= Wireshark wireshark-version:[] Release Notes
// AsciiDoc quick reference: http://powerman.name/doc/asciidoc

== What is Wireshark?

Wireshark is the world's most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.

== What's New

=== Bug Fixes

The following vulnerabilities have been fixed:

* ws-salink:2015-31[]
+
NBAP dissector crashes.
// Fixed in master: g5bf5656, g5b4ada1, g23379ae
// Fixed in master-2.0: gfa117e7, g254731e
// Fixed in master-1.12: gdaa562c, g3e1cd49, g884d49c
(ws-buglink:11602[], ws-buglink:11835[], ws-buglink:11841[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-37[]
+
NLM dissector crash.
// Fixed in master: g81dfe6d
// Fixed in master-2.0: g851782c
// Fixed in master-1.12: g916dfc5
//(ws-buglink:[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-39[]
+
BER dissector crash.
// Fixed in master: g921bb07
// Fixed in master-2.0: g1e52fad
// Fixed in master-1.12: g2c59970
// (ws-buglink:[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-40[]
+
Zlib decompression crash.
// Fixed in master: gcec0593
// Fixed in master-2.0: g7ea63cf
// Fixed in master-1.12: gff0220f
(ws-buglink:11548[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-41[]
+
SCTP dissector crash.
// Fixed in master: g2259bf8, g1b32d50
// Fixed in master-2.0: ga77290c, ga9b4be9
// Fixed in master-1.12: g39a50f4
(ws-buglink:11767[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-42[]
+
802.11 decryption crash.
// Fixed in master: g40b2831, g83f2818
// Fixed in master-2.0: gbf1fa88, gfc3b6a5
// Fixed in master-1.12: ga6e8fc8, g8110a70
(ws-buglink:11790[], ws-buglink:11826[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-43[]
+
DIAMETER dissector crash.
// Fixed in master: gaaa28a9
// Fixed in master-2.0: g92c892e
// Fixed in master-1.12: g644bc78
(ws-buglink:11792[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-44[]
+
VeriWave file parser crashes.
// Fixed in master: gb8fa3d4, g185911d
// Fixed in master-2.0: g135c8f0, ge4267dd
// Fixed in master-1.12: gfef89fc, g51ccf92
(ws-buglink:11789[], ws-buglink:11791[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-45[]
+
RSVP dissector crash.
// Fixed in master: g56baca6
// Fixed in master-2.0: g9764685
// Fixed in master-1.12: g5d20997
(ws-buglink:11793[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-46[]
+
ANSI A & GSM A dissector crashes.
// Fixed in master: g15edc8d
// Fixed in master-2.0: g61dcd11
// Fixed in master-1.12: g8194323
(ws-buglink:11797[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-47[]
+
Ascend file parser crash.
// Fixed in master: g338da1c
// Fixed in master-2.0: g7abfa36
// Fixed in master-1.12: g9cf09cf
(ws-buglink:11794[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-48[]
+
NBAP dissector crash.
// Fixed in master: gd2644ae
// Fixed in master-2.0: g4c499f5
// Fixed in master-1.12: gea517f9
(ws-buglink:11815[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-49[]
+
RSL dissector crash.
// Fixed in master: g2930d31
// Fixed in master-2.0: gaba3635
// Fixed in master-1.12: gf899e8a
(ws-buglink:11829[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-50[]
+
ZigBee ZCL dissector crash.
// Fixed in master: g9352616, geb0c034
// Fixed in master-2.0: gb11c868, g07dbf78
// Fixed in master-1.12: g49e7e7f, g6b3755c
(ws-buglink:11830[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-51[]
+
Sniffer file parser crash.
// Fixed in master: g53a3e53
// Fixed in master-2.0: gdcba250
// Fixed in master-1.12: g3a3ddbd
(ws-buglink:11827[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-52[]
+
NWP dissector crash.
// Fixed in master: g9b2c889
// Fixed in master-2.0: gb3162ea
(ws-buglink:11726[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-53[]
+
BT ATT dissector crash.
// Fixed in master: g83bad02
// Fixed in master-2.0: g6110aeb
(ws-buglink:11817[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-54[]
+
MP2T file parser crash.
// Fixed in master: gbaa3eab
// Fixed in master-2.0: g01815bf
(ws-buglink:11820[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-55[]
+
MP2T file parser crash.
// Fixed in master: ge3fc691
// Fixed in master-2.0: g2baaeb0
(ws-buglink:11821[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-56[]
+
S7COMM dissector crash.
// Fixed in master: g858c3f0
// Fixed in master-2.0: gd7ec92d
(ws-buglink:11823[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-57[]
+
IPMI dissector crash.
// Fixed in master: g96bf82c
// Fixed in master-2.0: g74612cb
(ws-buglink:11831[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-58[]
+
TDS dissector crash.
// Fixed in master: ge78093f
// Fixed in master-2.0: g06a0e6f
(ws-buglink:11846[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-59[]
+
PPI dissector crash.
// Fixed in master: g2290eba
// Fixed in master-2.0: g08a43e3
(ws-buglink:11876[])
//cve-idlink:2015-XXXX[]

