kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/wireshark/PLIST

984 lines
42 KiB
Text
Raw Normal View History

wireshark: updated to 3.6.5 Wireshark 3.6.5 Release Notes What’s New Note: This is the last release branch with support for 32-bit Windows. Updates will no longer be available after May 22, 2024 for that platform. Issue 17779[1] Bug Fixes This release fixes an installation issue on Windows which was introduced in the 3.6.4 release. Issue 18077[2]. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support New and Updated Capture File Support There is no new or updated capture file support in this release. New File Format Decoding Support There is no new or updated file format support in this release.
2022-05-05 12:54:27 +02:00
@comment $NetBSD: PLIST,v 1.71 2022/05/05 10:54:27 adam Exp $
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
bin/capinfos
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
bin/captype
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
bin/dumpcap
bin/editcap
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
bin/idl2wrs
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
bin/mergecap
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
bin/mmdbresolve
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
bin/randpkt
Update "wireshark" package to version 0.99.8. Changes since 0.99.7: - Security-related vulnerabilities in the SCTP, SNMP, and TFTP dissectors have been fixed. - This release adds configuration profiles, temporary coloring rules, enhanced I/O graphs, WLAN traffic statistics, and many other useful features.
2008-02-28 15:55:17 +01:00
bin/rawshark
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
bin/reordercap
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
bin/sharkd
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
bin/text2pcap
sort.
2006-07-21 16:53:00 +02:00
bin/tshark
wireshark: fixed building with qt5; added building with qt4 as an option
2017-09-20 21:49:38 +02:00
${PLIST.qt}bin/wireshark
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/cfile.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/cli_main.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/addr_and_mask.h
include/wireshark/epan/addr_resolv.h
include/wireshark/epan/address.h
include/wireshark/epan/address_types.h
include/wireshark/epan/afn.h
include/wireshark/epan/aftypes.h
include/wireshark/epan/app_mem_usage.h
include/wireshark/epan/arcnet_pids.h
include/wireshark/epan/arptypes.h
include/wireshark/epan/asn1.h
include/wireshark/epan/ax25_pids.h
include/wireshark/epan/bridged_pids.h
include/wireshark/epan/capture_dissectors.h
include/wireshark/epan/charsets.h
include/wireshark/epan/chdlctypes.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/cisco_pid.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/color_filters.h
include/wireshark/epan/column-info.h
include/wireshark/epan/column-utils.h
include/wireshark/epan/column.h
include/wireshark/epan/conv_id.h
include/wireshark/epan/conversation.h
include/wireshark/epan/conversation_debug.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/epan/conversation_filter.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/conversation_table.h
include/wireshark/epan/crc10-tvb.h
include/wireshark/epan/crc16-tvb.h
include/wireshark/epan/crc32-tvb.h
include/wireshark/epan/crc6-tvb.h
include/wireshark/epan/crc8-tvb.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dccpservicecodes.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/decode_as.h
include/wireshark/epan/dfilter/dfilter.h
include/wireshark/epan/dfilter/drange.h
include/wireshark/epan/diam_dict.h
include/wireshark/epan/disabled_protos.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/cond_ace_token_enum.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/file-rbm.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-6lowpan.h
include/wireshark/epan/dissectors/packet-a21.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-acdr.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-acp133.h
include/wireshark/epan/dissectors/packet-acse.h
include/wireshark/epan/dissectors/packet-actrace.h
include/wireshark/epan/dissectors/packet-adb_service.h
include/wireshark/epan/dissectors/packet-afp.h
include/wireshark/epan/dissectors/packet-alcap.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-amp.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-ansi_a.h
include/wireshark/epan/dissectors/packet-ansi_map.h
include/wireshark/epan/dissectors/packet-ansi_tcap.h
include/wireshark/epan/dissectors/packet-arp.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-asap+enrp-common.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-atalk.h
include/wireshark/epan/dissectors/packet-atm.h
include/wireshark/epan/dissectors/packet-atn-ulcs.h
include/wireshark/epan/dissectors/packet-bacapp.h
include/wireshark/epan/dissectors/packet-bacnet.h
include/wireshark/epan/dissectors/packet-ber.h
include/wireshark/epan/dissectors/packet-bfd.h
include/wireshark/epan/dissectors/packet-bgp.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/epan/dissectors/packet-bicc_mst.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-bluetooth.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-bpsec.h
include/wireshark/epan/dissectors/packet-bpv6.h
include/wireshark/epan/dissectors/packet-bpv7.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-bssap.h
include/wireshark/epan/dissectors/packet-bssgp.h
include/wireshark/epan/dissectors/packet-btatt.h
include/wireshark/epan/dissectors/packet-btavctp.h
include/wireshark/epan/dissectors/packet-btavdtp.h
include/wireshark/epan/dissectors/packet-btavrcp.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-btbredr_rf.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-bthci_acl.h
include/wireshark/epan/dissectors/packet-bthci_cmd.h
include/wireshark/epan/dissectors/packet-bthci_evt.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-bthci_iso.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-bthci_sco.h
include/wireshark/epan/dissectors/packet-btl2cap.h
include/wireshark/epan/dissectors/packet-btle.h
include/wireshark/epan/dissectors/packet-btrfcomm.h
include/wireshark/epan/dissectors/packet-btsdp.h
include/wireshark/epan/dissectors/packet-c1222.h
include/wireshark/epan/dissectors/packet-camel.h
include/wireshark/epan/dissectors/packet-cdt.h
include/wireshark/epan/dissectors/packet-cell_broadcast.h
include/wireshark/epan/dissectors/packet-charging_ase.h
include/wireshark/epan/dissectors/packet-chdlc.h
include/wireshark/epan/dissectors/packet-cip.h
include/wireshark/epan/dissectors/packet-cipsafety.h
include/wireshark/epan/dissectors/packet-cmip.h
include/wireshark/epan/dissectors/packet-cmp.h
include/wireshark/epan/dissectors/packet-cms.h
include/wireshark/epan/dissectors/packet-coap.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-cose.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-credssp.h
include/wireshark/epan/dissectors/packet-crmf.h
include/wireshark/epan/dissectors/packet-csn1.h
include/wireshark/epan/dissectors/packet-dap.h
include/wireshark/epan/dissectors/packet-dcc.h
include/wireshark/epan/dissectors/packet-dccp.h
include/wireshark/epan/dissectors/packet-dcerpc-browser.h
include/wireshark/epan/dissectors/packet-dcerpc-budb.h
include/wireshark/epan/dissectors/packet-dcerpc-butc.h
include/wireshark/epan/dissectors/packet-dcerpc-dce122.h
include/wireshark/epan/dissectors/packet-dcerpc-dnsserver.h
include/wireshark/epan/dissectors/packet-dcerpc-frsapi.h
include/wireshark/epan/dissectors/packet-dcerpc-frsrpc.h
include/wireshark/epan/dissectors/packet-dcerpc-netlogon.h
include/wireshark/epan/dissectors/packet-dcerpc-nt.h
include/wireshark/epan/dissectors/packet-dcerpc-pnp.h
include/wireshark/epan/dissectors/packet-dcerpc-rras.h
include/wireshark/epan/dissectors/packet-dcerpc-samr.h
include/wireshark/epan/dissectors/packet-dcerpc-spoolss.h
include/wireshark/epan/dissectors/packet-dcerpc-svcctl.h
include/wireshark/epan/dissectors/packet-dcerpc-tapi.h
include/wireshark/epan/dissectors/packet-dcerpc.h
include/wireshark/epan/dissectors/packet-dcom-dispatch.h
include/wireshark/epan/dissectors/packet-dcom.h
include/wireshark/epan/dissectors/packet-diameter.h
include/wireshark/epan/dissectors/packet-diameter_3gpp.h
include/wireshark/epan/dissectors/packet-diffserv-mpls-common.h
include/wireshark/epan/dissectors/packet-disp.h
include/wireshark/epan/dissectors/packet-dns.h
include/wireshark/epan/dissectors/packet-docsis-tlv.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-doip.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-dop.h
include/wireshark/epan/dissectors/packet-dsp.h
include/wireshark/epan/dissectors/packet-dtls.h
include/wireshark/epan/dissectors/packet-dvbci.h
include/wireshark/epan/dissectors/packet-e164.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/epan/dissectors/packet-e1ap.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-e212.h
include/wireshark/epan/dissectors/packet-eapol.h
include/wireshark/epan/dissectors/packet-edonkey.h
include/wireshark/epan/dissectors/packet-eigrp.h
include/wireshark/epan/dissectors/packet-enip.h
include/wireshark/epan/dissectors/packet-epl.h
include/wireshark/epan/dissectors/packet-epmd.h
include/wireshark/epan/dissectors/packet-erf.h
include/wireshark/epan/dissectors/packet-ess.h
include/wireshark/epan/dissectors/packet-eth.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-f1ap.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-f5ethtrailer.h
include/wireshark/epan/dissectors/packet-fc.h
include/wireshark/epan/dissectors/packet-fcbls.h
include/wireshark/epan/dissectors/packet-fcct.h
include/wireshark/epan/dissectors/packet-fcels.h
include/wireshark/epan/dissectors/packet-fcfcs.h
include/wireshark/epan/dissectors/packet-fcfzs.h
include/wireshark/epan/dissectors/packet-fclctl.h
include/wireshark/epan/dissectors/packet-fcsb3.h
include/wireshark/epan/dissectors/packet-fcswils.h
include/wireshark/epan/dissectors/packet-ff.h
include/wireshark/epan/dissectors/packet-fix.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-flexray.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-fmp.h
include/wireshark/epan/dissectors/packet-frame.h
include/wireshark/epan/dissectors/packet-ftam.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-ftdi-ft.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-geonw.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-giop.h
include/wireshark/epan/dissectors/packet-gluster.h
include/wireshark/epan/dissectors/packet-gmr1_common.h
include/wireshark/epan/dissectors/packet-gmr1_rr.h
include/wireshark/epan/dissectors/packet-gprscdr.h
include/wireshark/epan/dissectors/packet-gre.h
include/wireshark/epan/dissectors/packet-gsm_a_common.h
include/wireshark/epan/dissectors/packet-gsm_a_rr.h
include/wireshark/epan/dissectors/packet-gsm_map.h
include/wireshark/epan/dissectors/packet-gsm_rlcmac.h
include/wireshark/epan/dissectors/packet-gsm_sms.h
include/wireshark/epan/dissectors/packet-gsmtap.h
include/wireshark/epan/dissectors/packet-gssapi.h
include/wireshark/epan/dissectors/packet-gtp.h
include/wireshark/epan/dissectors/packet-gtpv2.h
include/wireshark/epan/dissectors/packet-h223.h
include/wireshark/epan/dissectors/packet-h225.h
include/wireshark/epan/dissectors/packet-h235.h
include/wireshark/epan/dissectors/packet-h245.h
include/wireshark/epan/dissectors/packet-h248.h
include/wireshark/epan/dissectors/packet-h263.h
include/wireshark/epan/dissectors/packet-h264.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-h265.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-h323.h
include/wireshark/epan/dissectors/packet-h450-ros.h
include/wireshark/epan/dissectors/packet-hpext.h
include/wireshark/epan/dissectors/packet-http.h
include/wireshark/epan/dissectors/packet-http2.h
include/wireshark/epan/dissectors/packet-iana-oui.h
include/wireshark/epan/dissectors/packet-iax2.h
include/wireshark/epan/dissectors/packet-icmp.h
include/wireshark/epan/dissectors/packet-idmp.h
include/wireshark/epan/dissectors/packet-idp.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-ieee1609dot2.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-ieee80211-radio.h
include/wireshark/epan/dissectors/packet-ieee80211-radiotap-defs.h
include/wireshark/epan/dissectors/packet-ieee80211-radiotap-iter.h
include/wireshark/epan/dissectors/packet-ieee80211.h
include/wireshark/epan/dissectors/packet-ieee802154.h
include/wireshark/epan/dissectors/packet-ieee8023.h
include/wireshark/epan/dissectors/packet-ieee802a.h
include/wireshark/epan/dissectors/packet-igmp.h
include/wireshark/epan/dissectors/packet-imf.h
include/wireshark/epan/dissectors/packet-inap.h
include/wireshark/epan/dissectors/packet-infiniband.h
include/wireshark/epan/dissectors/packet-ip.h
include/wireshark/epan/dissectors/packet-ipmi.h
include/wireshark/epan/dissectors/packet-ipsec.h
include/wireshark/epan/dissectors/packet-ipx.h
include/wireshark/epan/dissectors/packet-isakmp.h
include/wireshark/epan/dissectors/packet-isis-clv.h
include/wireshark/epan/dissectors/packet-isis.h
include/wireshark/epan/dissectors/packet-isl.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-iso10681.h
include/wireshark/epan/dissectors/packet-iso15765.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-isup.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-its.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-iwarp-ddp-rdmap.h
include/wireshark/epan/dissectors/packet-juniper.h
include/wireshark/epan/dissectors/packet-jxta.h
include/wireshark/epan/dissectors/packet-kerberos.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-knxip.h
include/wireshark/epan/dissectors/packet-knxip_decrypt.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-l2tp.h
include/wireshark/epan/dissectors/packet-lapdm.h
include/wireshark/epan/dissectors/packet-lbm.h
include/wireshark/epan/dissectors/packet-lbtrm.h
include/wireshark/epan/dissectors/packet-lbtru.h
include/wireshark/epan/dissectors/packet-lbttcp.h
include/wireshark/epan/dissectors/packet-lcsap.h
include/wireshark/epan/dissectors/packet-ldap.h
include/wireshark/epan/dissectors/packet-ldp.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-lin.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-link16.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-lisp.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-llc.h
include/wireshark/epan/dissectors/packet-lnet.h
include/wireshark/epan/dissectors/packet-logotypecertextn.h
include/wireshark/epan/dissectors/packet-lpp.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-lppa.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-lte-rrc.h
include/wireshark/epan/dissectors/packet-mac-lte.h
include/wireshark/epan/dissectors/packet-mausb.h
include/wireshark/epan/dissectors/packet-mbim.h
include/wireshark/epan/dissectors/packet-mbtcp.h
include/wireshark/epan/dissectors/packet-mgcp.h
include/wireshark/epan/dissectors/packet-mle.h
include/wireshark/epan/dissectors/packet-mms.h
include/wireshark/epan/dissectors/packet-mount.h
include/wireshark/epan/dissectors/packet-mp4ves.h
include/wireshark/epan/dissectors/packet-mpeg-descriptor.h
include/wireshark/epan/dissectors/packet-mpeg-sect.h
include/wireshark/epan/dissectors/packet-mpls.h
include/wireshark/epan/dissectors/packet-mq.h
include/wireshark/epan/dissectors/packet-msrp.h
include/wireshark/epan/dissectors/packet-mstp.h
include/wireshark/epan/dissectors/packet-mtp3.h
include/wireshark/epan/dissectors/packet-nbap.h
include/wireshark/epan/dissectors/packet-ncp-int.h
include/wireshark/epan/dissectors/packet-ncp-nmas.h
include/wireshark/epan/dissectors/packet-ncp-sss.h
include/wireshark/epan/dissectors/packet-ndmp.h
include/wireshark/epan/dissectors/packet-ndps.h
include/wireshark/epan/dissectors/packet-netbios.h
include/wireshark/epan/dissectors/packet-netlink.h
include/wireshark/epan/dissectors/packet-nfs.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-ngap.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-nisplus.h
include/wireshark/epan/dissectors/packet-nlm.h
include/wireshark/epan/dissectors/packet-nr-rrc.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-nrppa.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-nsh.h
include/wireshark/epan/dissectors/packet-ntlmssp.h
include/wireshark/epan/dissectors/packet-ntp.h
include/wireshark/epan/dissectors/packet-nvme.h
include/wireshark/epan/dissectors/packet-ocsp.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-oer.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-opensafety.h
include/wireshark/epan/dissectors/packet-oscore.h
include/wireshark/epan/dissectors/packet-osi-options.h
include/wireshark/epan/dissectors/packet-osi.h
include/wireshark/epan/dissectors/packet-p1.h
include/wireshark/epan/dissectors/packet-p22.h
include/wireshark/epan/dissectors/packet-p7.h
include/wireshark/epan/dissectors/packet-p772.h
include/wireshark/epan/dissectors/packet-pcap_pktdata.h
include/wireshark/epan/dissectors/packet-pcnfsd.h
include/wireshark/epan/dissectors/packet-pdcp-lte.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-pdcp-nr.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-pdu-transport.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-per.h
include/wireshark/epan/dissectors/packet-pkcs1.h
include/wireshark/epan/dissectors/packet-pkcs12.h
include/wireshark/epan/dissectors/packet-pkinit.h
include/wireshark/epan/dissectors/packet-pkix1explicit.h
include/wireshark/epan/dissectors/packet-pkix1implicit.h
include/wireshark/epan/dissectors/packet-pkixac.h
include/wireshark/epan/dissectors/packet-pkixproxy.h
include/wireshark/epan/dissectors/packet-pkixqualified.h
include/wireshark/epan/dissectors/packet-pkixtsp.h
include/wireshark/epan/dissectors/packet-portmap.h
include/wireshark/epan/dissectors/packet-ppi-geolocation-common.h
include/wireshark/epan/dissectors/packet-ppp.h
include/wireshark/epan/dissectors/packet-pres.h
include/wireshark/epan/dissectors/packet-ptp.h
include/wireshark/epan/dissectors/packet-ptpip.h
include/wireshark/epan/dissectors/packet-pw-atm.h
include/wireshark/epan/dissectors/packet-pw-common.h
include/wireshark/epan/dissectors/packet-q708.h
include/wireshark/epan/dissectors/packet-q931.h
include/wireshark/epan/dissectors/packet-q932.h
include/wireshark/epan/dissectors/packet-qsig.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/epan/dissectors/packet-quic.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-radius.h
include/wireshark/epan/dissectors/packet-raknet.h
include/wireshark/epan/dissectors/packet-ranap.h
include/wireshark/epan/dissectors/packet-rdm.h
include/wireshark/epan/dissectors/packet-rdt.h
include/wireshark/epan/dissectors/packet-reload.h
include/wireshark/epan/dissectors/packet-rlc-lte.h
include/wireshark/epan/dissectors/packet-rlc-nr.h
include/wireshark/epan/dissectors/packet-rmi.h
include/wireshark/epan/dissectors/packet-rmt-common.h
include/wireshark/epan/dissectors/packet-rohc.h
include/wireshark/epan/dissectors/packet-ros.h
include/wireshark/epan/dissectors/packet-rpc.h
include/wireshark/epan/dissectors/packet-rpcrdma.h
include/wireshark/epan/dissectors/packet-rrc.h
include/wireshark/epan/dissectors/packet-rsvp.h
include/wireshark/epan/dissectors/packet-rtcp.h
include/wireshark/epan/dissectors/packet-rtp-events.h
include/wireshark/epan/dissectors/packet-rtp.h
include/wireshark/epan/dissectors/packet-rtse.h
include/wireshark/epan/dissectors/packet-rtsp.h
include/wireshark/epan/dissectors/packet-rx.h
include/wireshark/epan/dissectors/packet-s1ap.h
include/wireshark/epan/dissectors/packet-s5066sis.h
include/wireshark/epan/dissectors/packet-s7comm.h
include/wireshark/epan/dissectors/packet-s7comm_szl_ids.h
include/wireshark/epan/dissectors/packet-sccp.h
include/wireshark/epan/dissectors/packet-scsi-mmc.h
include/wireshark/epan/dissectors/packet-scsi-osd.h
include/wireshark/epan/dissectors/packet-scsi-sbc.h
include/wireshark/epan/dissectors/packet-scsi-smc.h
include/wireshark/epan/dissectors/packet-scsi-ssc.h
include/wireshark/epan/dissectors/packet-scsi.h
include/wireshark/epan/dissectors/packet-sctp.h
include/wireshark/epan/dissectors/packet-sdp.h
include/wireshark/epan/dissectors/packet-ses.h
include/wireshark/epan/dissectors/packet-sflow.h
include/wireshark/epan/dissectors/packet-sip.h
include/wireshark/epan/dissectors/packet-skinny.h
include/wireshark/epan/dissectors/packet-sll.h
include/wireshark/epan/dissectors/packet-smb-browse.h
include/wireshark/epan/dissectors/packet-smb-common.h
include/wireshark/epan/dissectors/packet-smb-mailslot.h
include/wireshark/epan/dissectors/packet-smb-pipe.h
include/wireshark/epan/dissectors/packet-smb-sidsnooping.h
include/wireshark/epan/dissectors/packet-smb.h
include/wireshark/epan/dissectors/packet-smb2.h
include/wireshark/epan/dissectors/packet-smpp.h
include/wireshark/epan/dissectors/packet-smrse.h
include/wireshark/epan/dissectors/packet-snmp.h
include/wireshark/epan/dissectors/packet-socketcan.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-someip.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-spice.h
include/wireshark/epan/dissectors/packet-sprt.h
include/wireshark/epan/dissectors/packet-sscop.h
include/wireshark/epan/dissectors/packet-stat-notify.h
include/wireshark/epan/dissectors/packet-stat.h
include/wireshark/epan/dissectors/packet-sv.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-syslog.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-t124.h
