp
J1939
Juniper Jmirror
KDP
L2CAP
LDAP
LLDP
MGCP
MIP6
NBNS
NET/ROM
Netflow
Novell PKIS
PANA
PPPoE
RSL
RSYNC
RTMPT
RTP
SCSI OSD
SDP
SMB Pipe
SMPP
SYNCHROPHASOR
TETRA
TiVoConnect
TNEF
USB HID
V.52
VSS-Monitoring
X.509AF
Zebra
ZigBee
--sort-and-group--

=== New and Updated Capture File Support

--sort-and-group--
NetScaler
PacketLogger
Pcapng
--sort-and-group--

== Getting Wireshark

Wireshark source code and installation packages are available from
http://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages. You can
usually install or upgrade Wireshark using the package management system
specific to that platform. A list of third-party packages can be found
on the http://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference
files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary
from platform to platform. You can use About→Folders to find the default
locations on your system.

== Known Problems

Dumpcap might not quit if Wireshark or TShark crashes.
(ws-buglink:1419[])

The BER dissector might infinitely loop.
(ws-buglink:1516[])

Capture filters aren't applied when capturing from named pipes.
(ws-buglink:1814[])

Filtering tshark captures with read filters (-R) no longer works.
(ws-buglink:2234[])

The 64-bit Windows installer does not support Kerberos decryption.
(http://wiki.wireshark.org/Development/Win64[Win64 development page])

Resolving (ws-buglink:9044[]) reopens (ws-buglink:3528[]) so that Wireshark
no longer automatically decodes gzip data when following a TCP stream.

Application crash when changing real-time option.
(ws-buglink:4035[])

Hex pane display issue after startup.
(ws-buglink:4056[])

Packet list rows are oversized.
(ws-buglink:4357[])

Wireshark and TShark will display incorrect delta times in some cases.
(ws-buglink:4985[])

== Getting Help

Community support is available on http://ask.wireshark.org/[Wireshark's
Q&A site] and on the wireshark-users mailing list. Subscription
information and archives for all of Wireshark's mailing lists can be
found on http://www.wireshark.org/lists/[the web site].

Official Wireshark training and certification are available from
http://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
http://www.wireshark.org/faq.html[Wireshark web site].