* ws-salink:2015-60[]
+
MS-WSP dissector crash.
// Fixed in master: gd48b0ef
// Fixed in master-2.0: g8c2fa5b
(ws-buglink:11931[])
//cve-idlink:2015-XXXX[]

The Windows installers are now built using NSIS 2.50 in order to avoid
http://nsis.sourceforge.net/Docs/AppendixF.html[DLL hijacking flaws].

The following bugs have been fixed:

//* ws-buglink:5000[]
//* ws-buglink:6000[Wireshark bug]
//* cve-idlink:2014-2486[]
//* Wireshark insists on calling you on your land line which is keeping you from abandoning it for cellular. (ws-buglink:0000[])
// cp /dev/null /tmp/buglist.txt ; for bugnumber in `git log --stat v2.0.1rc0..| grep ' Bug:' | cut -f2 -d: | sort -n -u ` ; do gen-bugnote $bugnumber; pbpaste >> /tmp/buglist.txt; done

* Zooming out (Ctrl+-) too far crashes Wireshark. (ws-buglink:8854[])

* IPv6 Mobility Header Link-Layer Address Mobility Option is parsed incorrectly. (ws-buglink:10627[])

* About -> Plugins should be a scrollable. (ws-buglink:11427[])

* Profile change leaves prior profile residue. (ws-buglink:11493[])

* Wireshark crashes when using the VoIP player. (ws-buglink:11596[])

* Incorrect presentation of Ascend-Data-Filter (RADIUS attribute 242). (ws-buglink:11630[])

* Not possible to stop a capture with invalid filter. (ws-buglink:11667[])

* "No interface selected" when having a valid capture filter. (ws-buglink:11671[])

* Malformed packet with IPv6 mobility header. (ws-buglink:11728[])

* Wireshark crashes dissecting Profinet NRT (DCE-RPC) packet. (ws-buglink:11730[])

* All fields in the packet detail pane of a "new packet" window are expanded by default. (ws-buglink:11731[])

* Malformed packets with SET_CUR in the USBVIDEO (UVC) decoding. (ws-buglink:11736[])

* Display filters arranges columns incorrectly. (ws-buglink:11737[])

* Scrolling and navigating using the trackpad on Mac OS X could be much better. (ws-buglink:11738[])

* Lua Proto() does not validate arguments. (ws-buglink:11739[])

* Pointers to deallocated memory when redissecting. (ws-buglink:11740[])

* Suggestion for re-phrasing the TCP Window Full message. (ws-buglink:11741[])

* Can't parse MPEG-2 Transport Streams generated by the Logik L26DIGB21 TV. (ws-buglink:11749[])

* Qt UI on Windows crashes when changing to next capture file. (ws-buglink:11756[])

* First displayed frame not updated when changing profile. (ws-buglink:11757[])

* LDAP decode shows invalid number of results for searchResEntry packets. (ws-buglink:11761[])

* Crash when escape to Follow TCP -> Save. (ws-buglink:11763[])

* USBPcap prevents mouse and keyboard from working. (ws-buglink:11766[])

* Y-axis in RTP graph is in microseconds. (ws-buglink:11784[])

* "Delta time displayed" column in Wireshark doesn't work well, but Wireshark-gtk does. (ws-buglink:11786[])

* UDP 12001 SNA Data no longer shown in EBCDIC. (ws-buglink:11787[])

* Wireshark Portable is not starting (no messages at all). (ws-buglink:11800[])

* IPv6 RPL Routing Header with length of 8 bytes still reads an address. (ws-buglink:11803[])

* g_utf8_validate assertion when reassembling GSM SMS messages encoded in UCS2. (ws-buglink:11809[])

* Calling plugin_if_goto_frame when there is no file loaded causes a Protection Exception. (ws-buglink:11810[])

* Qt UI SIGSEGV before main() in initializer for colors_. (ws-buglink:11833[])

* Unable to add a directory to "GeoIP Database Paths". (ws-buglink:11842[])