include/wireshark/epan/dissectors/packet-t30.h
include/wireshark/epan/dissectors/packet-t38.h
include/wireshark/epan/dissectors/packet-tacacs.h
include/wireshark/epan/dissectors/packet-tcap.h
include/wireshark/epan/dissectors/packet-tcp.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-tcpclv3.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-tetra.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/epan/dissectors/packet-thrift.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/dissectors/packet-tls-utils.h
include/wireshark/epan/dissectors/packet-tls.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-tn3270.h
include/wireshark/epan/dissectors/packet-tn5250.h
include/wireshark/epan/dissectors/packet-tpkt.h
include/wireshark/epan/dissectors/packet-tr.h
include/wireshark/epan/dissectors/packet-tte.h
include/wireshark/epan/dissectors/packet-ua.h
include/wireshark/epan/dissectors/packet-uaudp.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/dissectors/packet-uavcan-dsdl.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-ubertooth.h
include/wireshark/epan/dissectors/packet-udp.h
include/wireshark/epan/dissectors/packet-umts_fp.h
include/wireshark/epan/dissectors/packet-umts_mac.h
include/wireshark/epan/dissectors/packet-umts_rlc.h
include/wireshark/epan/dissectors/packet-usb-hid.h
include/wireshark/epan/dissectors/packet-usb.h
include/wireshark/epan/dissectors/packet-usbip.h
include/wireshark/epan/dissectors/packet-vxlan.h
include/wireshark/epan/dissectors/packet-wap.h
include/wireshark/epan/dissectors/packet-wccp.h
include/wireshark/epan/dissectors/packet-windows-common.h
include/wireshark/epan/dissectors/packet-wlancertextn.h
include/wireshark/epan/dissectors/packet-wps.h
include/wireshark/epan/dissectors/packet-wsp.h
include/wireshark/epan/dissectors/packet-wtls.h
include/wireshark/epan/dissectors/packet-wtp.h
include/wireshark/epan/dissectors/packet-x11-keysymdef.h
include/wireshark/epan/dissectors/packet-x11.h
include/wireshark/epan/dissectors/packet-x2ap.h
include/wireshark/epan/dissectors/packet-x509af.h
include/wireshark/epan/dissectors/packet-x509ce.h
include/wireshark/epan/dissectors/packet-x509if.h
include/wireshark/epan/dissectors/packet-x509sat.h
include/wireshark/epan/dissectors/packet-xml.h
include/wireshark/epan/dissectors/packet-xmpp-conference.h
include/wireshark/epan/dissectors/packet-xmpp-core.h
include/wireshark/epan/dissectors/packet-xmpp-gtalk.h
include/wireshark/epan/dissectors/packet-xmpp-jingle.h
include/wireshark/epan/dissectors/packet-xmpp-other.h
include/wireshark/epan/dissectors/packet-xmpp-utils.h
include/wireshark/epan/dissectors/packet-xmpp.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/epan/dissectors/packet-xnap.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/dissectors/packet-ypbind.h
include/wireshark/epan/dissectors/packet-yppasswd.h
include/wireshark/epan/dissectors/packet-ypserv.h
include/wireshark/epan/dissectors/packet-ypxfr.h
include/wireshark/epan/dissectors/packet-zbee-aps.h
include/wireshark/epan/dissectors/packet-zbee-nwk.h
include/wireshark/epan/dissectors/packet-zbee-security.h
include/wireshark/epan/dissectors/packet-zbee-zcl.h
include/wireshark/epan/dissectors/packet-zbee-zdp.h
include/wireshark/epan/dissectors/packet-zbee.h
include/wireshark/epan/dissectors/packet-ziop.h
include/wireshark/epan/dtd.h
include/wireshark/epan/dtd_parse.h
include/wireshark/epan/dvb_chartbl.h
include/wireshark/epan/eap.h
include/wireshark/epan/eapol_keydes_types.h
include/wireshark/epan/epan.h
include/wireshark/epan/epan_dissect.h
include/wireshark/epan/etypes.h
include/wireshark/epan/ex-opt.h
include/wireshark/epan/except.h
include/wireshark/epan/exceptions.h
include/wireshark/epan/expert.h
include/wireshark/epan/export_object.h
include/wireshark/epan/exported_pdu.h
include/wireshark/epan/filter_expressions.h
include/wireshark/epan/follow.h
include/wireshark/epan/frame_data.h
include/wireshark/epan/frame_data_sequence.h
include/wireshark/epan/ftypes/ftypes.h
include/wireshark/epan/funnel.h
include/wireshark/epan/garrayfix.h
include/wireshark/epan/golay.h
include/wireshark/epan/guid-utils.h
include/wireshark/epan/iana_charsets.h
include/wireshark/epan/iax2_codec_type.h
include/wireshark/epan/in_cksum.h
include/wireshark/epan/ip_opts.h
include/wireshark/epan/ipproto.h
include/wireshark/epan/ipv4.h
include/wireshark/epan/ipv6.h
include/wireshark/epan/lapd_sapi.h
include/wireshark/epan/llcsaps.h
include/wireshark/epan/maxmind_db.h
include/wireshark/epan/media_params.h
include/wireshark/epan/next_tvb.h
include/wireshark/epan/nlpid.h
include/wireshark/epan/oids.h
include/wireshark/epan/osi-utils.h
include/wireshark/epan/oui.h
include/wireshark/epan/packet.h
include/wireshark/epan/packet_info.h
include/wireshark/epan/params.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/pci-ids.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/plugin_if.h
include/wireshark/epan/ppptypes.h
include/wireshark/epan/prefs-int.h
include/wireshark/epan/prefs.h
include/wireshark/epan/print.h
include/wireshark/epan/print_stream.h
include/wireshark/epan/proto.h
include/wireshark/epan/proto_data.h
include/wireshark/epan/ps.h
include/wireshark/epan/ptvcursor.h
include/wireshark/epan/range.h
include/wireshark/epan/reassemble.h
include/wireshark/epan/reedsolomon.h
include/wireshark/epan/register.h
include/wireshark/epan/req_resp_hdrs.h
include/wireshark/epan/rtd_table.h
include/wireshark/epan/rtp_pt.h
include/wireshark/epan/sctpppids.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/epan/secrets.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/show_exception.h
include/wireshark/epan/slow_protocol_subtypes.h
include/wireshark/epan/sminmpec.h
include/wireshark/epan/srt_table.h
include/wireshark/epan/stat_groups.h
include/wireshark/epan/stat_tap_ui.h
include/wireshark/epan/stats_tree.h
include/wireshark/epan/stats_tree_priv.h
include/wireshark/epan/stream.h
include/wireshark/epan/strutil.h
include/wireshark/epan/t35.h
include/wireshark/epan/tap-voip.h
include/wireshark/epan/tap.h
include/wireshark/epan/tfs.h
include/wireshark/epan/time_fmt.h
include/wireshark/epan/timestamp.h
include/wireshark/epan/timestats.h
include/wireshark/epan/to_str.h
include/wireshark/epan/tvbparse.h
include/wireshark/epan/tvbuff-int.h
include/wireshark/epan/tvbuff.h
include/wireshark/epan/uat-int.h
include/wireshark/epan/uat.h
include/wireshark/epan/unit_strings.h
include/wireshark/epan/value_string.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/epan/wmem_scopes.h
include/wireshark/epan/wscbor.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/epan/x264_prt_id.h
include/wireshark/epan/xdlc.h
include/wireshark/file.h
include/wireshark/globals.h
include/wireshark/wiretap/file_wrappers.h
include/wireshark/wiretap/merge.h
include/wireshark/wiretap/pcap-encap.h
include/wireshark/wiretap/pcapng_module.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/wiretap/secrets-types.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wiretap/wtap.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wiretap/wtap_modules.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wiretap/wtap_opttypes.h
include/wireshark/ws_attributes.h
include/wireshark/ws_compiler_tests.h
include/wireshark/ws_diag_control.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/ws_log_defs.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/ws_symbol_export.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/ws_version.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/802_11-utils.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/adler32.h
include/wireshark/wsutil/base32.h
include/wireshark/wsutil/bits_count_ones.h
include/wireshark/wsutil/bits_ctz.h
include/wireshark/wsutil/bitswap.h
include/wireshark/wsutil/buffer.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/wsutil/codecs.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/color.h
include/wireshark/wsutil/copyright_info.h
include/wireshark/wsutil/cpu_info.h
include/wireshark/wsutil/crash_info.h
include/wireshark/wsutil/crc10.h
include/wireshark/wsutil/crc11.h
include/wireshark/wsutil/crc16-plain.h
include/wireshark/wsutil/crc16.h
include/wireshark/wsutil/crc32.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/wsutil/crc5.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/crc6.h
include/wireshark/wsutil/crc7.h
include/wireshark/wsutil/crc8.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/wsutil/curve25519.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/eax.h
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
include/wireshark/wsutil/epochs.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/exported_pdu_tlvs.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/filesystem.h
include/wireshark/wsutil/g711.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/glib-compat.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/inet_addr.h
include/wireshark/wsutil/inet_ipv4.h
include/wireshark/wsutil/inet_ipv6.h
include/wireshark/wsutil/interface.h
include/wireshark/wsutil/jsmn.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/wsutil/json_dumper.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/mpeg-audio.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/wsutil/netlink.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/nstime.h
include/wireshark/wsutil/os_version_info.h
include/wireshark/wsutil/pint.h
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
include/wireshark/wsutil/please_report_bug.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/pow2.h
include/wireshark/wsutil/privileges.h
include/wireshark/wsutil/processes.h
include/wireshark/wsutil/report_message.h
include/wireshark/wsutil/sign_ext.h
include/wireshark/wsutil/sober128.h
include/wireshark/wsutil/socket.h
include/wireshark/wsutil/str_util.h
include/wireshark/wsutil/strnatcmp.h
include/wireshark/wsutil/strtoi.h
include/wireshark/wsutil/tempfile.h
include/wireshark/wsutil/time_util.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/to_str.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/type_util.h
include/wireshark/wsutil/unicode-utils.h
include/wireshark/wsutil/utf8_entities.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/wmem/wmem.h
include/wireshark/wsutil/wmem/wmem_array.h
include/wireshark/wsutil/wmem/wmem_core.h
include/wireshark/wsutil/wmem/wmem_interval_tree.h
include/wireshark/wsutil/wmem/wmem_list.h
include/wireshark/wsutil/wmem/wmem_map.h
include/wireshark/wsutil/wmem/wmem_miscutl.h
include/wireshark/wsutil/wmem/wmem_queue.h
include/wireshark/wsutil/wmem/wmem_stack.h
include/wireshark/wsutil/wmem/wmem_strbuf.h
include/wireshark/wsutil/wmem/wmem_strutl.h
include/wireshark/wsutil/wmem/wmem_tree.h
include/wireshark/wsutil/wmem/wmem_user_cb.h
include/wireshark/wsutil/ws_assert.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/ws_cpuid.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/ws_getopt.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/ws_mempbrk.h
include/wireshark/wsutil/ws_mempbrk_int.h
include/wireshark/wsutil/ws_pipe.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/ws_roundup.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
include/wireshark/wsutil/wsjson.h
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
include/wireshark/wsutil/wslog.h
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
include/wireshark/wsutil/xtea.h
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
lib/libwireshark.so
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
lib/libwireshark.so.15
wireshark: updated to 3.6.5 Wireshark 3.6.5 Release Notes What’s New Note: This is the last release branch with support for 32-bit Windows. Updates will no longer be available after May 22, 2024 for that platform. Issue 17779[1] Bug Fixes This release fixes an installation issue on Windows which was introduced in the 3.6.4 release. Issue 18077[2]. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support New and Updated Capture File Support There is no new or updated capture file support in this release. New File Format Decoding Support There is no new or updated file format support in this release.
2022-05-05 12:54:27 +02:00
lib/libwireshark.so.15.0.5
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
lib/libwiretap.so
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
lib/libwiretap.so.12
wireshark: updated to 3.6.5 Wireshark 3.6.5 Release Notes What’s New Note: This is the last release branch with support for 32-bit Windows. Updates will no longer be available after May 22, 2024 for that platform. Issue 17779[1] Bug Fixes This release fixes an installation issue on Windows which was introduced in the 3.6.4 release. Issue 18077[2]. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support New and Updated Capture File Support There is no new or updated capture file support in this release. New File Format Decoding Support There is no new or updated file format support in this release.
2022-05-05 12:54:27 +02:00
lib/libwiretap.so.12.0.5
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
lib/libwsutil.so
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
lib/libwsutil.so.13
wireshark: updated to 3.6.2 Wireshark 3.6.2 Release Notes What’s New Bug Fixes The following vulnerabilities have been fixed: • wnpa-sec-2022-01[1] RTMPT dissector infinite loop. Issue 17813[2]. • wnpa-sec-2022-02[3] Large loops in multiple dissectors. Issue 17829[4], Issue 17842[5], Issue 17847[6], Issue 17855[7], Issue 17891[8], Issue 17925[9], Issue 17926[10], Issue 17931[11], Issue 17932[12], Issue 17933[13]. • wnpa-sec-2022-03[14] PVFS dissector crash. Issue 17840[15]. • wnpa-sec-2022-04[16] CSN.1 dissector crash. Issue 17882[17]. • wnpa-sec-2022-05[18] CMS dissector crash. Issue 17935[19]. The following bugs have been fixed: • Support for GSM SMS TPDU in HTTP2 body Issue 17784[20]. • Wireshark 3.6.1 broke the ABI by removing ws_log_default_writer from libwsutil Issue 17822[21]. • Fedora RPM package build failing with RPATH of /usr/local/lib64 Issue 17830[22]. • macos-setup.sh: ftp.pcre.org no longer exists Issue 17834[23]. • nmap.org/npcap → npcap.com: domain/URL change Issue 17838[24]. • MPLS ECHO FEC stack change TLV not dissected correctly Issue 17868[25]. • Attempting to open a systemd journal export file segfaults Issue 17875[26]. • Dissector bug on 802.11ac packets Issue 17878[27]. • The Info column shows only one NGAP/S1AP packet of several packets inside an SCTP packet Issue 17886[28]. • Uninstalling Wireshark 3.6.1 on Windows 10 fails to remove the installation directory because it doesn’t remove the User’s Guide subdirectory and all its contents. Issue 17898[29]. • 3.6 doesn’t build without zlib Issue 17899[30]. • SIP Statistics no longer properly reporting method type accounting Issue 17904[31]. • Fuzz job crash output: fuzz-2022-01-26-6940.pcap Issue 17909[32]. • SCTP retransmission detection broken for the first data chunk of each association with relative TSN Issue 17917[33]. • “Show In Folder” doesn’t work correctly for filenames with spaces Issue 17927[34]. New and Updated Features New Protocol Support There are no new protocols in this release. Updated Protocol Support AMP, ASN.1 PER, ATN-ULCS, BGP, BP, CFLOW, CMS, CSN.1, GDSDB, GSM RP, GTP, HTTP3, IEEE 802.11 Radiotap, IPDC, ISAKMP, Kafka, MP2T, MPEG PES, MPEG SECT, MPLS ECHO, NGAP, NTLMSSP, OpenFlow 1.4, OpenFlow 1.5, P_MUL, PN-RT, PROXY, PTP, PVFS, RSL, RTMPT, rtnetlink, S1AP, SCTP, Signal PDU, SIP, TDS, USB, WAP, and ZigBee ZCL New and Updated Capture File Support BLF and libpcap New File Format Decoding Support There is no new or updated file format support in this release.
2022-02-11 11:08:27 +01:00
lib/libwsutil.so.13.1.0
Updated wireshark to 2.2.0. What's New Bug Fixes * Upgrading to latest version uninstalls Microsoft Visual C++ redistributable. ([1]Bug 12712) * Extcap errors not reported back to UI. ([2]Bug 11892) New and Updated Features The following features are new (or have been significantly updated) since version 2.2.0rc1: "Decode As" supports SSL (TLS) over TCP. The following features are new (or have been significantly updated) since version 2.1.1: * Invalid coloring rules are now disabled instead of discarded. This will provide backward compatibility with a coloring rule change in Wireshark 2.2. The following features are new (or have been significantly updated) since version 2.1.0: * Added -d option for Decode As support in Wireshark (mimics TShark functionality) * The Qt UI, GTK+ UI, and TShark can now export packets as JSON. TShark can additionally export packets as Elasticsearch-compatible JSON. * The Qt UI now supports the -j, -J, and -l flags. The -m flag is now deprecated. * The Conversations and Endpoints dialogs are more responsive when viewing large numbers of items. * The RTP player now allows up to 30 minutes of silence frames. * Packet bytes can now be displayed as EBCDIC. * The Qt UI loads captures faster on Windows. * proto_tree_add_checksum was added as an API. This attempts to standardize how checksums are reported and filtered for within *Shark. There are no more individual "good" and "bad" filter fields, protocols now have a "checksum.status" field that records "Good", "Bad" and "Unverified" (neither good or bad). Color filters provided with Wireshark have been adjusted to the new display filter names, but custom ones may need to be updated. The following features are new (or have been significantly updated) since version 2.0.0: * The intelligent scroll bar now sits to the left of a normal scroll bar and provides a clickable map of nearby packets. * You can now switch between between Capture and File Format dissection of the current capture file via the View menu in the Qt GUI. * You can now show selected packet bytes as ASCII, HTML, Image, ISO 8859-1, Raw, UTF-8, a C array, or YAML. * You can now use regular expressions in Find Packet and in the advanced preferences. * Name resolution for packet capture now supports asynchronous DNS lookups only. Therefore the "concurrent DNS resolution" preference has been deprecated and is a no-op. To enable DNS name resolution some build dependencies must be present (currently c-ares). If that is not the case DNS name resolution will be disabled (but other name resolution mechanisms, such as host files, are still available). * The byte under the mouse in the Packet Bytes pane is now highlighted. * TShark supports exporting PDUs via the -U flag. * The Windows and OS X installers now come with the "sshdump" and "ciscodump" extcap interfaces. * Most dialogs in the Qt UI now save their size and positions. * The Follow Stream dialog now supports UTF-16. * The Firewall ACL Rules dialog has returned. * The Flow (Sequence) Analysis dialog has been improved. * We no longer provide packages for 32-bit versions of OS X. * The Bluetooth Device details dialog has been added. New File Format Decoding Support Wireshark is able to display the format of some types of files (rather than displaying the contents of those files). This is useful when you're curious about, or debugging, a file and its format. To open a capture file (such as PCAP) in this mode specify "MIME Files Format" as the file's format in the Open File dialog. New Protocol Support Apache Cassandra - CQL version 3.0, Bachmann bluecom Protocol, Bluetooth Pseudoheader for BR/EDR, Cisco ERSPAN3 Marker, Cisco ttag, Digital Equipment Corporation Local Area Transport, Distributed Object Framework, DOCSIS Upstream Channel Descriptor Type 35, Edge Control Protocol (ECP), Encrypted UDP based FTP with multicast, Ericsson IPOS Kernel Packet Header Dissector Added (IPOS), Extensible Control & Management Protocol (eCMP), FLEXRAY Protocol dissector added (automotive bus), IEEE 802.1BR E-Tag, Intel Omni-Path Architecture, ISO 8583-1, ISO14443, ITU-T G.7041/Y.1303 Generic Framing Procedure (GFP), LAT protocol (DECNET), Metamako trailers, Network Service Header for Ethernet & GRE, Network-Based IP Flow Mobility (NBIFOM), Nokia Intelligent Service Interface (ISI), Open Mobile Alliance Lightweight Machine to Machine TLV payload Added (LwM2M TLV), Real Time Location System (RTLS), RTI TCP Transport Layer (RTITCP), SMB Witness Service, STANAG 5602 SIMPLE, Standard Interface for Multiple Platform Link Evaluation (SIMPLE), USB3 Vision Protocol (USB machine vision cameras), USBIP Protocol, UserLog Protocol, and Zigbee Protocol Clusters Dissectors Added (Closures Lighting General Measurement & Sensing HVAC Security & Safety) Updated Protocol Support Bluetooth OBEX dissector (btobex) was renamed to Obex Dissector (obex), allow to DecodeAs it over USB, TCP and UDP. A preference was added to TCP dissector for handling IPFIX process information. It has been disabled by default. New and Updated Capture File Support Micropross mplog New and Updated Capture Interfaces support Non-empty section placeholder. Major API Changes The libwireshark API has undergone some major changes: * The address macros (e.g., SET_ADDRESS) have been removed. Use the (lower case) functions of the same names instead. * "old style" dissector functions (that don't return number of bytes used) have been replaced in name with the "new style" dissector functions. * tvb_get_string and tvb_get_stringz have been replaced with tvb_get_string_enc and tvb_get_stringz_enc respectively.
2016-09-12 12:59:55 +02:00
lib/pkgconfig/wireshark.pc
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
lib/wireshark/cmake/FindGLIB2.cmake
wireshark: updated to 3.2.3 Wireshark 3.2.3 Release Notes Wireshark 3.2.0 to 3.2.2 might not update automatically on macOS in some cases. If you’re running those versions on macOS you might have to update to a later version manually. Bug Fixes The following vulnerabilities have been fixed: • wnpa-sec-2020-07[2] The BACapp dissector could crash. The following bugs have been fixed: • Add (IETF) QUIC Dissector. • Rename profile name loses list selection. • Dissector bug warning dissecting TLS Certificate Request with many names. • Only ACKs, but no DATA frames are visible in -> TCP Stream Graph -> Time Sequence (tcptrace). • Copy>Description does not work properly for all tree items. • Importing profiles in Windows - zip files fail and from directory crashes Wireshark. • Packet List selection is gone when adding or removing a display filter. • Check for updates, and auto-update, not working in 3.2.1. • f5ethtrailer: TLS trailer creates incorrect CLIENT keylog entries. • Buildbot crash output: randpkt-2020-03-04-18423.pcap. • File open dialog shows garbled time stamps. • RTCP Bye without optional reason reported as [Malformed Packet]. • Undefined-shift in dissect_rtcp. • SOMEIP: SOME/IP-SD dissector fails to register SOME/IP ports, if IPv6 is being used (BUG). • tshark logs: "…<U+200B>could not be opened: Too many open files.". • Typo in About Wireshark > Keyboard Shortcuts > Unignore All Displayed. • Buildbot crash output: randpkt-2020-04-02-31746.pcap. New and Updated Features There are no new features in this release. New Protocol Support There are no new protocols in this release. Updated Protocol Support AFS, BACapp, Bluetooth, CoAP, Diameter3GPP, F5 Ethernet trailer, GSM RLC MAC, ISIS, ISIS CLV, ISIS HELLO, ISIS LSP, ISIS SNP, NAS 5GS, NR RRC, pcap, QUIC, RPCAP, RTCP, SOME/IP-SD, TLS, and WSP New and Updated Capture File Support pcap
2020-04-09 16:37:15 +02:00
lib/wireshark/cmake/FindWSLibrary.cmake
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
lib/wireshark/cmake/FindWSWinLibs.cmake
lib/wireshark/cmake/LocatePythonModule.cmake
lib/wireshark/cmake/UseAsn2Wrs.cmake
lib/wireshark/cmake/UseMakePluginReg.cmake
lib/wireshark/cmake/WiresharkConfig.cmake
lib/wireshark/cmake/WiresharkConfigVersion.cmake
lib/wireshark/cmake/WiresharkTargets-release.cmake
lib/wireshark/cmake/WiresharkTargets.cmake
Updated wireshark to 2.2.0. What's New Bug Fixes * Upgrading to latest version uninstalls Microsoft Visual C++ redistributable. ([1]Bug 12712) * Extcap errors not reported back to UI. ([2]Bug 11892) New and Updated Features The following features are new (or have been significantly updated) since version 2.2.0rc1: "Decode As" supports SSL (TLS) over TCP. The following features are new (or have been significantly updated) since version 2.1.1: * Invalid coloring rules are now disabled instead of discarded. This will provide backward compatibility with a coloring rule change in Wireshark 2.2. The following features are new (or have been significantly updated) since version 2.1.0: * Added -d option for Decode As support in Wireshark (mimics TShark functionality) * The Qt UI, GTK+ UI, and TShark can now export packets as JSON. TShark can additionally export packets as Elasticsearch-compatible JSON. * The Qt UI now supports the -j, -J, and -l flags. The -m flag is now deprecated. * The Conversations and Endpoints dialogs are more responsive when viewing large numbers of items. * The RTP player now allows up to 30 minutes of silence frames. * Packet bytes can now be displayed as EBCDIC. * The Qt UI loads captures faster on Windows. * proto_tree_add_checksum was added as an API. This attempts to standardize how checksums are reported and filtered for within *Shark. There are no more individual "good" and "bad" filter fields, protocols now have a "checksum.status" field that records "Good", "Bad" and "Unverified" (neither good or bad). Color filters provided with Wireshark have been adjusted to the new display filter names, but custom ones may need to be updated. The following features are new (or have been significantly updated) since version 2.0.0: * The intelligent scroll bar now sits to the left of a normal scroll bar and provides a clickable map of nearby packets. * You can now switch between between Capture and File Format dissection of the current capture file via the View menu in the Qt GUI. * You can now show selected packet bytes as ASCII, HTML, Image, ISO 8859-1, Raw, UTF-8, a C array, or YAML. * You can now use regular expressions in Find Packet and in the advanced preferences. * Name resolution for packet capture now supports asynchronous DNS lookups only. Therefore the "concurrent DNS resolution" preference has been deprecated and is a no-op. To enable DNS name resolution some build dependencies must be present (currently c-ares). If that is not the case DNS name resolution will be disabled (but other name resolution mechanisms, such as host files, are still available). * The byte under the mouse in the Packet Bytes pane is now highlighted. * TShark supports exporting PDUs via the -U flag. * The Windows and OS X installers now come with the "sshdump" and "ciscodump" extcap interfaces. * Most dialogs in the Qt UI now save their size and positions. * The Follow Stream dialog now supports UTF-16. * The Firewall ACL Rules dialog has returned. * The Flow (Sequence) Analysis dialog has been improved. * We no longer provide packages for 32-bit versions of OS X. * The Bluetooth Device details dialog has been added. New File Format Decoding Support Wireshark is able to display the format of some types of files (rather than displaying the contents of those files). This is useful when you're curious about, or debugging, a file and its format. To open a capture file (such as PCAP) in this mode specify "MIME Files Format" as the file's format in the Open File dialog. New Protocol Support Apache Cassandra - CQL version 3.0, Bachmann bluecom Protocol, Bluetooth Pseudoheader for BR/EDR, Cisco ERSPAN3 Marker, Cisco ttag, Digital Equipment Corporation Local Area Transport, Distributed Object Framework, DOCSIS Upstream Channel Descriptor Type 35, Edge Control Protocol (ECP), Encrypted UDP based FTP with multicast, Ericsson IPOS Kernel Packet Header Dissector Added (IPOS), Extensible Control & Management Protocol (eCMP), FLEXRAY Protocol dissector added (automotive bus), IEEE 802.1BR E-Tag, Intel Omni-Path Architecture, ISO 8583-1, ISO14443, ITU-T G.7041/Y.1303 Generic Framing Procedure (GFP), LAT protocol (DECNET), Metamako trailers, Network Service Header for Ethernet & GRE, Network-Based IP Flow Mobility (NBIFOM), Nokia Intelligent Service Interface (ISI), Open Mobile Alliance Lightweight Machine to Machine TLV payload Added (LwM2M TLV), Real Time Location System (RTLS), RTI TCP Transport Layer (RTITCP), SMB Witness Service, STANAG 5602 SIMPLE, Standard Interface for Multiple Platform Link Evaluation (SIMPLE), USB3 Vision Protocol (USB machine vision cameras), USBIP Protocol, UserLog Protocol, and Zigbee Protocol Clusters Dissectors Added (Closures Lighting General Measurement & Sensing HVAC Security & Safety) Updated Protocol Support Bluetooth OBEX dissector (btobex) was renamed to Obex Dissector (obex), allow to DecodeAs it over USB, TCP and UDP. A preference was added to TCP dissector for handling IPFIX process information. It has been disabled by default. New and Updated Capture File Support Micropross mplog New and Updated Capture Interfaces support Non-empty section placeholder. Major API Changes The libwireshark API has undergone some major changes: * The address macros (e.g., SET_ADDRESS) have been removed. Use the (lower case) functions of the same names instead. * "old style" dissector functions (that don't return number of bytes used) have been replaced in name with the "new style" dissector functions. * tvb_get_string and tvb_get_stringz have been replaced with tvb_get_string_enc and tvb_get_stringz_enc respectively.
2016-09-12 12:59:55 +02:00
lib/wireshark/extcap/androiddump
wireshark: pkgsrc improvements - remove unused configure options - allow newer Python - depend on: lz4, libssh, libcares, snappy - add http2 as an option
2018-12-03 16:35:15 +01:00
lib/wireshark/extcap/ciscodump
Updated wireshark to 2.2.0. What's New Bug Fixes * Upgrading to latest version uninstalls Microsoft Visual C++ redistributable. ([1]Bug 12712) * Extcap errors not reported back to UI. ([2]Bug 11892) New and Updated Features The following features are new (or have been significantly updated) since version 2.2.0rc1: "Decode As" supports SSL (TLS) over TCP. The following features are new (or have been significantly updated) since version 2.1.1: * Invalid coloring rules are now disabled instead of discarded. This will provide backward compatibility with a coloring rule change in Wireshark 2.2. The following features are new (or have been significantly updated) since version 2.1.0: * Added -d option for Decode As support in Wireshark (mimics TShark functionality) * The Qt UI, GTK+ UI, and TShark can now export packets as JSON. TShark can additionally export packets as Elasticsearch-compatible JSON. * The Qt UI now supports the -j, -J, and -l flags. The -m flag is now deprecated. * The Conversations and Endpoints dialogs are more responsive when viewing large numbers of items. * The RTP player now allows up to 30 minutes of silence frames. * Packet bytes can now be displayed as EBCDIC. * The Qt UI loads captures faster on Windows. * proto_tree_add_checksum was added as an API. This attempts to standardize how checksums are reported and filtered for within *Shark. There are no more individual "good" and "bad" filter fields, protocols now have a "checksum.status" field that records "Good", "Bad" and "Unverified" (neither good or bad). Color filters provided with Wireshark have been adjusted to the new display filter names, but custom ones may need to be updated. The following features are new (or have been significantly updated) since version 2.0.0: * The intelligent scroll bar now sits to the left of a normal scroll bar and provides a clickable map of nearby packets. * You can now switch between between Capture and File Format dissection of the current capture file via the View menu in the Qt GUI. * You can now show selected packet bytes as ASCII, HTML, Image, ISO 8859-1, Raw, UTF-8, a C array, or YAML. * You can now use regular expressions in Find Packet and in the advanced preferences. * Name resolution for packet capture now supports asynchronous DNS lookups only. Therefore the "concurrent DNS resolution" preference has been deprecated and is a no-op. To enable DNS name resolution some build dependencies must be present (currently c-ares). If that is not the case DNS name resolution will be disabled (but other name resolution mechanisms, such as host files, are still available). * The byte under the mouse in the Packet Bytes pane is now highlighted. * TShark supports exporting PDUs via the -U flag. * The Windows and OS X installers now come with the "sshdump" and "ciscodump" extcap interfaces. * Most dialogs in the Qt UI now save their size and positions. * The Follow Stream dialog now supports UTF-16. * The Firewall ACL Rules dialog has returned. * The Flow (Sequence) Analysis dialog has been improved. * We no longer provide packages for 32-bit versions of OS X. * The Bluetooth Device details dialog has been added. New File Format Decoding Support Wireshark is able to display the format of some types of files (rather than displaying the contents of those files). This is useful when you're curious about, or debugging, a file and its format. To open a capture file (such as PCAP) in this mode specify "MIME Files Format" as the file's format in the Open File dialog. New Protocol Support Apache Cassandra - CQL version 3.0, Bachmann bluecom Protocol, Bluetooth Pseudoheader for BR/EDR, Cisco ERSPAN3 Marker, Cisco ttag, Digital Equipment Corporation Local Area Transport, Distributed Object Framework, DOCSIS Upstream Channel Descriptor Type 35, Edge Control Protocol (ECP), Encrypted UDP based FTP with multicast, Ericsson IPOS Kernel Packet Header Dissector Added (IPOS), Extensible Control & Management Protocol (eCMP), FLEXRAY Protocol dissector added (automotive bus), IEEE 802.1BR E-Tag, Intel Omni-Path Architecture, ISO 8583-1, ISO14443, ITU-T G.7041/Y.1303 Generic Framing Procedure (GFP), LAT protocol (DECNET), Metamako trailers, Network Service Header for Ethernet & GRE, Network-Based IP Flow Mobility (NBIFOM), Nokia Intelligent Service Interface (ISI), Open Mobile Alliance Lightweight Machine to Machine TLV payload Added (LwM2M TLV), Real Time Location System (RTLS), RTI TCP Transport Layer (RTITCP), SMB Witness Service, STANAG 5602 SIMPLE, Standard Interface for Multiple Platform Link Evaluation (SIMPLE), USB3 Vision Protocol (USB machine vision cameras), USBIP Protocol, UserLog Protocol, and Zigbee Protocol Clusters Dissectors Added (Closures Lighting General Measurement & Sensing HVAC Security & Safety) Updated Protocol Support Bluetooth OBEX dissector (btobex) was renamed to Obex Dissector (obex), allow to DecodeAs it over USB, TCP and UDP. A preference was added to TCP dissector for handling IPFIX process information. It has been disabled by default. New and Updated Capture File Support Micropross mplog New and Updated Capture Interfaces support Non-empty section placeholder. Major API Changes The libwireshark API has undergone some major changes: * The address macros (e.g., SET_ADDRESS) have been removed. Use the (lower case) functions of the same names instead. * "old style" dissector functions (that don't return number of bytes used) have been replaced in name with the "new style" dissector functions. * tvb_get_string and tvb_get_stringz have been replaced with tvb_get_string_enc and tvb_get_stringz_enc respectively.
2016-09-12 12:59:55 +02:00
lib/wireshark/extcap/randpktdump
wireshark: pkgsrc improvements - remove unused configure options - allow newer Python - depend on: lz4, libssh, libcares, snappy - add http2 as an option
2018-12-03 16:35:15 +01:00
lib/wireshark/extcap/sshdump
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
lib/wireshark/extcap/udpdump
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
lib/wireshark/plugins/3.6/codecs/g711.so
wireshark: fix PLIST for spandsp option
2021-12-10 15:46:09 +01:00
${PLIST.spandsp}lib/wireshark/plugins/3.6/codecs/g722.so
${PLIST.spandsp}lib/wireshark/plugins/3.6/codecs/g726.so
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
lib/wireshark/plugins/3.6/codecs/l16mono.so
lib/wireshark/plugins/3.6/codecs/opus_dec.so
lib/wireshark/plugins/3.6/epan/ethercat.so
lib/wireshark/plugins/3.6/epan/gryphon.so
lib/wireshark/plugins/3.6/epan/irda.so
lib/wireshark/plugins/3.6/epan/mate.so
lib/wireshark/plugins/3.6/epan/opcua.so
lib/wireshark/plugins/3.6/epan/profinet.so
lib/wireshark/plugins/3.6/epan/stats_tree.so
lib/wireshark/plugins/3.6/epan/transum.so
lib/wireshark/plugins/3.6/epan/unistim.so
lib/wireshark/plugins/3.6/epan/wimax.so
lib/wireshark/plugins/3.6/epan/wimaxasncp.so
lib/wireshark/plugins/3.6/epan/wimaxmacphy.so
lib/wireshark/plugins/3.6/wiretap/usbdump.so
${PLIST.icons}share/applications/org.wireshark.Wireshark.desktop
${PLIST.icons}share/icons/hicolor/128x128/apps/org.wireshark.Wireshark.png
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
${PLIST.icons}share/icons/hicolor/128x128/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/128x128/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/16x16/apps/org.wireshark.Wireshark.png
Add a wireshark.desktop entry for the GTK+ port, icons for it and icons for the tcpdump/pcap mimetype.
2015-05-07 23:40:43 +02:00
${PLIST.icons}share/icons/hicolor/16x16/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/16x16/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/24x24/apps/org.wireshark.Wireshark.png
Add a wireshark.desktop entry for the GTK+ port, icons for it and icons for the tcpdump/pcap mimetype.
2015-05-07 23:40:43 +02:00
${PLIST.icons}share/icons/hicolor/24x24/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/24x24/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/256x256/apps/org.wireshark.Wireshark.png
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
${PLIST.icons}share/icons/hicolor/256x256/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/256x256/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/32x32/apps/org.wireshark.Wireshark.png
Add a wireshark.desktop entry for the GTK+ port, icons for it and icons for the tcpdump/pcap mimetype.
2015-05-07 23:40:43 +02:00
${PLIST.icons}share/icons/hicolor/32x32/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/32x32/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/48x48/apps/org.wireshark.Wireshark.png
Add a wireshark.desktop entry for the GTK+ port, icons for it and icons for the tcpdump/pcap mimetype.
2015-05-07 23:40:43 +02:00
${PLIST.icons}share/icons/hicolor/48x48/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/48x48/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/64x64/apps/org.wireshark.Wireshark.png
Add a wireshark.desktop entry for the GTK+ port, icons for it and icons for the tcpdump/pcap mimetype.
2015-05-07 23:40:43 +02:00
${PLIST.icons}share/icons/hicolor/64x64/mimetypes/application-vnd.tcpdump.pcap.png
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/icons/hicolor/64x64/mimetypes/org.wireshark.Wireshark-mimetype.png
${PLIST.icons}share/icons/hicolor/scalable/apps/org.wireshark.Wireshark.svg
wireshark: Readjust PLIST for ${PLIST.icons} entries Readd ${PLIST.icons} as it was in net/wireshark/PLIST,-r1.36 in order to at least fix wireshark when is built with `-qt5' option.