* C++ Run time error when filtering on Expert limit to display filter. (ws-buglink:11848[])

* Widening the window doesn't correctly widen the rightmost column. (ws-buglink:11849[])

* SSL V2 Client Hello no longer dissected in Wireshark 2.0. (ws-buglink:11851[])

* PacketBB (RFC5444) dissector displays IPv4 addresses incorrectly. (ws-buglink:11852[])

* SMTP over port 587 shows identical content for fields "Username" and "Password" when not decoding base-64-encoded authentication information. (ws-buglink:11853[])

* Converting of EUI64 address to string does not take offset into account. (ws-buglink:11856[])

* CIP segment dissection causes PDML assertion/failure. (ws-buglink:11863[])

* In Import from Hex Dump, an attempt to enter the timestamp format manually crashes the application. (ws-buglink:11873[])

* Follow Stream directional selector not readable. (ws-buglink:11887[])

* Coloring rule custom colors not saved. (ws-buglink:11888[])

* Total number of streams not correct in Follow TCP Stream dialog. (ws-buglink:11889[])

* Command line switch -Y for display filter does not work. (ws-buglink:11891[])

* Creating Debian package doesn't work. (ws-buglink:11893[])

* Visual C++ Runtime Library Error "The application has requested the Runtime to terminate it in an unusual way." when you do not wait until Conversations is completely updated before applying "Limit to display filter". (ws-buglink:11900[])

* dpkg-buildpackage relocation R_X86_64_PC32 against symbol. (ws-buglink:11901[])

* Bits view in Packet Bytes pane is not persistent. (ws-buglink:11903[])

* ICMP Timestamp days, hours, minutes, seconds is incorrect. (ws-buglink:11910[])

* MPEG2TS NULL pkt: AFC: "Should be 0 for NULL packets" wrong. (ws-buglink:11921[])

=== New and Updated Features

There are no new features in this release.

//=== Removed Dissectors

=== New File Format Decoding Support

There are no new file formats in this release.

=== New Protocol Support

There are no new protocols in this release.


=== Updated Protocol Support

--sort-and-group--
6LoWPAN
ANSI A
ASN.1 BER
BT ATT
CIP
CLNP
DIAMETER
DNS
ENIP
ERF
GSM A
GSM SMS
HiSLIP
ICMP
IEEE 802.11
IEEE 802.11 Radio
IPMI
IPv4
IPv6
ISUP
L2TP
LDAP
Link (ethertype)
MIP6
MP2T
MS-WSP
NBAP
NWP
PacketBB
PPI
QUIC
RADIUS
RSL
RSVP
S7COMM
SCSI
SCTP
SMTP
SSL
TCP
TDS
USB
VRT
ZigBee ZCL
--sort-and-group--

=== New and Updated Capture File Support

//There is no new or updated capture file support in this release.
--sort-and-group--
Ascend
ERF
MP2T
Sniffer
VeriWave
--sort-and-group--

=== New and Updated Capture Interfaces support

There are no new or updated capture interfaces supported in this release.

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages. You can
usually install or upgrade Wireshark using the package management system
specific to that platform. A list of third-party packages can be found
on the https://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference
files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary
from platform to platform. You can use About→Folders to find the default
locations on your system.

== Known Problems

Dumpcap might not quit if Wireshark or TShark crashes.
(ws-buglink:1419[])

The BER dissector might infinitely loop.
(ws-buglink:1516[])

Capture filters aren't applied when capturing from named pipes.
(ws-buglink:1814[])

Filtering tshark captures with read filters (-R) no longer works.
(ws-buglink:2234[])

Resolving (ws-buglink:9044[]) reopens (ws-buglink:3528[]) so that Wireshark
no longer automatically decodes gzip data when following a TCP stream.

Application crash when changing real-time option.
(ws-buglink:4035[])

Hex pane display issue after startup.
(ws-buglink:4056[])

Packet list rows are oversized.
(ws-buglink:4357[])

Wireshark and TShark will display incorrect delta times in some cases.
(ws-buglink:4985[])

The 64-bit version of Wireshark will leak memory on Windows when the display
depth is set to 16 bits (ws-buglink:9914[])

Wireshark should let you work with multiple capture files. (ws-buglink:10488[])

== Getting Help

Community support is available on https://ask.wireshark.org/[Wireshark's
Q&A site] and on the wireshark-users mailing list. Subscription
information and archives for all of Wireshark's mailing lists can be
found on https://www.wireshark.org/lists/[the web site].

Official Wireshark training and certification are available from
http://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