2018-09-10 10:34:06 +02:00
${PLIST.icons}share/icons/hicolor/scalable/apps/wireshark.svg
wireshark: updated to 3.6.0 Wireshark 3.6.0 Release Notes What’s New Many improvements have been made. See the “New and Updated Features” section below for more details. You might want to pay particular attention to the display filter syntax updates. New and Updated Features The following features are new (or have been significantly updated) since version 3.6.0rc3: • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. The following features are new (or have been significantly updated) since version 3.6.0rc2: • Display filter set elements must now be comma-separated. See below for more details. The following features are new (or have been significantly updated) since version 3.6.0rc1: • The display filter expression “a != b” now has the same meaning as “!(a == b)”. The following features are new (or have been significantly updated) since version 3.5.0: • Nothing of note. The following features are new (or have been significantly updated) since version 3.4.0: • Several changes have been made to the display filter syntax: • The expression “a != b” now always has the same meaning as “!(a == b)”. In particular this means filter expressions with multi-value fields like “ip.addr != 1.1.1.1” will work as expected (the result is the same as typing “ip.src != 1.1.1.1 and ip.dst != 1.1.1.1”). This avoids the contradiction (a == b and a != b) being true. • It is possible to use the syntax “a ~= b” or “a any_ne b” to recover the previous (inconsistent with "==") logic for not equal. • Literal strings can now be specified using raw string syntax, identical to raw strings in the Python programming language. This can be used to avoid the complexity of using two levels of character escapes with regular expressions. • Set elements must now be separated using a comma. A filter such as http.request.method in {"GET" "HEAD"} must be written as …<U+200B> in {"GET", "HEAD"}. Whitespace is not significant. The previous use of whitespace as separator is deprecated and will be removed in a future version. • Support for the syntax "a not in b" with the same meaning as "not a in b" has been added. • Packaging updates: • A macOS Arm 64 (Apple Silicon) package is now available. • The macOS Intel packages now ship with Qt 5.15.3 and require macOS 10.13 or later. • The Windows installers now ship with Npcap 1.55. • A 64-bit Windows PortableApps package is now available. • TCP conversations now support a completeness criteria, which facilitates the identification of TCP streams having any of opening or closing handshakes, a payload, in any combination. It can be accessed with the new tcp.completeness filter. • Protobuf fields that are not serialized on the wire or otherwise missing in capture files can now be displayed with default values by setting the new “add_default_value” preference. The default values might be explicitly declared in “proto2” files, or false for bools, first value for enums, zero for numeric types. • Wireshark now supports reading Event Tracing for Windows (ETW). A new extcap named ETW reader is created that now can open an etl file, convert all events in the file to DLT_ETW packets and write to a specified FIFO destination. Also, a new packet_etw dissector is created to dissect DLT_ETW packets so Wireshark can display the DLT_ETW packet header, its message and packet_etw dissector calls packet_mbim sub_dissector if its provider matches the MBIM provider GUID. • “Follow DCCP stream” feature to filter for and extract the contents of DCCP streams. • Wireshark now supports dissecting RTP packets with OPUS payloads. • Importing captures from text files based on regular expressions is now possible. By specifying a regex capturing a single packet including capturing groups for relevant fields a textfile can be converted to a libpcap capture file. Supported data encodings are plain-hexadecimal, -octal, -binary and base64. Also the timestamp format now allows the second-fractions to be placed anywhere in the timestamp and it will be stored with nanosecond instead of microsecond precision. • The RTP Player has been significatnly redesigned and improved. See Playing VoIP Calls[1] and RTP Player Window[2] in the User’s Guide for more details. • The RTP Player can play many streams in row. • The UI is more responsive. • The RTP Player maintains playlist and other tools can add and remove streams to and from it. • Every stream can be muted or routed to the left or right channel for replay. • The option to save audio has been moved from the RTP Analysis dialog to the RTP Player. The RTP Player also saves what was played, and it can save in multichannel .au or .wav. • The RTP Player is now accessible from the Telephony › RTP › RTP Player menu. • The VoIP dialogs (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, SIP Flows) are non-modal and can stay opened on background. • The same tools are provided across all dialogs (Prepare Filter, Analyse, RTP Player …<U+200B>) • The “Follow Stream” dialog is now able to follow SIP calls based on their Call-ID value. • The “Follow Stream” dialog’s YAML output format has been updated to add timestamps and peers information For more details see Following Protocol Streams[3] in the User’s Guide. • IP fragments between public IPv4 addresses are now reassembled even if they have different VLAN IDs. Reassembly of IP fragments where one endpoint is a private (RFC 1918 section 3) or link-local (RFC 3927) IPv4 address continues to take the VLAN ID into account, as those addresses can be reused. To revert to the previous behavior and not reassemble fragments with different VLAN IDs, turn on the “Enable stricter conversation tracking heuristics” top level protocol preference. • USB Link Layer reassembly has been added, which allows hardware captures to be analyzed at the same level as software captures. • TShark can now export TLS session keys with the --export-tls-session-keys option. • Wireshark participated in the Google Season of Docs 2020 and the User’s Guide has been extensively updated. • The “RTP Stream Analysis” dialog CSV export format was slightly changed. The first line of the export contains column titles as in other CSV exports. • Wireshark now supports the Turkish language. • The settings in the “Import from Hex Dump” dialog is now stored in a profile import_hexdump.json file. • Analyze › Reload Lua Plugins has been improved to properly support FileHandler. • The “RTP Stream Analysis” and “IAX2 Stream Analysis” dialogs now show correct calculation mean jitter calculations. • RTP streams are now created based on Skinny protocol messages in addition to other types of messages. • The “VoIP Calls Flow Sequence” window shows more information about various Skinny messages. • Initial support for building Wireshark on Windows using GCC and MinGW-w64 has been added. See README.msys2 in the sources for more information. New File Format Decoding Support Vector Informatik Binary Log File (BLF) New Protocol Support 5G Lawful Interception (5GLI), Bluetooth Link Manager Protocol (BT LMP), Bundle Protocol version 7 (BPv7), Bundle Protocol version 7 Security (BPSec), CBOR Object Signing and Encryption (COSE), E2 Application Protocol (E2AP), Event Tracing for Windows (ETW), EXtreme extra Eth Header (EXEH), High-Performance Connectivity Tracer (HiPerConTracer), ISO 10681, Kerberos SPAKE, Linux psample protocol, Local Interconnect Network (LIN), Microsoft Task Scheduler Service, O-RAN E2AP, O-RAN fronthaul UC-plane (O-RAN), Opus Interactive Audio Codec (OPUS), PDU Transport Protocol, R09.x (R09), RDP Dynamic Channel Protocol (DRDYNVC), RDP Graphic pipeline channel Protocol (EGFX), RDP Multi-transport (RDPMT), Real-Time Publish-Subscribe Virtual Transport (RTPS-VT), Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC), Shared Memory Communications (SMC), Signal PDU, SparkplugB, State Synchronization Protocol (SSyncP), Tagged Image File Format (TIFF), TP-Link Smart Home Protocol, UAVCAN DSDL, UAVCAN/CAN, UDP Remote Desktop Protocol (RDPUDP), Van Jacobson PPP compression (VJC), World of Warcraft World (WOWW), and X2 xIRI payload (xIRI) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Vector Informatik Binary Log File (BLF)
2021-12-10 09:37:17 +01:00
${PLIST.icons}share/metainfo/org.wireshark.Wireshark.metainfo.xml
${PLIST.icons}share/mime/packages/org.wireshark.Wireshark.xml
Update "wireshark" package to version 0.99.4. Changes since version 0.99.3: - Bug fixes o The HTTP dissector could crash. (Bugs 1050 and 1079) Versions affected: 0.99.3. CVE-2006-5468 o The LDAP dissector (and possibly others) could crash. (Bug 1054) Versions affected: 0.99.3. o The XOT dissector could attempt to allocate a large amount of memory and crash. (Bug 1133) Versions affected: 0.9.8 to 0.99.3. CVE-2006-4805 o The WBXML dissector could crash. (Bug 1134) Versions affected: 0.10.11 to 0.99.3. CVE-2006-5469 o The MIME Multipart dissector was susceptible to an off-by-one error. (Bug 1135) Versions affected: 0.10.1 to 0.99.3. CVE-2006-4574 o If AirPcap support was enabled, parsing a WEP key could sometimes cause a crash. Versions affected: 0.99.3. o The file set dialog could grow excessively large. (Bug 331) o Trying to save flow data may crash Wireshark. (Bug 396) o The personal hosts configuration file wasn't being parsed correctly. (Bug 795) o "Save as" to an existing file wasn't allowed. (Bug 927) o The SNMP dissector was not handling 64-bit counters properly. (Bug 1047) o The HTTP content-length field was a string instead of an integer. (Bug 1109) o Invalid characters could show up in PDML output. (Bug 1110) - New and Updated Features o AirPcap, support (which provides raw mode capture under Windows) has been enhanced to allow capturing on multiple AirPcap adapters simultaneously using the Multi-Channel Aggregator. o VoIP call playback has been enhanced. If Wireshark is linked with the PortAudio library, you can play back G.711 conversations. o The capture interface dialog display has been enhanced. o The "Save" button has been removed from the "Ok" / "Apply" / "Cancel" button group in the following dialogs: o Edit/Preferences o View/Coloring Rules o Capture/Capture Filters o Analyze/Display Filters o Analyze/Enabled Protocols If you're fond of the "Save" button it can be resurrected in the User Interface preferences. o Expert analysis has been improved. o Wireshark now supports USB as a media type. If you're running a Linux distribution with version 2.6.11 of the kernel or greater and you have the usbmon module enabled and you have a recent CVS version of libpcap (post-0.9.5) installed you can also do live captures. More details can be found at the USB capture setup page on the wiki. o The number of WEP keys that the user can specify in the IEEE 802.11 protocol preferences has been increased from 4 to 64. - New Protocol Support Enea LINX, Ethernet Powerlink (v1 and v2), H.248 Q.1950 Annex A, Linux pktgen, MP2T, NEWMAIL, PNG, SCSI OSD, UDLD, UMTS FP, USB, WLCCP, WZCSVC - Updated Protocol Support 3Com NJACK, 802.11, ACSE, AH, ALCAP, ANSI MAP, ATM, ASN.1, BACapp, BER, BGP, BSSAP, Camel, Catapult DCT2000, CFlow, CLNP, Common Windows networking, DAP, DCERPC (DCERPC, ATSVC, DFS, EFS, EPM, EVENTLOG, INITSHUTDOWN, MAPI, NT, PIPE, SAMR, SPOOLSS, SRVSVC, SVCCTL, WINREG), DCOM (DCOM, CBA-ACCO, SYSACT), DIAMETER, DISP, DNS, DOP, DSP, ESP, Ethernet, FC, FCP, GSM A, GSM MAP, GSM SMS, GSSAPI, GTP, H.225, H.245, H.248, HTTP, ICQ, IKE, ISAKMP, iSCSI, ISUP, IUUP, Kerberos 4, LAP-D, LDAP, LLC, LogotypeCertExtn, MEGACO, MIME Multipart, MIP6, MMS, MSRP, MTP3, NCP, NDMP, NDPS, NFS, NTP, OSI, PER, PN-MRP, PPP, 19154Q.931, RADIUS, Redback, RPC, RTCP, RTP, SCCP, SCSI, SDP, SIP, SMB, SMRSE, SNMP, SSL, STANAG 5066, STP, TCAP, TCP, TFTP, TIPC, UDP, UMA, VLAN, VNC, VRRP, X.509ce X11, YMSG, WTLS - Removed Protocols The CISCOWL dissector has been superseded by WLCCP. - New and Updated Capture File Support Catapult DCT2000, EyeSDN, iSeries
2006-11-01 13:59:42 +01:00
share/wireshark/COPYING
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/cfilters
share/wireshark/colorfilters
Add a new option "lua" to enable support for Lua scripts and turn it on by default. Bump package revisions as the binary package changed. Suggested by Jonathan Kollasch in private e-mail.
2010-05-15 22:27:28 +02:00
${PLIST.lua}share/wireshark/console.lua
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/dfilter_macros
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/dfilters
Update "wireshark" package to version 1.8.3. Changes since 1.8.2: - Bug Fixes The following vulnerabilities have been fixed. o wnpa-sec-2012-26 The HSRP dissector could go into an infinite loop. (Bug 7581) Versions affected: 1.8.0 to 1.8.2. CVE-2012-5237 o wnpa-sec-2012-27 The PPP dissector could abort. (Bug 7316, bug 7668) Versions affected: 1.8.0 to 1.8.2. CVE-2012-5238 o wnpa-sec-2012-28 Martin Wilck discovered an infinite loop in the DRDA dissector. (Bug 7666) Versions affected: 1.6.0 to 1.6.10, 1.8.0 to 1.8.2. CVE-2012-5239 o wnpa-sec-2012-29 Laurent Butti discovered a buffer overflow in the LDP dissector. (Bug 7567) Versions affected: 1.8.0 to 1.8.2. CVE-2012-5240 The following bugs have been fixed: o The HTTP dissector does not reassemble headers when the first TCP segment does not contain a full header line. o HDCP2 uses the wrong protocol id. o Several I/O graph problems have been fixed. o No markers show up when maps are displayed. (Bug 5016) o Assertion when using tshark/wireshark on large captures. (Bug 5699) o Volume label field of "SMB/TRANS2-QUERY_FS_INFO/InfoVolume level" reply packet is not displayed correctly due alignment issue. (Bug 5778) o 64-bit Wireshark appears to hit 2-Gbyte memory limit on 64-bit Windows. (Bug 5979) o Truncated/partial JPEG files are not dissected. (Bug 6230) o Support for MPLS Packet Loss and Delay Measurement, RFC 6374. (Bug 6881) o Memory leak in voip_calls.c. (Bug 7320) o When listing protocols available for "Decode As", plugins are sorted after built-ins. (Bug 7348) o Hidden columns should not be printed when printing packet summary line. (Bug 7356) o Size wrong in "File Set List" for just-finished captures. (Bug 7370) o Error: no dependency information found for debian/wireshark-common/usr/lib/wireshark/libwsutil.so.2 (used by debian/wireshark/usr/bin/wireshark). (Bug 7408) o Parse and properly display LTE RADIUS AVP 3GPP-User-Location-Info. (Bug 7474) o [PATCH] HomeplugAV dissector: decode device id. (Bug 7548) o BACnet GetEnrollmentSummary-ACK does not decode correctly. (Bug 7556) o epan/dissectors/packet-per.c dissect_per_constrained_integer_64b fails for 64 bits. (Bug 7624) o New SCTP PPID 48. (Bug 7635) o dissector of Qos attribute "Reliability Class" in GMM/SM message. (Bug 7670) o Performance regression in tshark -z io,stat. (Bug 7674) o Incorrect io-stat table format when unsupported "-t" operand is specified and when using AVG of relative_time fields. (Bug 7685) o IEEE 802.11 TKIP dissection : wrong IS_TKIP macro. (Bug 7691) o Homeplug AV dissectors does not properly dissect short frames. (Bug 7707) o mm_context_nas_dl_cnt and mm_context_nas_ul_cnt are not dissected properly in ContextResponse message in Gtpv2. (Bug 7718) o This trace causes Wireshark to crash when VoIP Calls selected. (Bug 7724) o Some diameter Gx enumerations are missing values or value is incorrect. (Bug 7727) o Wireshark 1.8.2 is only displaying 2 filters from the drop-down menu even when preferences are set to higher integer. (Bug 7731) o BGP bad decoding for Graceful Restart Capability with only helper support & for Enhanced Route Refresh Capability. (Bug 7734) o Dissection error of D-RELEASE and D-CONNECT in TETRA dissector. (Bug 7736) o DND can cause Wireshark to crash. (Bug 7744) o SCSI: WRITE BUFFER fields always display as zero. (Bug 7753) - Updated Protocol Support ASN.1 PER, BACnet, BGP, DIAMETER, DRDA, DVB CI, DVB, GSM Management, GTP, GTPv2, HDCP2, HomePlug AV, ICMP, ICMPv6, IEEE 802.11, IEEE 802a, Interlink, JPEG, LDP, LPP, MPEG, MPLS, PCAP, PPP, RANAP, RRC, RRLP, SCCP, SCSI, SCTP, SDP, SMB, TETRA
2012-10-04 22:15:48 +02:00
share/wireshark/diameter/AlcatelLucent.xml
Update "wireshark" package to version 1.6.1. The major changes since version 1.4.* are: - Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets. - Large file (greater than 2 GB) support has been improved. - Wireshark and TShark can import text dumps, similar to text2pcap. - You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window. - Wireshark can export SSL session keys via File→Export→SSL Session Keys... - TShark can show a specific occurrence of a field when using '-T fields'. - Custom columns can show a specific occurrence of a field. - You can hide columns in the packet list. - Wireshark can now export SMB objects. - dftest and randpkt now have manual pages. - TShark can now display iSCSI, ICMP and ICMPv6 service response times. - Dumpcap can now save files with a user-specified group id. - Syntax checking is done for capture filters. - You can display the compiled BPF code for capture filters in the Capture Options dialog. - You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. . - Packet length is (finally) a default column. - TCP window size is now avaiable both scaled and unscaled. A TCP window scaling graph is available in the GUI. - 802.1q VLAN tags are now shown in the Ethernet II protocol tree instead of a separate tree. - Various dissectors now display some UTF-16 strings as proper Unicode including the DCE/RPC and SMB dissectors. - The RTP player now has an option to show the time of day in the graph in addition to the seconds since beginning of capture. - The RTP player now shows why media interruptions occur. - Graphs now save as PNG images by default. - TShark can read and write host name information from and to pcapng-formatted files. Wireshark can read it. TShark can dump host name information via [-z hosts] . - TShark's -z option now uses the [-z <proto>,srt] syntax instead of [-z <proto>,rtt] for all protocols that support service response time statistics. This matches Wireshark's syntax for this option. - Wireshark and TShark can now read compressed Windows Sniffer files. - New Protocol Support ADwin, ADwin-Config, Apache Etch, Aruba PAPI, Babel Routing Protocol, Broadcast/Multicast Control, Constrained Application Protocol (COAP), Digium TDMoE, Erlang Distribution Protocol, Ether-S-I/O, FastCGI, Fibre Channel over InfiniBand (FCoIB), Gopher, Gigamon GMHDR, IDMP, Infiniband Socket Direct Protocol (SDP), JSON, LISP Control, LISP Data, LISP, MikroTik MAC-Telnet, MRP Multiple Mac Registration Protocol (MMRP) Mongo Wire Protocol, MUX27010, Network Monitor 802.11 radio header, OPC UA ExtensionObjects, openSAFETY, PPI-GEOLOCATION-GPS, ReLOAD, ReLOAD Framing, RObust Header Compression (ROHC), RSIP, SAMETIME, SCoP, SGSAP, Tektronix Teklink, USB/AT Commands, uTorrent Transport Protocol, WAI authentication, Wi-Fi P2P (Wi-Fi Direct) - New and Updated Capture File Support Apple PacketLogger, Catapult DCT2000, Daintree SNA, Endace ERF, HP OpenVMS TCPTrace, IPFIX (the file format, not the protocol), Lucent/Ascend debug, Microsoft Network Monitor, Network Instruments, TamoSoft CommView
2011-07-20 20:42:44 +02:00
share/wireshark/diameter/Cisco.xml
Updated wireshark to 2.2.0. What's New Bug Fixes * Upgrading to latest version uninstalls Microsoft Visual C++ redistributable. ([1]Bug 12712) * Extcap errors not reported back to UI. ([2]Bug 11892) New and Updated Features The following features are new (or have been significantly updated) since version 2.2.0rc1: "Decode As" supports SSL (TLS) over TCP. The following features are new (or have been significantly updated) since version 2.1.1: * Invalid coloring rules are now disabled instead of discarded. This will provide backward compatibility with a coloring rule change in Wireshark 2.2. The following features are new (or have been significantly updated) since version 2.1.0: * Added -d option for Decode As support in Wireshark (mimics TShark functionality) * The Qt UI, GTK+ UI, and TShark can now export packets as JSON. TShark can additionally export packets as Elasticsearch-compatible JSON. * The Qt UI now supports the -j, -J, and -l flags. The -m flag is now deprecated. * The Conversations and Endpoints dialogs are more responsive when viewing large numbers of items. * The RTP player now allows up to 30 minutes of silence frames. * Packet bytes can now be displayed as EBCDIC. * The Qt UI loads captures faster on Windows. * proto_tree_add_checksum was added as an API. This attempts to standardize how checksums are reported and filtered for within *Shark. There are no more individual "good" and "bad" filter fields, protocols now have a "checksum.status" field that records "Good", "Bad" and "Unverified" (neither good or bad). Color filters provided with Wireshark have been adjusted to the new display filter names, but custom ones may need to be updated. The following features are new (or have been significantly updated) since version 2.0.0: * The intelligent scroll bar now sits to the left of a normal scroll bar and provides a clickable map of nearby packets. * You can now switch between between Capture and File Format dissection of the current capture file via the View menu in the Qt GUI. * You can now show selected packet bytes as ASCII, HTML, Image, ISO 8859-1, Raw, UTF-8, a C array, or YAML. * You can now use regular expressions in Find Packet and in the advanced preferences. * Name resolution for packet capture now supports asynchronous DNS lookups only. Therefore the "concurrent DNS resolution" preference has been deprecated and is a no-op. To enable DNS name resolution some build dependencies must be present (currently c-ares). If that is not the case DNS name resolution will be disabled (but other name resolution mechanisms, such as host files, are still available). * The byte under the mouse in the Packet Bytes pane is now highlighted. * TShark supports exporting PDUs via the -U flag. * The Windows and OS X installers now come with the "sshdump" and "ciscodump" extcap interfaces. * Most dialogs in the Qt UI now save their size and positions. * The Follow Stream dialog now supports UTF-16. * The Firewall ACL Rules dialog has returned. * The Flow (Sequence) Analysis dialog has been improved. * We no longer provide packages for 32-bit versions of OS X. * The Bluetooth Device details dialog has been added. New File Format Decoding Support Wireshark is able to display the format of some types of files (rather than displaying the contents of those files). This is useful when you're curious about, or debugging, a file and its format. To open a capture file (such as PCAP) in this mode specify "MIME Files Format" as the file's format in the Open File dialog. New Protocol Support Apache Cassandra - CQL version 3.0, Bachmann bluecom Protocol, Bluetooth Pseudoheader for BR/EDR, Cisco ERSPAN3 Marker, Cisco ttag, Digital Equipment Corporation Local Area Transport, Distributed Object Framework, DOCSIS Upstream Channel Descriptor Type 35, Edge Control Protocol (ECP), Encrypted UDP based FTP with multicast, Ericsson IPOS Kernel Packet Header Dissector Added (IPOS), Extensible Control & Management Protocol (eCMP), FLEXRAY Protocol dissector added (automotive bus), IEEE 802.1BR E-Tag, Intel Omni-Path Architecture, ISO 8583-1, ISO14443, ITU-T G.7041/Y.1303 Generic Framing Procedure (GFP), LAT protocol (DECNET), Metamako trailers, Network Service Header for Ethernet & GRE, Network-Based IP Flow Mobility (NBIFOM), Nokia Intelligent Service Interface (ISI), Open Mobile Alliance Lightweight Machine to Machine TLV payload Added (LwM2M TLV), Real Time Location System (RTLS), RTI TCP Transport Layer (RTITCP), SMB Witness Service, STANAG 5602 SIMPLE, Standard Interface for Multiple Platform Link Evaluation (SIMPLE), USB3 Vision Protocol (USB machine vision cameras), USBIP Protocol, UserLog Protocol, and Zigbee Protocol Clusters Dissectors Added (Closures Lighting General Measurement & Sensing HVAC Security & Safety) Updated Protocol Support Bluetooth OBEX dissector (btobex) was renamed to Obex Dissector (obex), allow to DecodeAs it over USB, TCP and UDP. A preference was added to TCP dissector for handling IPFIX process information. It has been disabled by default. New and Updated Capture File Support Micropross mplog New and Updated Capture Interfaces support Non-empty section placeholder. Major API Changes The libwireshark API has undergone some major changes: * The address macros (e.g., SET_ADDRESS) have been removed. Use the (lower case) functions of the same names instead. * "old style" dissector functions (that don't return number of bytes used) have been replaced in name with the "new style" dissector functions. * tvb_get_string and tvb_get_stringz have been replaced with tvb_get_string_enc and tvb_get_stringz_enc respectively.
2016-09-12 12:59:55 +02:00
share/wireshark/diameter/CiscoSystems.xml
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
share/wireshark/diameter/Custom.xml
Update "wireshark" package to version 1.2.1. Changes since version 1.0.8: New features: - Wireshark has a spiffy new start page. - Display filters now autocomplete. - Support for the c-ares resolver library has been added. It has many - advantages over ADNS. - Many new protocol dissectors and capture file formats have been added. - Macintosh OS X support has been improved. - GeoIP database lookups. - OpenStreetMap + GeoIP integration. - Improved Postscript(R) print output. - The preference handling code is now much smarter about changes. - Support for Pcap-ng, the next-generation capture file format. - Support for process information correlation via IPFIX. - Column widths are now saved. - The last used configuration profile is now saved. - Protocol preferences are changeable from the packet details context menu. - Support for IP packet comparison. - Capinfos now shows the average packet rate. Security fixes: - The AFS dissector could crash. - The Infiniband dissector could crash on some platforms.
2009-07-21 22:39:41 +02:00
share/wireshark/diameter/Ericsson.xml
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/diameter/HP.xml
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
share/wireshark/diameter/Huawei.xml
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/diameter/Inovar.xml
share/wireshark/diameter/Juniper.xml
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
share/wireshark/diameter/Metaswitch.xml
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/diameter/Microsoft.xml
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/diameter/Nokia.xml
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/diameter/NokiaSolutionsAndNetworks.xml
share/wireshark/diameter/Oracle.xml
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/diameter/Siemens.xml
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
share/wireshark/diameter/Starent.xml
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/diameter/TGPP.xml
share/wireshark/diameter/TGPP2.xml
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/diameter/Telefonica.xml
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
share/wireshark/diameter/VerizonWireless.xml
Update "wireshark" package to version 1.6.1. The major changes since version 1.4.* are: - Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets. - Large file (greater than 2 GB) support has been improved. - Wireshark and TShark can import text dumps, similar to text2pcap. - You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window. - Wireshark can export SSL session keys via File→Export→SSL Session Keys... - TShark can show a specific occurrence of a field when using '-T fields'. - Custom columns can show a specific occurrence of a field. - You can hide columns in the packet list. - Wireshark can now export SMB objects. - dftest and randpkt now have manual pages. - TShark can now display iSCSI, ICMP and ICMPv6 service response times. - Dumpcap can now save files with a user-specified group id. - Syntax checking is done for capture filters. - You can display the compiled BPF code for capture filters in the Capture Options dialog. - You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. . - Packet length is (finally) a default column. - TCP window size is now avaiable both scaled and unscaled. A TCP window scaling graph is available in the GUI. - 802.1q VLAN tags are now shown in the Ethernet II protocol tree instead of a separate tree. - Various dissectors now display some UTF-16 strings as proper Unicode including the DCE/RPC and SMB dissectors. - The RTP player now has an option to show the time of day in the graph in addition to the seconds since beginning of capture. - The RTP player now shows why media interruptions occur. - Graphs now save as PNG images by default. - TShark can read and write host name information from and to pcapng-formatted files. Wireshark can read it. TShark can dump host name information via [-z hosts] . - TShark's -z option now uses the [-z <proto>,srt] syntax instead of [-z <proto>,rtt] for all protocols that support service response time statistics. This matches Wireshark's syntax for this option. - Wireshark and TShark can now read compressed Windows Sniffer files. - New Protocol Support ADwin, ADwin-Config, Apache Etch, Aruba PAPI, Babel Routing Protocol, Broadcast/Multicast Control, Constrained Application Protocol (COAP), Digium TDMoE, Erlang Distribution Protocol, Ether-S-I/O, FastCGI, Fibre Channel over InfiniBand (FCoIB), Gopher, Gigamon GMHDR, IDMP, Infiniband Socket Direct Protocol (SDP), JSON, LISP Control, LISP Data, LISP, MikroTik MAC-Telnet, MRP Multiple Mac Registration Protocol (MMRP) Mongo Wire Protocol, MUX27010, Network Monitor 802.11 radio header, OPC UA ExtensionObjects, openSAFETY, PPI-GEOLOCATION-GPS, ReLOAD, ReLOAD Framing, RObust Header Compression (ROHC), RSIP, SAMETIME, SCoP, SGSAP, Tektronix Teklink, USB/AT Commands, uTorrent Transport Protocol, WAI authentication, Wi-Fi P2P (Wi-Fi Direct) - New and Updated Capture File Support Apple PacketLogger, Catapult DCT2000, Daintree SNA, Endace ERF, HP OpenVMS TCPTrace, IPFIX (the file format, not the protocol), Lucent/Ascend debug, Microsoft Network Monitor, Network Instruments, TamoSoft CommView
2011-07-20 20:42:44 +02:00
share/wireshark/diameter/Vodafone.xml
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/diameter/chargecontrol.xml
share/wireshark/diameter/dictionary.dtd
share/wireshark/diameter/dictionary.xml
Update "wireshark" package to version 1.2.2. Changes since version 1.2.1: - The following vulnerabilities have been fixed. See the security advisory for details and a workaround. - The GSM A RR dissector could crash. Versions affected: 1.2.0 to 1.2.1 - The OpcUa dissector could use excessive CPU and memory. Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1 - The TLS dissector could crash on some platforms. Versions affected: 1.2.0 to 1.2.1 - The following bugs have been fixed: - The "Capture->Interfaces" window can't be closed. (Bug 1740) - tshark-1.0.2 (dumpcap) signal abort core saved. (Bug 2767) - Memory leak fixes. (Bug 3330) - Display filter autocompletion doesn't work for some RADIUS and WiMAX ASNCP fields. (Bug 3538) - Wireshark Portable includes wrong WinPcap installer. (Bug 3547) - Crash when loading a profile. (Bug 3640) - The proto,colinfo tap doesn't work if the INFO column isn't being printed. (Bug 3675) - Flow Graph adds too much unnecessary garbage. (Bug 3693) - The EAP Diameter dictionary file was missing in the distribution. (Bug 3761) - Graph analysis window is behind other window. (Bug 3773) - IKEv2 Cert Request payload dissection error. (Bug 3782) - DNS NAPTR RR (RFC 3403) replacement MUST be a fully qualified domain-name. (Bug 3792) - Malformed RTCP Packet error while sending Payload specific RTCP feedback packet( as per RFC 4585). (Bug 3800) - 802.11n Block Ack packet Bitmap field missing. (Bug 3806) - Wireshark doesn't decode WBXML/ActiveSync information correctly. (Bug 3811) - Malformed packet when IPv6 packet has Next Header == 59. (Bug 3820) - Wireshark could crash while reading an ERF file. (Bug 3849) - Minor errors in gsm rr dissectors. (Bug 3889) - WPA Decryption Issues. (Bug 3890) - GSM A RR sys info dissection problem. (Bug 3901) - GSM A RR inverts MEAS-VALID values. (Bug 3915) - PDML output leaks ~300 bytes / packet. (Bug 3913) - Incorrect station identifier parsing in Kingfisher dissector. (Bug 3946) - DHCPv6, Vendor-Specific Informantion, SubOption"Option Request" parser incorrect. (Bug 3987) - Wireshark could leak memory while analyzing SSL. - Wireshark could crash while updating menu items after reading a file in some cases. - The Mac OS X ChmodBPF script now works correctly under Snow Leopard. - Updated Protocol Support DCERPC, DHCPv6, DNS, E.212, GSM A RR, GTPv2, H.248, IEEE 802.11, IPMI, ISAKMP/IKE, ISUP, Kingfisher, LDAP, OpcUA, RTCP, SCTP, SIP, SSL, TCP, WBXML, ZRTP - Updated Capture File Support ERF
2009-09-19 08:36:18 +02:00
share/wireshark/diameter/eap.xml
Update "wireshark" package to version 1.2.1. Changes since version 1.0.8: New features: - Wireshark has a spiffy new start page. - Display filters now autocomplete. - Support for the c-ares resolver library has been added. It has many - advantages over ADNS. - Many new protocol dissectors and capture file formats have been added. - Macintosh OS X support has been improved. - GeoIP database lookups. - OpenStreetMap + GeoIP integration. - Improved Postscript(R) print output. - The preference handling code is now much smarter about changes. - Support for Pcap-ng, the next-generation capture file format. - Support for process information correlation via IPFIX. - Column widths are now saved. - The last used configuration profile is now saved. - Protocol preferences are changeable from the packet details context menu. - Support for IP packet comparison. - Capinfos now shows the average packet rate. Security fixes: - The AFS dissector could crash. - The Infiniband dissector could crash on some platforms.
2009-07-21 22:39:41 +02:00
share/wireshark/diameter/etsie2e4.xml
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/diameter/mobileipv4.xml
Update "wireshark" package to version 1.2.7. Changes since version 1.2.6: Bug fixes: - SNMPv3 Engine ID registration. (Bug 2426) - Open file dialog always displayed when clicking anywhere on Wireshark. (Bug 2478) - tshark reports wrong number of bytes on big dumpfiles with -z io,stat. (Bug 3205) - Negative INTEGER number displayed as positive number in SNMP dissector. (Bug 3230) - Add support for FT_BOOLEAN fields to wslua FieldInfo. (Bug 4049) - Wireshark crashes w/ GLib error when trying to play RTP stream. (Bug 4119) - Windows 2000 support has been restored. (Bug 4176) - Wrong dissection on be_cell_id_list for bssmap. (Bug 4437) - I/O Graph dropdown boxes not working correctly. (Bug 4487) - Runtime Error when right-clicking field and selecting "Filter Field Reference". (Bug 4522) - In GSM SMS PDU TPVPF showing wrong. (Bug 4524) - Profinet: May be wrong defined byte meaning. (Bug 4525) - GLib-CRITICAL ** Message. (Bug 4547) - Certain EDP display filters trigger Wireshark/tshark runtime error. (Bug 4563) - Some NCP frames trigger "Dissector bug, protocol NCP". (Bug 4565) - The encapsulation abbreviation "bluetooth-h4" is ambiguous.(Bug 4613) Updated Protocol Support: - BSSMAP, DMP, GSM SMS, LDSS, NCP, PN/IO, PPP, SIP, SNMP Requested by Alistair Crooks.
2010-04-04 13:40:25 +02:00
share/wireshark/diameter/mobileipv6.xml
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/diameter/nasreq.xml
Update "wireshark" package to version 0.99.5. Changes since version 0.99.4: - Bug Fixes o The TCP dissector could hang or crash while reassembling HTTP packets. Versions affected: 0.99.2 to 0.99.4 CVE-2007-0459 o The HTTP dissector could crash. Versions affected: 0.99.3 to 0.99.4 CVE-2007-0458 o On some systems, the IEEE 802.11 dissector could crash. Versions affected: 0.10.14 to 0.99.4 CVE-2007-0457 o On some systems, the LLT dissector could crash. Versions affected: 0.99.3 to 0.99.4 CVE-2007-0456 The following bugs have been fixed: o The end of HTTP chunked encoding wasn't being displayed. o The Follow TCP Stream window could omit characters. o Opening a flow graph could crash Wireshark. o Follow TCP Stream would sometimes get the direction wrong. o The foreground text in the coloring rules editor was always black. o The CSV export format was incorrect. o On some Windows systems Wireshark could take a long time to start up. o Malformed UDLD packets could cause an exception. o The ISUP statistics report could overflow a buffer and crash when displaying IPv6 addresses. - New and Updated Features o Decryption support for WPA/WPA2 and SNMPv3 has been added. The TDS / MS SQL dissector now de-obfuscates passwords. o 64-bit file handling has been improved. o The Find function now selects the corresponding packet detail item. Find functionality has been added to the TCP and SSL stream dialogs. o Main window keyboard navigation has been improved. o ASN.1 BER-encoded files can now be dissected according to a user-specified syntax. - New Protocol Support DMP, Homeplug (INT51X1), NBD, OMAPI, PKCS#12, RGMP, Roofnet, STUN v2 - Updated Protocol Support 2dparityfec, ACN, AIM, AMR, ANSI 637, ANSI A, ANSI MAP, ARP, ASN.1 BER, ASN.1 PER, BACapp, BPDU, CAMEL, DCERPC (DCERPC, EFS, EVENTLOG, NSPI, PN-IO, WINREG), DCOM CBA, DCP, DHCP, DHCPv6, DMP, DNS, E.164, EAP, EPL, ETSI DCP, FCP, GIOP, GSM A, H.245, H.248, HPSW, HTTP, ICMP, ICMPv6, IEEE 802.11, IMAP, INAP, IPMI, IPsec, IRC, ISAKMP, iSCSI, ISIS LSP, IuUP, K12, Kerberos, LDAP, LLDP, MEGACO, MGCP, MIME Multipart, MMS, MMSE, MSRP, MySQL, NetFlow, NFS, NTLMSSP, NTP, OSPF, PN-PTCP, PPPoE, Q.931, Radiotap, RADIUS, RPC, RSVP, RTCP, S4406, SCCP, SCSI, SDP, SES, sFlow, SIGCOMP, SIP, SIR, Skinny, SMB (SMB, NETLOGON), SMTP, SNMP, SPNEGO, SSL, T.38, TCP, TDS, text/media, TIPC, UDLD, UDP Lite, UDP, UMA, UMTS FP, USB, VNC, WBXML, WLCCP, WSP, X.411, X.420, XML, XOT, YMSG - New and Updated Capture File Support Catapult DCT2000, Netttl, Windows Sniffer / NetXray
2007-02-03 19:06:37 +01:00
share/wireshark/diameter/sip.xml
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/diameter/sunping.xml
Add a new option "lua" to enable support for Lua scripts and turn it on by default. Bump package revisions as the binary package changed. Suggested by Jonathan Kollasch in private e-mail.
2010-05-15 22:27:28 +02:00
${PLIST.lua}share/wireshark/dtd_gen.lua
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/dtds/dc.dtd
share/wireshark/dtds/itunes.dtd
Update "wireshark" package to version 0.99.5. Changes since version 0.99.4: - Bug Fixes o The TCP dissector could hang or crash while reassembling HTTP packets. Versions affected: 0.99.2 to 0.99.4 CVE-2007-0459 o The HTTP dissector could crash. Versions affected: 0.99.3 to 0.99.4 CVE-2007-0458 o On some systems, the IEEE 802.11 dissector could crash. Versions affected: 0.10.14 to 0.99.4 CVE-2007-0457 o On some systems, the LLT dissector could crash. Versions affected: 0.99.3 to 0.99.4 CVE-2007-0456 The following bugs have been fixed: o The end of HTTP chunked encoding wasn't being displayed. o The Follow TCP Stream window could omit characters. o Opening a flow graph could crash Wireshark. o Follow TCP Stream would sometimes get the direction wrong. o The foreground text in the coloring rules editor was always black. o The CSV export format was incorrect. o On some Windows systems Wireshark could take a long time to start up. o Malformed UDLD packets could cause an exception. o The ISUP statistics report could overflow a buffer and crash when displaying IPv6 addresses. - New and Updated Features o Decryption support for WPA/WPA2 and SNMPv3 has been added. The TDS / MS SQL dissector now de-obfuscates passwords. o 64-bit file handling has been improved. o The Find function now selects the corresponding packet detail item. Find functionality has been added to the TCP and SSL stream dialogs. o Main window keyboard navigation has been improved. o ASN.1 BER-encoded files can now be dissected according to a user-specified syntax. - New Protocol Support DMP, Homeplug (INT51X1), NBD, OMAPI, PKCS#12, RGMP, Roofnet, STUN v2 - Updated Protocol Support 2dparityfec, ACN, AIM, AMR, ANSI 637, ANSI A, ANSI MAP, ARP, ASN.1 BER, ASN.1 PER, BACapp, BPDU, CAMEL, DCERPC (DCERPC, EFS, EVENTLOG, NSPI, PN-IO, WINREG), DCOM CBA, DCP, DHCP, DHCPv6, DMP, DNS, E.164, EAP, EPL, ETSI DCP, FCP, GIOP, GSM A, H.245, H.248, HPSW, HTTP, ICMP, ICMPv6, IEEE 802.11, IMAP, INAP, IPMI, IPsec, IRC, ISAKMP, iSCSI, ISIS LSP, IuUP, K12, Kerberos, LDAP, LLDP, MEGACO, MGCP, MIME Multipart, MMS, MMSE, MSRP, MySQL, NetFlow, NFS, NTLMSSP, NTP, OSPF, PN-PTCP, PPPoE, Q.931, Radiotap, RADIUS, RPC, RSVP, RTCP, S4406, SCCP, SCSI, SDP, SES, sFlow, SIGCOMP, SIP, SIR, Skinny, SMB (SMB, NETLOGON), SMTP, SNMP, SPNEGO, SSL, T.38, TCP, TDS, text/media, TIPC, UDLD, UDP Lite, UDP, UMA, UMTS FP, USB, VNC, WBXML, WLCCP, WSP, X.411, X.420, XML, XOT, YMSG - New and Updated Capture File Support Catapult DCT2000, Netttl, Windows Sniffer / NetXray
2007-02-03 19:06:37 +01:00
share/wireshark/dtds/mscml.dtd
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/dtds/pocsettings.dtd
share/wireshark/dtds/presence.dtd
share/wireshark/dtds/reginfo.dtd
Update "wireshark" package to version 0.99.4. Changes since version 0.99.3: - Bug fixes o The HTTP dissector could crash. (Bugs 1050 and 1079) Versions affected: 0.99.3. CVE-2006-5468 o The LDAP dissector (and possibly others) could crash. (Bug 1054) Versions affected: 0.99.3. o The XOT dissector could attempt to allocate a large amount of memory and crash. (Bug 1133) Versions affected: 0.9.8 to 0.99.3. CVE-2006-4805 o The WBXML dissector could crash. (Bug 1134) Versions affected: 0.10.11 to 0.99.3. CVE-2006-5469 o The MIME Multipart dissector was susceptible to an off-by-one error. (Bug 1135) Versions affected: 0.10.1 to 0.99.3. CVE-2006-4574 o If AirPcap support was enabled, parsing a WEP key could sometimes cause a crash. Versions affected: 0.99.3. o The file set dialog could grow excessively large. (Bug 331) o Trying to save flow data may crash Wireshark. (Bug 396) o The personal hosts configuration file wasn't being parsed correctly. (Bug 795) o "Save as" to an existing file wasn't allowed. (Bug 927) o The SNMP dissector was not handling 64-bit counters properly. (Bug 1047) o The HTTP content-length field was a string instead of an integer. (Bug 1109) o Invalid characters could show up in PDML output. (Bug 1110) - New and Updated Features o AirPcap, support (which provides raw mode capture under Windows) has been enhanced to allow capturing on multiple AirPcap adapters simultaneously using the Multi-Channel Aggregator. o VoIP call playback has been enhanced. If Wireshark is linked with the PortAudio library, you can play back G.711 conversations. o The capture interface dialog display has been enhanced. o The "Save" button has been removed from the "Ok" / "Apply" / "Cancel" button group in the following dialogs: o Edit/Preferences o View/Coloring Rules o Capture/Capture Filters o Analyze/Display Filters o Analyze/Enabled Protocols If you're fond of the "Save" button it can be resurrected in the User Interface preferences. o Expert analysis has been improved. o Wireshark now supports USB as a media type. If you're running a Linux distribution with version 2.6.11 of the kernel or greater and you have the usbmon module enabled and you have a recent CVS version of libpcap (post-0.9.5) installed you can also do live captures. More details can be found at the USB capture setup page on the wiki. o The number of WEP keys that the user can specify in the IEEE 802.11 protocol preferences has been increased from 4 to 64. - New Protocol Support Enea LINX, Ethernet Powerlink (v1 and v2), H.248 Q.1950 Annex A, Linux pktgen, MP2T, NEWMAIL, PNG, SCSI OSD, UDLD, UMTS FP, USB, WLCCP, WZCSVC - Updated Protocol Support 3Com NJACK, 802.11, ACSE, AH, ALCAP, ANSI MAP, ATM, ASN.1, BACapp, BER, BGP, BSSAP, Camel, Catapult DCT2000, CFlow, CLNP, Common Windows networking, DAP, DCERPC (DCERPC, ATSVC, DFS, EFS, EPM, EVENTLOG, INITSHUTDOWN, MAPI, NT, PIPE, SAMR, SPOOLSS, SRVSVC, SVCCTL, WINREG), DCOM (DCOM, CBA-ACCO, SYSACT), DIAMETER, DISP, DNS, DOP, DSP, ESP, Ethernet, FC, FCP, GSM A, GSM MAP, GSM SMS, GSSAPI, GTP, H.225, H.245, H.248, HTTP, ICQ, IKE, ISAKMP, iSCSI, ISUP, IUUP, Kerberos 4, LAP-D, LDAP, LLC, LogotypeCertExtn, MEGACO, MIME Multipart, MIP6, MMS, MSRP, MTP3, NCP, NDMP, NDPS, NFS, NTP, OSI, PER, PN-MRP, PPP, 19154Q.931, RADIUS, Redback, RPC, RTCP, RTP, SCCP, SCSI, SDP, SIP, SMB, SMRSE, SNMP, SSL, STANAG 5066, STP, TCAP, TCP, TFTP, TIPC, UDP, UMA, VLAN, VNC, VRRP, X.509ce X11, YMSG, WTLS - Removed Protocols The CISCOWL dissector has been superseded by WLCCP. - New and Updated Capture File Support Catapult DCT2000, EyeSDN, iSeries
2006-11-01 13:59:42 +01:00
share/wireshark/dtds/rlmi.dtd
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/dtds/rss.dtd
share/wireshark/dtds/smil.dtd
share/wireshark/dtds/watcherinfo.dtd
Update "wireshark" package to version 0.99.3. Changes since 0.99.3: The following vulnerabilities have been fixed: o The SCSI dissector could crash. Versions affected: 0.99.2. o If Wireshark was compiled with ESP decryption support, the IPsec ESP preference parser was susceptible to off-by-one errors. Versions affected: 0.99.2. o If the SSCOP dissector has a port range configured and the SSCOP payload protocol is Q.2931, a malformed packet could make the Q.2931 dissector use up available memory. No port range is configured by default. Versions affected: 0.7.9 - 0.99.2. The following bugs have been fixed: o The VOIP call analysis feature could cause an assertion. o The RTP analysis feature could freeze for an extended period. o Selecting "Apply as Filter" wouldn't work for some tree items. New and Updated Features The following features are new (or have been significantly updated) since the last release: o The packet list context menu now includes a conversation filter. o Wireshark can now generate ACL rules for several popular firewall products. New Protocol Support Daytime, JPEG (RTP payload), Pegasus Lightweight Stream Control, Pro-MPEG FEC, UMTS RRC, Veritas Low Latency Transport Updated Protocol Support All ASN.1 dissectors, 3G A11, 802.11, AIM SST, AJP13, ANSI 637, AVS WLAN, BACapp, BFD, CDP, Cisco WIDS, DCERPC (DCERPC, CONV, DFS, EPM, FLDB, NETLOGON, NT, PN-IO, RS_PGO), DCOM, DHCP, DIAMETER, DTLS, EAPOL, ESP, H.225, H.245, H.450, HTTP, IPv6, ISAKMP, Juniper, Kerberos, L2TP, LDAP, MSRP, NTLMSSP, PN-CBA, PN-RT, Prism, RSVP, RTCP, RUDP, SCSI, SCTP, SDP, SIP, SIPFRAG, Skinny, SMB, SSL, TCP, text/media, Time, XML New and Updated Capture File Support Catapult DCT2000, nettl
2006-08-24 12:48:59 +02:00
share/wireshark/dtds/xcap-caps.dtd
Update "wireshark" package to version 0.99.7pre2. Changes since version 0.99.6: - Fixes for the security problems reported in "wnpa-sec-2007-03" - Most of the capture code has been moved out of the GUI, which means that Wireshark no longer needs to be run as root. - Many display filter names have been cleaned up. If your favorite display filter just went missing, please consult the display filter reference to find out where it ended up. - You can now filter directly on SNMP OIDs. - IO graphs have more display options, and you can now export graphs. - You can now follow UDP streams in addition to TCP and SSL streams. - You can now disable coloring rules without deleting them. - Main window toolbar buttons are now available even when the window is small. - Optimizations have been applied in some places to make Wireshark start up and run faster. - New Protocol Support ANSI TCAP, application/xcap-error (MIME type), CFM, DPNSS, EtherCAT, ETSI e2/e4, H.282, H.460, H.501, IEEE 802.1ad and 802.1ah, IMF (RFC 2822), RSL, SABP, T.125, TNEF, TPNCP, UNISTIM, Wake on LAN, WiMAX ASN Control Plane, X.224 - Updated Protocol Support 3Com XNS, 3G A11, ACN, ACP123, ACSE, AIM, ANSI IS-637-A, ANSI MAP, Armagetronad, BACapp, BACnet, BER, BFD, BGP, Bluetooth, CAMEL, CDT, CFM, CIP, Cisco ERSPAN, CLNP, CMIP, CMS, COPS, CTDB, DCCP, DCERPC ATSVC, DCERPC PNIO, DCERPC SAMR, DCERPC, DCOM CBA-ACCO, DCP ETSI, DEC DNA, DFS, DHCP/BOOTP, DHCPv6, DIAMETER, DISP, DMP, DNP, DNS, DOP, DTLS, DUA, eDonkey, ELSM, ESL, Ethernet, FC ELS, FC, FCOE, FTAM, FTP, GDSDB, GIOP, GPRS-LLC, GSM A, GSM MAP, GTP, HSRP, HTTP, IAX2, ICMPv6, IEEE 802.11, INAP, IP, IPMI, IPv6, ISAKMP, ISIS, iSNS, ISUP, IUUP, JXTA, K12, Kerberos, L2TP, LAPD, LDAP, LINX, LPD, LWAPP, MEGACO, MIKEY, MIME Multipart, MMS, MP2T, MPEG PES, MPEG, MTP2, MySQL, NBAP, NetFlow, nettl, NFS, NSIP, OSPF, P_MUL, PANA, PER, PKCS#12, PMIPv6, PN-PTCP, PN-RT, PPI, PPPoE, PRES, PROFINET, PTP, Q.932 ROS, Q.932, QSIG, Radiotap, RADIUS, RANAP, RNSAP, ROS, RTCP, RTP, RTSE, RTSP, SCCP, SCTP, SDP, SIGCOMP, SIP, Slow Protocols, SMB, SMPP, SMTP, SNDCP, SNMP, SRP, SSL, STANAG 4406, STUN2, TCAP, TCP, text/media, TIPC, ULP, UMA, UMTS FP, V5UA, VNC, WiMAX M2M, WiMAX, WLCCP, X.411, X.420, X.509 SAT, XML - New and Updated Capture File Support Catapult DCT 2000, Endace ERF, Juniper NetScreen snoop, Visual Networks, Windows Sniffer (NetXRay)
2007-12-15 14:53:27 +01:00
share/wireshark/dtds/xcap-error.dtd
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
share/wireshark/enterprises.tsv
Add a new option "lua" to enable support for Lua scripts and turn it on by default. Bump package revisions as the binary package changed. Suggested by Jonathan Kollasch in private e-mail.
2010-05-15 22:27:28 +02:00
${PLIST.lua}share/wireshark/init.lua
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
share/wireshark/ipmap.html
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/manuf
Update "wireshark" package to version 1.6.1. The major changes since version 1.4.* are: - Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets. - Large file (greater than 2 GB) support has been improved. - Wireshark and TShark can import text dumps, similar to text2pcap. - You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window. - Wireshark can export SSL session keys via File→Export→SSL Session Keys... - TShark can show a specific occurrence of a field when using '-T fields'. - Custom columns can show a specific occurrence of a field. - You can hide columns in the packet list. - Wireshark can now export SMB objects. - dftest and randpkt now have manual pages. - TShark can now display iSCSI, ICMP and ICMPv6 service response times. - Dumpcap can now save files with a user-specified group id. - Syntax checking is done for capture filters. - You can display the compiled BPF code for capture filters in the Capture Options dialog. - You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. . - Packet length is (finally) a default column. - TCP window size is now avaiable both scaled and unscaled. A TCP window scaling graph is available in the GUI. - 802.1q VLAN tags are now shown in the Ethernet II protocol tree instead of a separate tree. - Various dissectors now display some UTF-16 strings as proper Unicode including the DCE/RPC and SMB dissectors. - The RTP player now has an option to show the time of day in the graph in addition to the seconds since beginning of capture. - The RTP player now shows why media interruptions occur. - Graphs now save as PNG images by default. - TShark can read and write host name information from and to pcapng-formatted files. Wireshark can read it. TShark can dump host name information via [-z hosts] . - TShark's -z option now uses the [-z <proto>,srt] syntax instead of [-z <proto>,rtt] for all protocols that support service response time statistics. This matches Wireshark's syntax for this option. - Wireshark and TShark can now read compressed Windows Sniffer files. - New Protocol Support ADwin, ADwin-Config, Apache Etch, Aruba PAPI, Babel Routing Protocol, Broadcast/Multicast Control, Constrained Application Protocol (COAP), Digium TDMoE, Erlang Distribution Protocol, Ether-S-I/O, FastCGI, Fibre Channel over InfiniBand (FCoIB), Gopher, Gigamon GMHDR, IDMP, Infiniband Socket Direct Protocol (SDP), JSON, LISP Control, LISP Data, LISP, MikroTik MAC-Telnet, MRP Multiple Mac Registration Protocol (MMRP) Mongo Wire Protocol, MUX27010, Network Monitor 802.11 radio header, OPC UA ExtensionObjects, openSAFETY, PPI-GEOLOCATION-GPS, ReLOAD, ReLOAD Framing, RObust Header Compression (ROHC), RSIP, SAMETIME, SCoP, SGSAP, Tektronix Teklink, USB/AT Commands, uTorrent Transport Protocol, WAI authentication, Wi-Fi P2P (Wi-Fi Direct) - New and Updated Capture File Support Apple PacketLogger, Catapult DCT2000, Daintree SNA, Endace ERF, HP OpenVMS TCPTrace, IPFIX (the file format, not the protocol), Lucent/Ascend debug, Microsoft Network Monitor, Network Instruments, TamoSoft CommView
2011-07-20 20:42:44 +02:00
share/wireshark/pdml2html.xsl
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/profiles/Bluetooth/colorfilters
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
share/wireshark/profiles/Bluetooth/preferences
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/profiles/Classic/colorfilters
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
share/wireshark/profiles/No Reassembly/preferences
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/README.radius_dictionary
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/radius/custom.includes
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary
share/wireshark/radius/dictionary.3com
share/wireshark/radius/dictionary.3gpp
share/wireshark/radius/dictionary.3gpp2
share/wireshark/radius/dictionary.acc
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.acme
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.actelis
share/wireshark/radius/dictionary.aerohive
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.airespace
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.alcatel
Update to wireshark-1.12.7. Full ChangeLog since 1.10.14 is too long to include. A few highlights: - Expert information is now filterable when the new API is in use. - "malformed" display filter has been renamed to "_ws.malformed". - Transport name resolution is now disabled by default. - Support has been added for all versions of the DCBx protocol. - Cleanup of LLDP code, all dissected fields are now navigable. - Dissector output may be encoded as UTF-8. This includes TShark output. - The ASN1 plugin has been removed as it s deemed obsolete. - The GNM dissector has been removed as it was never used. - The Kerberos dissector has been replaced by one generated from ASN1 code. - A more flexible, modular memory manager (wmem) has been added. - A new API for expert information has been added, replacing the old one. - The tvbuff API has been cleaned up. - Support for 80+ new protocols
2015-09-12 21:03:59 +02:00
share/wireshark/radius/dictionary.alcatel-lucent.aaa
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.alcatel.esam
share/wireshark/radius/dictionary.alcatel.sr
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.alteon
share/wireshark/radius/dictionary.altiga
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.alvarion
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.alvarion.wimax.v2_2
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.apc
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/radius/dictionary.aptilo
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.aptis
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.arbor
Update "wireshark" package to version 1.0.6. Changes between 1.0.5 and 1.0.6.: - The following vulnerabilities have been fixed: * On non-Windows systems, Wireshark could crash if the HOME environment variable contained sprintf-style string formatting characters. * Wireshark could crash while reading a malformed NetScreen snoop file. * Wireshark could crash while reading a Tektronix K12 text capture file. - The following bugs have been fixed: * Crash when loading capture file and Preferences: NO Info column * Some Lua scripts may lead to corruption via out of bounds stack * Build with GLib 1.2 fails with error: 'G_MININT32' undeclared * Wrong decoding IMSI with GSM MAP protocol * Segmentation fault for "Follow TCP stream" (Bug 3119) * SMPP optional parameter 'network_error_code' incorrectly decoded * DHCPv6 dissector doesn't handle malformed FQDN * WCCP overrides CFLOW as decoded protocol (Bug 3175) * Improper decoding of MPLS echo reply IPv4 Interface and Label Stack Object * ANSI MAP fix for TRN digits/SMS and OTA subdissection (Bug 3214) - Updated Protocol Support * AFS, ATM, DHCPv6, DIS, E.212, RTP, UDP, USB, WCCP, WPS - New and Updated Capture File Support * NetScreen snoop Changes between version 1.0.4 and 1.0.5: - The following vulnerabilities have been fixed. See the security advisory for details and a workaround. * The SMTP dissector could consume excessive amounts of CPU and memory. * The WLCCP dissector could go into an infinte loop. - The following bugs have been fixed: * Missing CRLF during HTTP POST in the "packet details" window * Memory assertion in time_secs_to_str_buf() when compiled with GCC 4.2.3 * Diameter dissector fails RFC 4005 compliance * LDP vendor private TLV type is not correctly shown * Wireshark on MacOS does not run when there are spaces in its path * Compilation broke when compiling without zlib * Memory leak: saved_repoid * Memory leak: follow_info * Memory leak: follow_info * Memory leak: tacplus_data * Memory leak: col_arrows * Memory leak: col_arrows * Incorrect address structure assigned for find_conversation() in WSP * Memory leak with unistim in voip_calls * Error parsing the BSSGP protocol * Assertion thrown in fvalue_get_uinteger when decoding TIPC * LUA script : Wireshark crashes after closing and opening again a window used by a listener.draw() function. - Updated Protocol Support * ANSI MAP, BSSGP, CIP, Diameter, ENIP, GIOP, H.263, H.264, HTTP, MPEG PES * PostgreSQL, PPI, PTP, Rsync, RTP, SMTP, SNMP, STANAG 5066, TACACS, TIPC * WLCCP, WSP The package update was provided by Matthias Drochner in private e-mail.
2009-02-13 10:41:11 +01:00
share/wireshark/radius/dictionary.aruba
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.ascend
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.asn
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.audiocodes
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.avaya
share/wireshark/radius/dictionary.azaire
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.bay
share/wireshark/radius/dictionary.bintec
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.bluecoat
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.bristol
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.broadsoft
share/wireshark/radius/dictionary.brocade
share/wireshark/radius/dictionary.bskyb
share/wireshark/radius/dictionary.bt
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.cablelabs
share/wireshark/radius/dictionary.cabletron
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.camiant
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.chillispot
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.cisco
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.cisco.asa
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.cisco.bbsm
share/wireshark/radius/dictionary.cisco.vpn3000
share/wireshark/radius/dictionary.cisco.vpn5000
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.citrix
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.clavister
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/radius/dictionary.cnergee
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.colubris
share/wireshark/radius/dictionary.columbia_university
share/wireshark/radius/dictionary.compat
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.compatible
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.cosine
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.dante
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/radius/dictionary.dellemc
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.dhcp
share/wireshark/radius/dictionary.digium
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.dlink
share/wireshark/radius/dictionary.dragonwave
share/wireshark/radius/dictionary.efficientip
Update "wireshark" package to version 1.6.1. The major changes since version 1.4.* are: - Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets. - Large file (greater than 2 GB) support has been improved. - Wireshark and TShark can import text dumps, similar to text2pcap. - You can now view Wireshark's dissector tables (for example the TCP port to dissector mappings) from the main window. - Wireshark can export SSL session keys via File→Export→SSL Session Keys... - TShark can show a specific occurrence of a field when using '-T fields'. - Custom columns can show a specific occurrence of a field. - You can hide columns in the packet list. - Wireshark can now export SMB objects. - dftest and randpkt now have manual pages. - TShark can now display iSCSI, ICMP and ICMPv6 service response times. - Dumpcap can now save files with a user-specified group id. - Syntax checking is done for capture filters. - You can display the compiled BPF code for capture filters in the Capture Options dialog. - You can now navigate backwards and forwards through TCP and UDP sessions using Ctrl+, and Ctrl+. . - Packet length is (finally) a default column. - TCP window size is now avaiable both scaled and unscaled. A TCP window scaling graph is available in the GUI. - 802.1q VLAN tags are now shown in the Ethernet II protocol tree instead of a separate tree. - Various dissectors now display some UTF-16 strings as proper Unicode including the DCE/RPC and SMB dissectors. - The RTP player now has an option to show the time of day in the graph in addition to the seconds since beginning of capture. - The RTP player now shows why media interruptions occur. - Graphs now save as PNG images by default. - TShark can read and write host name information from and to pcapng-formatted files. Wireshark can read it. TShark can dump host name information via [-z hosts] . - TShark's -z option now uses the [-z <proto>,srt] syntax instead of [-z <proto>,rtt] for all protocols that support service response time statistics. This matches Wireshark's syntax for this option. - Wireshark and TShark can now read compressed Windows Sniffer files. - New Protocol Support ADwin, ADwin-Config, Apache Etch, Aruba PAPI, Babel Routing Protocol, Broadcast/Multicast Control, Constrained Application Protocol (COAP), Digium TDMoE, Erlang Distribution Protocol, Ether-S-I/O, FastCGI, Fibre Channel over InfiniBand (FCoIB), Gopher, Gigamon GMHDR, IDMP, Infiniband Socket Direct Protocol (SDP), JSON, LISP Control, LISP Data, LISP, MikroTik MAC-Telnet, MRP Multiple Mac Registration Protocol (MMRP) Mongo Wire Protocol, MUX27010, Network Monitor 802.11 radio header, OPC UA ExtensionObjects, openSAFETY, PPI-GEOLOCATION-GPS, ReLOAD, ReLOAD Framing, RObust Header Compression (ROHC), RSIP, SAMETIME, SCoP, SGSAP, Tektronix Teklink, USB/AT Commands, uTorrent Transport Protocol, WAI authentication, Wi-Fi P2P (Wi-Fi Direct) - New and Updated Capture File Support Apple PacketLogger, Catapult DCT2000, Daintree SNA, Endace ERF, HP OpenVMS TCPTrace, IPFIX (the file format, not the protocol), Lucent/Ascend debug, Microsoft Network Monitor, Network Instruments, TamoSoft CommView
2011-07-20 20:42:44 +02:00
share/wireshark/radius/dictionary.eltex
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
share/wireshark/radius/dictionary.enterasys
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.epygi
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.equallogic
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.ericsson
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.ericsson.ab
share/wireshark/radius/dictionary.ericsson.packet.core.networks
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.extreme
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.f5
share/wireshark/radius/dictionary.fdxtended
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.fortinet
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.foundry
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.freedhcp
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.freeradius
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.freeradius.internal
share/wireshark/radius/dictionary.freeswitch
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.gandalf
share/wireshark/radius/dictionary.garderos
share/wireshark/radius/dictionary.gemtek
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.h3c
share/wireshark/radius/dictionary.hp
share/wireshark/radius/dictionary.huawei
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.iana
wireshark: updated to 3.4.0 Wireshark 3.4.0 New and Updated Features The following features are new (or have been significantly updated) since version 3.4.0rc1: Nothing of note. The following features are new (or have been significantly updated) since version 3.3.1: The Protobuf fields defined as google.protobuf.Timestamp type of Protobuf standard library can now be dissected as Wireshark fields of absolute time type. The following features are new (or have been significantly updated) since version 3.3.0: The Windows installers now ship with Npcap 1.00. They previously shipped with Npcap 0.9997. The Windows installers now ship with Qt 5.15.1. They previously shipped with Qt 5.12.8. The following features are new (or have been significantly updated) since version 3.2.0: Windows executables and installers are now signed using SHA-2 only. Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. Asynchronous DNS resolution is always enabled. As a result, the c-ares library is now a required dependency. Protobuf fields can be dissected as Wireshark (header) fields that allows user input the full names of Protobuf fields or messages in Filter toolbar for searching. Dissectors based on Protobuf can register themselves to a new 'protobuf_field' dissector table, which is keyed with the full names of fields, for further parsing fields of BYTES or STRING type. Wireshark is able to decode, play, and save iLBC payload on platforms where the iLBC library is available. Wireshark is able to decode, play, and save opus payload on platforms where the opus library is available. “Decode As” entries can now be copied from other profiles using a button in the dialog. sshdump can now be copied to multiple instances. Each instance will show up a different interface and will have its own profile. The main window now supports a packet diagram view, which shows each packet as a textbook-style diagram. Filter buttons (“Preferences → Filter Buttons”) can be grouped by using “//” as a path separator in the filter button label. IPP Over USB packets can now be dissected and displayed New Protocol Support Arinc 615A (A615A), Asphodel Protocol, AudioCodes Debug Recording (ACDR), Bluetooth HCI ISO (BT HCI ISO), Cisco MisCabling Protocol (MCP), Community ID Flow Hashing (CommunityID), DCE/RPC IRemoteWinspool SubSystem, (IREMOTEWINSPOOL), Dynamic Link Exchange Protocol (DLEP), EAP Generalized Pre-Shared Key (EAP-GPSK), EAP Password Authenticated Exchange (EAP-PAX), EAP Pre-Shared Key (EAP-PSK), EAP Shared-secret Authentication and Key Establishment (EAP-SAKE), Fortinet Single Sign-on (FSSO), FTDI Multi-Protocol Synchronous Serial Engine (FTDI MPSSE), Hypertext Transfer Protocol Version 3 (HTTP3), ILDA Digital Network (IDN), Java Debug Wire Protocol (JDWP), LBM Stateful Resolution Service (LBMSRS), Lithionics Battery Management, .NET Message Framing Protocol (MC-NMF), .NET NegotiateStream Protocol (MS-NNS), OBSAI UDP-based Communication Protocol (UDPCP), Palo Alto Heartbeat Backup (PA-HB-Bak), ScyllaDB RPC, Technically Enhanced Capture Module Protocol (TECMP), Tunnel Extensible Authentication Protocol (TEAP), UDP based FTP w/ multicast V5 (UFTP5), and USB Printer (USBPRINTER) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support MP4 (ISO/IEC 14496-12)
2020-11-12 22:05:20 +01:00
share/wireshark/radius/dictionary.identity_engines
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.iea
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.infoblox
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.infonet
share/wireshark/radius/dictionary.ipunplugged
share/wireshark/radius/dictionary.issanni
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.itk
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.jradius
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.juniper
share/wireshark/radius/dictionary.karlnet
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.kineto
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.lancom
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.livingston
share/wireshark/radius/dictionary.localweb
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.lucent
share/wireshark/radius/dictionary.manzara
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.meinberg
wireshark: updated to 3.2.0 Wireshark 3.2.0 What’s New This is the last release branch with official support for Windows 7 and Windows Server 2008 R2. Many improvements have been made. See the “New and Updated Features” section below for more details. New and Updated Features The following features are new (or have been significantly updated) since version 3.2.0rc2: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.2.0rc1: • Minor bug fixes. The following features are new (or have been significantly updated) since version 3.1.1: • Miscellaneous UI fixes and updates. • The macOS installer now ships with Qt 5.12.6. It previously shipped with Qt 5.12.5. The following features are new (or have been significantly updated) since version 3.1.0: • Automatic updates are supported on macOS. • You can now select multiple packets in the packet list at the same time • They can be exported as Text by “Ctrl+C” or “Cmd+C” and the corresponding menu in “Edit › Copy › As …<U+200B>” • They can be marked/unmarked or ignored/unignored at the same time • They can be exported and printed using the corresponding menu entries “File › Export Specified Packets”, “File › Export Packet Dissections” and “File › Print” You can now follow HTTP/2 and QUIC streams. You can once again mark and unmark packets using the middle mouse button. This feature went missing around 2009 or so. The Windows packages are now built using Microsoft Visual Studio 2019. IOGraph automatically adds a graph for the selected display filter if no previous graph exists Action buttons for the display filter bar may be aligned left via the context menu • The "Expression…<U+200B>" toolbar entry has been moved to "Analyze › Display filter Expression …<U+200B>" as well as to the context menu of the display filter toolbar Allow extcaps to be loaded from the personal configuration directory The Wireshark 3.1.0 Windows installers ship with Qt 5.12.6. Previous installers shipped with Qt 5.12.4. The following features are new (or have been significantly updated) since version 3.0.0: • You can drag and drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as “Apply Filter” • You can drag and drop a column entry to the display filter to create a filter for it. • You can import profiles from a .zip archive or an existing directory. • Dark mode support on macOS and dark theme support on other platforms has been improved. • Brotli decompression support in HTTP/HTTP2 (requires the brotli library). • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback. • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571[1]). • A new tap for extracting credentials from the capture file has been added. It can be accessed through the -z credentials option in tshark or from the “Tools › Credentials” menu in Wireshark. • Editcap can now split files on floating point intervals. • Windows .msi packages are now signed using SHA-2[2]. .exe installers are still dual-signed using SHA-1 and SHA-2. • The “Enabled Protocols” Dialog now only enables, disables and inverts protocols based on the set filter selection. The protocol type (standard or heuristic) may also be choosen as a filter value. • Save RTP stream to .au supports any codec with 8000 Hz rate supported by Wireshark (shown in RTP player). If save of audio is not possible (unsupported codec or rate), silence of same length is saved and warning is shown. • The “Analyze › Apply as Filter” and “Analyze › Prepare a Filter” packet list and detail popup menus now show a preview of their respective filters. • Protobuf files (*.proto) can now be configured to enable more precise parsing of serialized Protobuf data (such as gRPC). • HTTP2 support streaming mode reassembly. To use this feature, subdissectors can register itself to "streaming_content_type" dissector table and return pinfo→desegment_len and pinfo→desegment_offset to tell HTTP2 when to start and how many additional bytes requires when next called. • The message of stream gRPC method can now be parsed with supporting of HTTP2 streaming mode reassembly feature. • The Wireshark 3.1.0 Windows installers ship with Qt 5.12.4. Previous installers shipped with Qt 5.12.1. New Protocol Support 3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Asynchronous Management Protocol (AMP), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Diagnostic Log and Trace (DLT), Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), ITS message - CAMv1, ITS message - DENMv1, Linux net_dm (network drop monitor) protocol, MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, NVM Express over Fabrics for TCP (nvme-tcp), OsmoTRX Protocol (GSM Transceiver control and data), Scalable service-Oriented MiddlewarE over IP (SOME/IP), USB 2.0 Link Layer (USBLL), and Wi-Fi Neighbour Awareness Networking (NAN) Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support 3gpp phone, Android Logcat Text, Ascend, Busmaster log file, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek
2019-12-30 18:48:05 +01:00
share/wireshark/radius/dictionary.meraki
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.merit
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.meru
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/radius/dictionary.microsemi
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.microsoft
share/wireshark/radius/dictionary.mikrotik
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.motorola
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.motorola.wimax
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.navini
share/wireshark/radius/dictionary.netscreen
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.networkphysics
share/wireshark/radius/dictionary.nexans
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.nokia
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.nokia.conflict
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.nomadix
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.nortel
share/wireshark/radius/dictionary.ntua
share/wireshark/radius/dictionary.openser
share/wireshark/radius/dictionary.packeteer
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.paloalto
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.patton
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.perle
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.propel
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.prosoft
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.proxim
share/wireshark/radius/dictionary.purewave
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.quiconnect
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.quintum
share/wireshark/radius/dictionary.redcreek
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.rfc2865
share/wireshark/radius/dictionary.rfc2866
share/wireshark/radius/dictionary.rfc2867
share/wireshark/radius/dictionary.rfc2868
share/wireshark/radius/dictionary.rfc2869
share/wireshark/radius/dictionary.rfc3162
share/wireshark/radius/dictionary.rfc3576
share/wireshark/radius/dictionary.rfc3580
share/wireshark/radius/dictionary.rfc4072
share/wireshark/radius/dictionary.rfc4372
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.rfc4603
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.rfc4675
share/wireshark/radius/dictionary.rfc4679
share/wireshark/radius/dictionary.rfc4818
share/wireshark/radius/dictionary.rfc4849
share/wireshark/radius/dictionary.rfc5090
share/wireshark/radius/dictionary.rfc5176
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/radius/dictionary.rfc5447
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.rfc5580
share/wireshark/radius/dictionary.rfc5607
share/wireshark/radius/dictionary.rfc5904
Changes 1.10.0: Wireshark on 32- and 64-bit Windows supports automatic updates. The packet bytes view is faster. You can now display a list of resolved host names in "hosts" format within Wireshark. The wireless toolbar has been updated. Wireshark on Linux does a better job of detecting interface addition and removal. It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work. The Windows installers ship with WinPcap 4.1.3, which supports Windows 8. USB type and product name support has been improved. All Bluetooth profiles and protocols are now supported. Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added. The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes. Capinfos now prints human-readable statistics with SI suffixes by default. It is now possible to open a referenced packet (such as the matched request or response packet) in a new window. Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x. Wireshark can be compiled using GTK+ 3. The Wireshark application icon, capture toolbar icons, and other icons have been updated. Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y. Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway. Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add "gtk-scrolled-window-placement = top-right" in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini). Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules. The LOAD() metric in the IO-graph now shows the load in IO units instead of thousands of IO units.
2013-07-04 23:33:14 +02:00
share/wireshark/radius/dictionary.rfc6519
share/wireshark/radius/dictionary.rfc6572
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.rfc6677
share/wireshark/radius/dictionary.rfc6911
share/wireshark/radius/dictionary.rfc6929
share/wireshark/radius/dictionary.rfc6930
share/wireshark/radius/dictionary.rfc7055
share/wireshark/radius/dictionary.rfc7155
share/wireshark/radius/dictionary.rfc7268
share/wireshark/radius/dictionary.rfc7499
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/radius/dictionary.rfc7930
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.riverbed
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.riverstone
share/wireshark/radius/dictionary.roaringpenguin
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.ruckus
share/wireshark/radius/dictionary.ruggedcom
Updated wireshark to 2.2.0. What's New Bug Fixes * Upgrading to latest version uninstalls Microsoft Visual C++ redistributable. ([1]Bug 12712) * Extcap errors not reported back to UI. ([2]Bug 11892) New and Updated Features The following features are new (or have been significantly updated) since version 2.2.0rc1: "Decode As" supports SSL (TLS) over TCP. The following features are new (or have been significantly updated) since version 2.1.1: * Invalid coloring rules are now disabled instead of discarded. This will provide backward compatibility with a coloring rule change in Wireshark 2.2. The following features are new (or have been significantly updated) since version 2.1.0: * Added -d option for Decode As support in Wireshark (mimics TShark functionality) * The Qt UI, GTK+ UI, and TShark can now export packets as JSON. TShark can additionally export packets as Elasticsearch-compatible JSON. * The Qt UI now supports the -j, -J, and -l flags. The -m flag is now deprecated. * The Conversations and Endpoints dialogs are more responsive when viewing large numbers of items. * The RTP player now allows up to 30 minutes of silence frames. * Packet bytes can now be displayed as EBCDIC. * The Qt UI loads captures faster on Windows. * proto_tree_add_checksum was added as an API. This attempts to standardize how checksums are reported and filtered for within *Shark. There are no more individual "good" and "bad" filter fields, protocols now have a "checksum.status" field that records "Good", "Bad" and "Unverified" (neither good or bad). Color filters provided with Wireshark have been adjusted to the new display filter names, but custom ones may need to be updated. The following features are new (or have been significantly updated) since version 2.0.0: * The intelligent scroll bar now sits to the left of a normal scroll bar and provides a clickable map of nearby packets. * You can now switch between between Capture and File Format dissection of the current capture file via the View menu in the Qt GUI. * You can now show selected packet bytes as ASCII, HTML, Image, ISO 8859-1, Raw, UTF-8, a C array, or YAML. * You can now use regular expressions in Find Packet and in the advanced preferences. * Name resolution for packet capture now supports asynchronous DNS lookups only. Therefore the "concurrent DNS resolution" preference has been deprecated and is a no-op. To enable DNS name resolution some build dependencies must be present (currently c-ares). If that is not the case DNS name resolution will be disabled (but other name resolution mechanisms, such as host files, are still available). * The byte under the mouse in the Packet Bytes pane is now highlighted. * TShark supports exporting PDUs via the -U flag. * The Windows and OS X installers now come with the "sshdump" and "ciscodump" extcap interfaces. * Most dialogs in the Qt UI now save their size and positions. * The Follow Stream dialog now supports UTF-16. * The Firewall ACL Rules dialog has returned. * The Flow (Sequence) Analysis dialog has been improved. * We no longer provide packages for 32-bit versions of OS X. * The Bluetooth Device details dialog has been added. New File Format Decoding Support Wireshark is able to display the format of some types of files (rather than displaying the contents of those files). This is useful when you're curious about, or debugging, a file and its format. To open a capture file (such as PCAP) in this mode specify "MIME Files Format" as the file's format in the Open File dialog. New Protocol Support Apache Cassandra - CQL version 3.0, Bachmann bluecom Protocol, Bluetooth Pseudoheader for BR/EDR, Cisco ERSPAN3 Marker, Cisco ttag, Digital Equipment Corporation Local Area Transport, Distributed Object Framework, DOCSIS Upstream Channel Descriptor Type 35, Edge Control Protocol (ECP), Encrypted UDP based FTP with multicast, Ericsson IPOS Kernel Packet Header Dissector Added (IPOS), Extensible Control & Management Protocol (eCMP), FLEXRAY Protocol dissector added (automotive bus), IEEE 802.1BR E-Tag, Intel Omni-Path Architecture, ISO 8583-1, ISO14443, ITU-T G.7041/Y.1303 Generic Framing Procedure (GFP), LAT protocol (DECNET), Metamako trailers, Network Service Header for Ethernet & GRE, Network-Based IP Flow Mobility (NBIFOM), Nokia Intelligent Service Interface (ISI), Open Mobile Alliance Lightweight Machine to Machine TLV payload Added (LwM2M TLV), Real Time Location System (RTLS), RTI TCP Transport Layer (RTITCP), SMB Witness Service, STANAG 5602 SIMPLE, Standard Interface for Multiple Platform Link Evaluation (SIMPLE), USB3 Vision Protocol (USB machine vision cameras), USBIP Protocol, UserLog Protocol, and Zigbee Protocol Clusters Dissectors Added (Closures Lighting General Measurement & Sensing HVAC Security & Safety) Updated Protocol Support Bluetooth OBEX dissector (btobex) was renamed to Obex Dissector (obex), allow to DecodeAs it over USB, TCP and UDP. A preference was added to TCP dissector for handling IPFIX process information. It has been disabled by default. New and Updated Capture File Support Micropross mplog New and Updated Capture Interfaces support Non-empty section placeholder. Major API Changes The libwireshark API has undergone some major changes: * The address macros (e.g., SET_ADDRESS) have been removed. Use the (lower case) functions of the same names instead. * "old style" dissector functions (that don't return number of bytes used) have been replaced in name with the "new style" dissector functions. * tvb_get_string and tvb_get_stringz have been replaced with tvb_get_string_enc and tvb_get_stringz_enc respectively.
2016-09-12 12:59:55 +02:00
share/wireshark/radius/dictionary.sangoma
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.sg
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.shasta
share/wireshark/radius/dictionary.shiva
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.siemens
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.slipstream
share/wireshark/radius/dictionary.sofaware
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.sonicwall
share/wireshark/radius/dictionary.springtide
Update "wireshark" package to version 1.2.1. Changes since version 1.0.8: New features: - Wireshark has a spiffy new start page. - Display filters now autocomplete. - Support for the c-ares resolver library has been added. It has many - advantages over ADNS. - Many new protocol dissectors and capture file formats have been added. - Macintosh OS X support has been improved. - GeoIP database lookups. - OpenStreetMap + GeoIP integration. - Improved Postscript(R) print output. - The preference handling code is now much smarter about changes. - Support for Pcap-ng, the next-generation capture file format. - Support for process information correlation via IPFIX. - Column widths are now saved. - The last used configuration profile is now saved. - Protocol preferences are changeable from the packet details context menu. - Support for IP packet comparison. - Capinfos now shows the average packet rate. Security fixes: - The AFS dissector could crash. - The Infiniband dissector could crash on some platforms.
2009-07-21 22:39:41 +02:00
share/wireshark/radius/dictionary.starent
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.starent.vsa1
share/wireshark/radius/dictionary.surfnet
share/wireshark/radius/dictionary.symbol
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.t_systems_nova
share/wireshark/radius/dictionary.telebit
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.telkom
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.terena
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.trapeze
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.travelping
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.tropos
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.ukerna
Update to 2.4.3 Changelog: Bug Fixes The following bugs have been fixed: wnpa-sec-2017-47 The IWARP_MPA dissector could crash. (Bug 14236) wnpa-sec-2017-48 The NetBIOS dissector could crash. (Bug 14249) wnpa-sec-2017-49 The CIP Safety dissector could crash. (Bug 14250) "tshark -G ?" doesn't provide expected help. (Bug 13984) File loading is very slow with TRANSUM dissector enabled. (Bug 14094) packet-knxnetip.c:936: bad bitmask ?. (Bug 14115) packet-q931.c:1306: bad compare ?. (Bug 14116) SSL Dissection bug. (Bug 14117) Wireshark crashes when exporting various files to .csv, txt and other 'non-capture file' formats. (Bug 14128) RLC reassembly doesn't work for RLC over UDP heuristic dissector. Bug 14129) HTTP Object export fails with long extension (possibly query string). (Bug 14130) 3GPP Civic Address not displayed in Packet Details. (Bug 14131) Wireshark prefers packet.dll in System32\\Npcap over the one in System32. (Bug 14134) PEEKREMOTE dissector does not decode 11ac MCS rates properly. (Bug 14136) Visual Studio Community Edition 2015 lacks tools named in developer guide. (Bug 14147) TCP: Malformed data with Riverbed Probe option. (Bug 14150) Wireshark Crash when trying to use Preferences | Advanced. (Bug 14157) Right click on SMB2 Message ID and then Apply as Column causes Runtime Error. (Bug 14169) Return [Enter] should apply change (Column title - Button Label toolbars). (Bug 14191) Wireshark crashes if "rip.display_routing_domain" is set to TRUE in preferences file. (Bug 14197) Entry point inflatePrime not found for androiddump.exe and randpktdump.exe. (Bug 14207) BGP: IPv6 NLRI is received with Add-path ID, then Wire shark is not able to decode the packet correctly. (Bug 14241) Wrong SSL decryption when using EXTENDED MASTER SECRET and Client certificate request (mutual authentication). (Bug 14243) Frame direction isn't always set if it comes from the pcapng record header rather than the packet pseudo-header. (Bug 14245) Updated Protocol Support 3GPP NAS, BGP, CIP Safety, DTLS, IEEE 802.11 Radio, IWARP_MPA, KNXnet/IP, LCSAP, MQTT, NetBIOS, PEEKREMOTE, Q.931, RIP, RLC, SIP, SSL/TLS, TCP, and TRANSUM
2018-01-03 12:09:41 +01:00
share/wireshark/radius/dictionary.unisphere
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.unix
share/wireshark/radius/dictionary.usr
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.utstarcom
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.valemount
wireshark: updated to 3.0.1 3.0.1: The Windows installers now ship with Npcap 0.992. They previously shipped with Npcap 0.99-r9. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2019-09 NetScaler file parser crash. Bug 15497. CVE-2019-10895. wnpa-sec-2019-10 SRVLOC dissector crash. Bug 15546. CVE-2019-10899. wnpa-sec-2019-11 IEEE 802.11 dissector infinite loop. Bug 15553. CVE-2019-10897. wnpa-sec-2019-12 GSUP dissector infinite loop. Bug 15585. CVE-2019-10898. wnpa-sec-2019-13 Rbm dissector infinite loop. Bug 15612. CVE-2019-10900. wnpa-sec-2019-14 GSS-API dissector crash. Bug 15613. CVE-2019-10894. wnpa-sec-2019-15 DOF dissector crash. Bug 15617. CVE-2019-10896. wnpa-sec-2019-16 TSDNS dissector crash. Bug 15619. CVE-2019-10902. wnpa-sec-2019-17 LDSS dissector crash. Bug 15620. CVE-2019-10901. wnpa-sec-2019-18 DCERPC SPOOLSS dissector crash. Bug 15568. CVE-2019-10903. The following bugs have been fixed: [oss-fuzz] UBSAN: shift exponent 34 is too large for 32-bit type 'guint32' (aka 'unsigned int') in packet-ieee80211.c:15534:49. Bug 14770. [oss-fuzz] UBSAN: shift exponent 35 is too large for 32-bit type 'int' in packet-couchbase.c:1674:37. Bug 15439. Duplicated TCP SEQ field in ICMP packets. Bug 15533. Wrong length in dhcpv6 NTP Server suboption results in "Malformed Packet" and breaks further dissection. Bug 15542. Wireshark’s speaker-to-MaxMind is burning up the CPU. Bug 15545. GSM-A-RR variable bitmap decoding may report ARFCNs > 1023. Bug 15549. Import hexdump dummy Ethernet header generation ignores direction indication. Bug 15561. %T not supported for timestamps. Bug 15565. LWM2M: resource with \r\n badly shown. Bug 15572. When selecting BSSAP in 'Decode As' for a SCCP payload, it uses BSSAP+ which is not the same protocol. Bug 15578. Possible buffer overflow in function ssl_md_final for crafted SSL 3.0 sessions. Bug 15599. Windows console log output delay. Bug 15605. Syslog dissector processes the UTF-8 BOM incorrectly. Bug 15607. NFS/NLM: Wrong lock byte range in the "Info" column. Bug 15608. randpkt -r causes segfault when count > 1. Bug 15627. Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition. Bug 15628. Packets with metadata but no data get the Protocol Info column overwritten. Bug 15630. BGP MP_REACH_NLRI AFI: Layer-2 VPN, SAFI: EVPN - Label stack not decoded. Bug 15631. Buildbot crash output: fuzz-2019-03-23-1789.pcap. Bug 15634. Typo: broli → brotli. Bug 15647. Wrong dissection of GTPv2 MM Context Used NAS integrity protection algorithm. Bug 15648. Windows CHM (help file) title displays quoted HTML characters. Bug 15656. Unable to load 3rd party plugins not signed by Wireshark’s codesigning certificate. Bug 15667. 3.0.0: Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Support for a number of legacy features and libraries has been removed. See the “Removed Features and Support” section below for more details. Bug Fixes The following bugs have been fixed: Data following a TCP ZeroWindowProbe is marked as retransmission and not passed to subdissectors (Bug 15427) Lua Error on startup: init.lua: dofile has been disabled due to running Wireshark as superuser (Bug 15489). Text and Image columns were handled incorrectly for TDS 7.0 and 7.1. (Bug 3098) Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419) The following features are new (or have been significantly updated) since version 3.0.0rc1: The IP map feature (the “Map” button in the “Endpoints” dialog) has been added back in a modernized form (Bug 14693). The macOS package now ships with Qt 5.12.1. Previously it shipped with Qt 5.9.7. The macOS package requires version 10.12 or later. If you’re running an older version of macOS, please use Wireshark 2.6. The following features are new (or have been significantly updated) since version 2.9.0: Wireshark now supports the Swedish and Ukrainian languages. Initial support for using PKCS #11 tokens for RSA decryption in TLS. This can be configured at Preferences, RSA Keys. The build system now produces reproducible builds (Bug 15163). The Windows installers now ship with Qt 5.12.1. Previously they shipped with Qt 5.12.0. The following features are new (or have been significantly updated) since version 2.6.0: The Windows .exe installers now ship with Npcap instead of WinPcap. Besides being actively maintained (by the nmap project), Npcap brings support for loopback capture and 802.11 WiFi monitor mode capture (if supported by the NIC driver). Conversation timestamps are supported for UDP/UDP-Lite protocols TShark now supports the -G elastic-mapping option which generates an ElasticSearch mapping file. The “Capture Information” dialog has been added back (Bug 12004). The Ethernet and IEEE 802.11 dissectors no longer validate the frame check sequence (checksum) by default. The TCP dissector gained a new “Reassemble out-of-order segments” preference to fix dissection and decryption issues in case TCP segments are received out-of-order. See the User’s Guide, chapter TCP Reassembly for details. Decryption support for the new WireGuard dissector (Bug 15011, requires Libgcrypt 1.8). The BOOTP dissector has been renamed to DHCP. With the exception of “bootp.dhcp”, the old “bootp.*” display filter fields are still supported but may be removed in a future release. The SSL dissector has been renamed to TLS. As with BOOTP the old “ssl.*” display filter fields are supported but may be removed in a future release. Coloring rules, IO graphs, Filter Buttons and protocol preference tables can now be copied from other profiles using a button in the corresponding configuration dialogs. APT-X has been renamed to aptX. When importing from hex dump, it’s now possible to add an ExportPDU header with a payload name. This calls the specific dissector directly without lower protocols. The sshdump and ciscodump extcap interfaces can now use a proxy for the SSH connection. Dumpcap now supports the -a packets:NUM and -b packets:NUM options. Wireshark now includes a “No Reassembly” configuration profile. Wireshark now supports the Russian language. The build system now supports AppImage packages. The Windows installers now ship with Qt 5.12.0. Previously they shipped with Qt 5.9.7. Support for DTLS and TLS decryption using pcapng files that embed a Decryption Secrets Block (DSB) containing a TLS Key Log (Bug 15252). The editcap utility gained a new --inject-secrets option to inject an existing TLS Key Log file into a pcapng file. A new dfilter function string() has been added. It allows the conversion of non-string fields to strings so string functions (as contains and matches) can be used on them. The Bash test suite has been replaced by one based on Python unittest/pytest. The custom window title can now show file path of the capture file and it has a conditional separator. Removed Features and Support The legacy (GTK+) user interface has been removed and is no longer supported. The portaudio library is no longer needed due to the removal of GTK+. Wireshark requires Qt 5.2 or later. Qt 4 is no longer supported. Wireshark requires GLib 2.32 or later. Wireshark requires GnuTLS 3.2 or later as optional dependency. Building Wireshark requires Python 3.4 or newer, Python 2.7 is unsupported. Building Wireshark requires CMake. Autotools is no longer supported. TShark’s -z compare option was removed. Building with Cygwin is no longer supported on Windows.
2019-05-06 11:36:47 +02:00
share/wireshark/radius/dictionary.verizon
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.versanet
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.vqp
share/wireshark/radius/dictionary.walabi
share/wireshark/radius/dictionary.waverider
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.wichorus
Update "wireshark" package to version 1.2.1. Changes since version 1.0.8: New features: - Wireshark has a spiffy new start page. - Display filters now autocomplete. - Support for the c-ares resolver library has been added. It has many - advantages over ADNS. - Many new protocol dissectors and capture file formats have been added. - Macintosh OS X support has been improved. - GeoIP database lookups. - OpenStreetMap + GeoIP integration. - Improved Postscript(R) print output. - The preference handling code is now much smarter about changes. - Support for Pcap-ng, the next-generation capture file format. - Support for process information correlation via IPFIX. - Column widths are now saved. - The last used configuration profile is now saved. - Protocol preferences are changeable from the packet details context menu. - Support for IP packet comparison. - Capinfos now shows the average packet rate. Security fixes: - The AFS dissector could crash. - The Infiniband dissector could crash on some platforms.
2009-07-21 22:39:41 +02:00
share/wireshark/radius/dictionary.wimax
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.wimax.alvarion
Update "wireshark" package to version 1.6.3. Changes since version 1.6.2: - The following vulnerabilities have been fixed. o wnpa-sec-2011-17 The CSN.1 dissector could crash. (Bug 6351) Versions affected: 1.6.0 to 1.6.2. o wnpa-sec-2011-18 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL pointer. (Bug 6476) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. o wnpa-sec-2011-19 Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a buffer overflow in the ERF file reader. (Bug 6479) Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2. - The following bugs have been fixed: o Assertion failed when doing File->Quit->Save during live capture. (Bug 1710) o Wrong PCEP XRO sub-object decoding. (Bug 3778) o Wireshark window takes very long time to show up if invalid network file path is at recent file list (Bug 3810) o Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits. (Bug 4109) o ISUP party number dissection. (Bug 5221) o wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion. (Bug 5431) o Ethernet packets with both VLAN tag and LLC header no longer displayed correctly. (Bug 5645) o SLL encapsuled 802.1Q VLAN is not dissected. (Bug 5680) o Wireshark crashes when attempting to open a file via drag & drop when there's already a file open. (Bug 5987) o Adding and removing custom HTTP headers requires a restart. (Bug 6241) o Can't read full 64-bit SNMP values. (Bug 6295) o Dissection fails for frames with Gigamon Header and VLAN. (Bug 6305) o RTP Stream Analysis does not work for TURN-encapsulated RTP. (Bug 6322) o packet-csn1.c doesn't process CSN_CHOICE entries properly. (Bug 6328) o BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients. (Bug 6336) o GUI crash on invalid IEEE 802.11 GAS frame. (Bug 6345) o [ASN.1 PER] Incorrect decoding of BIT STRING type. (Bug 6347) o ICMPv6 router advertisement Prefix Information Flag R "Router Address" missing. (Bug 6350) o Export -> Object -> HTTP -> save all: Error on saving files. (Bug 6362) o Inner tag of 802.1ad frames not parsed properly. (Bug 6366) o Added cursor type decoding to MySQL dissector. (Bug 6396) o Incorrect identification of UDP-encapsulated NAT-keepalive packets. (Bug 6414) o WPA IE pairwise cipher suite dissector uses incorrect value_string list. (Bug 6420) o S1AP protocol can't decode IPv6 transportLayerAddress. (Bug 6435) o RTPS2 dissector doesn't handle 0 in the octestToNextHeader field. (Bug 6449) o packet-ajp13 fix, cleanup, and enhancement. (Bug 6452) o Network Instruments Observer file format bugs. (Bug 6453) o Wireshark crashes when using "Open Recent" 2 times in a row. (Bug 6457) o Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header. (Bug 6469) o wireshark unable to decode NetFlow options which have system scope size != 4 bytes. (Bug 6471) o Display filter Expression Dialog Box Error. (Bug 6472) o text_import_scanner.l missing. (Bug 6531) - Updated Protocol Support AJP13, ASN.1 PER, BACnet, CSN.1, DTN, Ethernet, ICMPv6, IEEE 802.11, IEEE 802.1q, Infiniband, IPsec, MySQL, PCEP, PN-RT, RTP, S1AP, SSL - New and Updated Capture File Support Endace ERF.
2011-11-02 08:56:24 +01:00
share/wireshark/radius/dictionary.wimax.wichorus
Add new "wireshark" package. Wireshark is a network protocol analyzer and the successor of "ethereal". Changes since "ethereal" version 0.99.0: - The GSM BSSMAP dissector could crash. Versions affected: 0.10.11. - The ANSI MAP dissector was vulnerable to a format string overflow. Versions affected: 0.10.0. - The Checkpoint FW-1 dissector was vulnerable to a format string overflow. Versions affected: 0.10.10. - The MQ dissector was vulnerable to a format string overflow. Versions affected: 0.10.4. - The XML dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The MOUNT dissector could attempt to allocate large amounts of memory. Versions affected: 0.9.4. - The NCP NMAS and NDPS dissectors were susceptible to off-by-one errors. Versions affected: 0.9.7. - The NTP dissector was vulnerable to a format string overflow. Versions affected: 0.10.13. - The SSH dissector was vulnerable to an infinite loop. Versions affected: 0.9.10. - The NFS dissector may have been susceptible to a buffer overflow. Versions affected: 0.8.16. - The "Follow TCP Stream" dialog now wraps long lines. - Problems with ring buffers under 0.99.0 have been fixed. - It was possible for Wireshark to crash when closing the capture information dialog. This has been fixed. - It was possible for Wireshark to crash when using the "Find" feature. This has been fixed. - Wireshark could crash if an interface was removed while viewing the interface list. This has been fixed. - Multicast stream analysis (Statistics->Multicast Streams) has been added. It lets you determine burst size, output buffer size, and losses for multicast data. - TCP reassembly has been updated and improved. - Expert analysis has been updated and improved. - SCSI service response time statistics have been added. - You can now find next/previous marked frames. - The LDAP and SNMP dissectors have been completely rewriten. - The SMB dissector now tracks filenames and share names.
2006-07-21 16:27:53 +02:00
share/wireshark/radius/dictionary.wispr
share/wireshark/radius/dictionary.xedia
Make wireshark2 the new default wireshark, since it is the default stable version upstream.
2016-03-03 14:33:14 +01:00
share/wireshark/radius/dictionary.xylan
share/wireshark/radius/dictionary.yubico
share/wireshark/radius/dictionary.zeus
share/wireshark/radius/dictionary.zte
Update "wireshark" package to version 1.4.0. Change since version 1.2.10: - The following bugs have been fixed: - Update time display in background. (Bug 1275) - Tshark returns 0 even with an invalid interface or capture filter. (Bug 4735) - The following features are new (or have been significantly updated) since version 1.2: - The packet list internals have been rewritten and are now more efficient. - Columns are easier to use. You can add a protocol field as a column by right-clicking on its packet detail item, and you can adjust some column preferences by right-clicking the column header. - Preliminary Python scripting support has been added. - Many memory leaks have been fixed. - Packets can now be ignored (excluded from dissection), similar to the way they can be marked. - Manual IP address resolution is now supported. - Columns with seconds can now be displayed as hours, minutes and seconds. - You can now set the capture buffer size on UNIX and Linux if you have libpcap 1.0.0 or greater. - TShark no longer needs elevated privileges on UNIX or Linux to list interfaces. Only dumpcap requires privileges now. - Wireshark and TShark can enable 802.11 monitor mode directly if you have libpcap 1.0.0 or greater. - You can play RTP streams directly from the RTP Analysis window. - Capinfos and editcap now respectively support time order checking and forcing. - Wireshark now has a "jump to timestamp" command-line option. - You can open JPEG files directly in Wireshark. - New Protocol Support 3GPP Nb Interface RTP Multiplex, Access Node Control Protocol, Apple Network-MIDI Session Protocol, ARUBA encapsulated remote mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N. Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle Protocol, CIP Class Generic, CIP Connection Configuration Object, CIP Connection Manager, CIP Message Router, collectd network data, Control And Provisioning of Wireless Access Points, Controller Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch Link, Fibre Channel Delimiters, File Replication Service DFS-R, Gateway Load Balancing Protocol, Gigamon Header, GigE Vision Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM sub-protocol, GSM over IP protocol as used by ip.access, GSM Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol, IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless Association Control Service, ISO 9548-1 OSI Connectionless Session Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol, ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word, MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS Protocol, packetbb Protocol, Peer Network Resolution Protocol, PKIX Attribute Certificate, Pseudowire Padding, Server/Application State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol, TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN Iuh interface RUA signalling, V5.2, Vendor Specific Control Protocol, Vendor Specific Network Protocol, VMware Lab Manager, VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt, X.411 Message Access Service, ZigBee Cluster Library - Updated Protocol Support There are too many to list here. - New and Updated Capture File Support Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000, Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries, JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler, PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian OS btsnoop, Visual Networks Pkgsrc changes: A fix for the security vulnerability reported in SA41535 has been integrated from the Wireshark SVN repository.
2010-09-25 13:19:10 +02:00
share/wireshark/radius/dictionary.zyxel
Update "wireshark" package to version 0.99.7pre2. Changes since version 0.99.6: - Fixes for the security problems reported in "wnpa-sec-2007-03" - Most of the capture code has been moved out of the GUI, which means that Wireshark no longer needs to be run as root. - Many display filter names have been cleaned up. If your favorite display filter just went missing, please consult the display filter reference to find out where it ended up. - You can now filter directly on SNMP OIDs. - IO graphs have more display options, and you can now export graphs. - You can now follow UDP streams in addition to TCP and SSL streams. - You can now disable coloring rules without deleting them. - Main window toolbar buttons are now available even when the window is small. - Optimizations have been applied in some places to make Wireshark start up and run faster. - New Protocol Support ANSI TCAP, application/xcap-error (MIME type), CFM, DPNSS, EtherCAT, ETSI e2/e4, H.282, H.460, H.501, IEEE 802.1ad and 802.1ah, IMF (RFC 2822), RSL, SABP, T.125, TNEF, TPNCP, UNISTIM, Wake on LAN, WiMAX ASN Control Plane, X.224 - Updated Protocol Support 3Com XNS, 3G A11, ACN, ACP123, ACSE, AIM, ANSI IS-637-A, ANSI MAP, Armagetronad, BACapp, BACnet, BER, BFD, BGP, Bluetooth, CAMEL, CDT, CFM, CIP, Cisco ERSPAN, CLNP, CMIP, CMS, COPS, CTDB, DCCP, DCERPC ATSVC, DCERPC PNIO, DCERPC SAMR, DCERPC, DCOM CBA-ACCO, DCP ETSI, DEC DNA, DFS, DHCP/BOOTP, DHCPv6, DIAMETER, DISP, DMP, DNP, DNS, DOP, DTLS, DUA, eDonkey, ELSM, ESL, Ethernet, FC ELS, FC, FCOE, FTAM, FTP, GDSDB, GIOP, GPRS-LLC, GSM A, GSM MAP, GTP, HSRP, HTTP, IAX2, ICMPv6, IEEE 802.11, INAP, IP, IPMI, IPv6, ISAKMP, ISIS, iSNS, ISUP, IUUP, JXTA, K12, Kerberos, L2TP, LAPD, LDAP, LINX, LPD, LWAPP, MEGACO, MIKEY, MIME Multipart, MMS, MP2T, MPEG PES, MPEG, MTP2, MySQL, NBAP, NetFlow, nettl, NFS, NSIP, OSPF, P_MUL, PANA, PER, PKCS#12, PMIPv6, PN-PTCP, PN-RT, PPI, PPPoE, PRES, PROFINET, PTP, Q.932 ROS, Q.932, QSIG, Radiotap, RADIUS, RANAP, RNSAP, ROS, RTCP, RTP, RTSE, RTSP, SCCP, SCTP, SDP, SIGCOMP, SIP, Slow Protocols, SMB, SMPP, SMTP, SNDCP, SNMP, SRP, SSL, STANAG 4406, STUN2, TCAP, TCP, text/media, TIPC, ULP, UMA, UMTS FP, V5UA, VNC, WiMAX M2M, WiMAX, WLCCP, X.411, X.420, X.509 SAT, XML - New and Updated Capture File Support Catapult DCT 2000, Endace ERF, Juniper NetScreen snoop, Visual Networks, Windows Sniffer (NetXRay)
2007-12-15 14:53:27 +01:00
share/wireshark/services
share/wireshark/smi_modules
share/wireshark/tpncp/tpncp.dat
share/wireshark/wimaxasncp/dictionary.dtd
share/wireshark/wimaxasncp/dictionary.xml
wireshark: update to 2.6.0. Switch default GUI from gtk3 to qt5. See What's New below for "why". What’s New Wireshark 2.6 is the last release that will support the legacy (GTK+) user interface. It will not be supported or available in Wireshark 3.0. Many user interface improvements have been made. See the “New and Updated Features” section below for more details. Bug Fixes The following bugs have been fixed: Dumpcap might not quit if Wireshark or TShark crashes. (Bug 1419[1]) New and Updated Features The following features are new (or have been significantly updated) since version 2.5.0: • HTTP Request sequences are now supported. • Wireshark now supports MaxMind DB files. Support for GeoIP and GeoLite Legacy databases has been removed. • The Windows packages are now built using Microsoft Visual Studio 2017. • The IP map feature (the “Map” button in the “Endpoints” dialog) has been removed. The following features are new (or have been significantly updated) since version 2.4.0: • Display filter buttons can now be edited, disabled, and removed via a context menu directly from the toolbar • Drag & Drop filter fields to the display filter toolbar or edit to create a button on the fly or apply the filter as a display filter. • Application startup time has been reduced. • Some keyboard shortcut mix-ups have been resolved by assigning new shortcuts to Edit → Copy methods. • TShark now supports color using the --color option. • The "matches" display filter operator is now case-insensitive. • Display expression (button) preferences have been converted to a UAT. This puts the display expressions in their own file. Wireshark still supports preference files that contain the old preferences, but new preference files will be written without the old fields. • SMI private enterprise numbers are now read from the “enterprises.tsv” configuration file. • The QUIC dissector has been renamed to Google QUIC (quic → gquic). • The selected packet number can now be shown in the Status Bar by enabling Preferences → Appearance → Layout → Show selected packet number. • File load time in the Status Bar is now disabled by default and can be enabled in Preferences → Appearance → Layout → Show file load time. • Support for the G.729A codec in the RTP Player is now added via the bcg729 library. • Support for hardware-timestamping of packets has been added. • Improved NetMon .cap support with comments, event tracing, network filter, network info types and some Message Analyzer exported types. • The personal plugins folder on Linux/Unix is now ~/.local/lib/wireshark/plugins. • TShark can print flow graphs using -z flow… • Capinfos now prints SHA256 hashes in addition to RIPEMD160 and SHA1. MD5 output has been removed. • The packet editor has been removed. (This was a GTK+ only experimental feature.) • Support BBC micro:bit Bluetooth profile • The Linux and UNIX installation step for Wireshark will now install headers required to build plugins. A pkg-config file is provided to help with this (see “doc/plugins.example” for details). Note you must still rebuild all plugins between minor releases (X.Y). • The Windows installers and packages now ship with Qt 5.9.4. • The generic data dissector can now uncompress zlib compressed data. • DNS Stats now supports service level statistics. • DNS filters for retransmissions and unsolicited responses have been added. • The “tcptrace” TCP Stream graph now shows duplicate ACKS and zero window advertisements. • The membership operator now supports ranges, allowing display filters such as tcp.port in {4430..4434} to be expressed. See the User’s Guide, chapter Building display filter expressions for details. New Protocol Support ActiveMQ Artemis Core Protocol, AMT (Automatic Multicast Tunneling), AVSP (Arista Vendor Specific Protocol), Bluetooth Mesh, Broadcom tags (Broadcom Ethernet switch management frames), CAN-ETH, CVS password server, Excentis DOCSIS31 XRA header, F1 Application Protocol, F5ethtrailer, FP Mux, GRPC (gRPC), IEEE 1905.1a, IEEE 802.11ax (High Efficiency WLAN (HEW)), IEEE 802.15.9 IEEE Recommended Practice for Transport of Key Management Protocol (KMP) Datagrams, IEEE 802.3br Frame Preemption Protocol, ISOBUS, LoRaTap, LoRaWAN, Lustre Filesystem, Lustre Network, Nano / RaiBlocks Cryptocurrency Protocol (UDP), Network Functional Application Platform Interface (NFAPI) Protocol, New Radio Radio Link Control protocol, New Radio Radio Resource Control protocol, NR (5G) MAC protocol, NXP 802.15.4 Sniffer Protocol, Object Security for Constrained RESTful Environments (OSCORE), PFCP (Packet Forwarding Control Protocol), Protobuf (Protocol Buffers), QUIC (IETF), RFC 4108 Using CMS to Protect Firmware Packages, Session Multiplex Protocol, SolarEdge monitoring protocol, Steam In-Home Streaming Discovery Protocol, Tibia, TWAMP and OWAMP, Wi-Fi Device Provisioning Protocol, and Wi-SUN FAN Protocol Updated Protocol Support Too many protocols have been updated to list here. New and Updated Capture File Support Microsoft Network Monitor New and Updated Capture Interfaces support LoRaTap
2018-04-29 14:15:37 +02:00
share/wireshark/wka
Update "wireshark" package to version 0.99.8. Changes since 0.99.7: - Security-related vulnerabilities in the SCTP, SNMP, and TFTP dissectors have been fixed. - This release adds configuration profiles, temporary coloring rules, enhanced I/O graphs, WLAN traffic statistics, and many other useful features.
2008-02-28 15:55:17 +01:00
share/wireshark/ws.css
Reference in a new issue Copy permalink