Wireshark 0.99.6 Release Notes

   ------------------------------------------------------------------

What is Wireshark?

   Wireshark is the world's most popular network protocol analyzer.
   It is used for troubleshooting, analysis, development, and
   education.

What's New

  Bug Fixes

   The following vulnerabilities have been fixed. See the [1]security
   advisory for details and a workaround.

     o Wireshark could crash when dissecting an HTTP chunked
       response. (Bug [2]1394)

       Versions affected: 0.99.5

     o On some systems, Wireshark could crash while reading iSeries
       capture files. (Bug [3]1415)

       Versions affected: 0.10.14 to 0.99.5

     o Wireshark could exhaust system memory while reading a
       malformed DCP ETSI packet. (Bug [4]1264)

       Versions affected: 0.99.5

     o Wireshark could loop excessively while reading a malformed SSL
       packet. (Bug [5]1582)

       Versions affected: 0.8.20 to 0.99.5

     o The DHCP/BOOTP dissector was susceptible to an off-by-one
       error. (Bug [6]1416)

       Versions affected: 0.10.17 to 0.99.5

     o Wireshark could loop excessively while reading a malformed MMS
       packet. (Bug [7]1342)

       Versions affected: 0.10.12 to 0.99.5

   The following bugs have been fixed:

     o WEP decryption would only work for the first key specified.
       disappear or become unusable. WEP and WPA decryption didn't
       work for QoS frames. WPA decryption failed if EAPOL handshake
       packets contained extra data. Wireshark failed to parse
       colon-separated WEP keys.

     o Merging files in Wireshark now appends files properly.

     o Wireshark could hang while saving an RTP stream with bad
       timestamp data.

     o You must now explicitly pass "--disable-wireshark" to the
       build environment if you only want to build TShark; the
       configure script will fail, rather than automatically building
       only TShark, if it's run on a system that doesn't have GTK+
       headers and libraries installed.

     o Capture from named pipes (via -i \\<server>\pipe\<pipename>)
       now works under Windows.

     o The frame.time_delta display filter now works as expected,
       matching the delta time between the current and previous
       captured packet. A new filter, frame.time_delta_displayed,
       matches the delta time between the current and previous
       displayed packet.

  New and Updated Features

   The following features are new (or have been significantly
   updated) since the last release:

     o You no longer have to restart Wireshark after changing column
       preferences. Woohoo!

     o You can now export HTTP objects via
       File->Export->Objects->HTTP.

     o [8]Display filter macros are now supported.

     o Right-clicking on a packet lets you copy many more things,
       such as the packet summary and the packet bytes.

     o You can now match upper- and lower-case text with the contains
       operator, e.g. upper(http.request.method) contains "GET".

     o A great deal of code has been cleaned up, including fixing
       many compiler errors. Many thanks to those who worked on this.

  New Protocol Support

   AMQP (Advanced Message Queueing Protocol), BCTP Q.1990, Borland
   StarTeam, Cisco ERSPAN, CTDB (Cluster TDB), DRDA (Distributed
   Relational Database Architecture), DTPT (DeskTop PassThrough),
   EPMD (Erlang Port Mapper Daemon), FCoE (Fibre Channel over
   Ethernet), Firebird/Interbase (replaces the old Interbase
   dissector), FMP (File Mapping Protocol), H.248.10, H.248.7,
   IPsec/ISAKMP over TCP, Kingfisher, MIKEY (Multimedia Internet
   KEYing), MPEG, NSRP (Juniper Netscreen Redundant Protocol), OpcUa
   Binary Protocol, PPI (Per-Packet Information header), Q.932, QSIG,
   TAPA (Trapeze Access Point Access Protocol), WiMAX, WiMAX M2M

  Updated Protocol Support

   ACSE, AFP, AMR, ANSI IS-801, ANSI MAP, ARP, ASAP, ASN.1 BER, ASN.1
   PER, AVS WLANCAP, BSSAP, BSSGP, BVLC, Camel, CDT, CIP, CMS, COPS,
   CPFI, DCCP, DCERPC (DCERPC, ATSVC, DFS, EFS, EVENTLOG,
   INITSHUTDOWN, NDR, NETLOGON, NSPI, NT, PNIO, SAMR, SPOOLSS,
   SRVSVC, WINREG, WKSSVC, WZCSVC), DCOM (DCOM, CBA, CBA-ACCO), DCP
   ETSI, DCP, DCT2000, DHCP, DIAMETER, DMP, DNP, DTLS, EDP, ENRP,
   EPL, ERF, FCELS, Fibre Channel, FTAM, FTBP, FW-1, GIOP, GSM MAP,
   GTP, H.223, H.225, H.235, H.245, H.248, H.263, HTTP, IAX2, IEEE
   802.11, IGRP, INAP, IP, IPsec, IPv6, iSCSI, ISUP, IUA, IuUP,
   Juniper, JXTA, K12, Kerberos, L2TP, LDAP, LLDP, LWAPP, M3UA,
   MEGACO, MIP, MMS, MP2T, MTP3, NBAP, NDMP, Netflow, NFS, NT SONMP,
   OICQ, OSPF, PANA, PN-PTCP, PPP, P_Mul, Radiotap, RADIUS
   (Packetcable), RANAP, Redback, RNSAP, RRLP, RSVP, RTCP, RTP, RX,
   SCCP, SCSI (SCSI, MMC, OSD, SBC, SMC, SSC), SCTP, SDP, SIGCOMP,
   SIP, Skinny, SliMP3, SLL, SMB PIPE, SMB, SMB2, SMPP, SNMP, SPNEGO,
   SSCOP, SSL, STUN, SUA, Symantec, Syslog, TACACS, TCAP, TCP, TFTP,
   UDLD, UDP, ULP, UMA, UMTS (UMTS, FP, RRC), USB, VNC, WCP, WLCCP,
   X.25, X.411, X.509, YMSG

  New and Updated Capture File Support

   DCT2000, Endace ERF, iSeries, K12, MPEG Audio (yes, this means you
   can open .mp3 files in Wireshark), NetMon, pppdump, snoop (Shomiti
   wireless packets), Visual Networks, Windows Sniffer (NetXRay)

Getting Wireshark

   Wireshark source code and installation packages are available from
   the [9]download page on the main web site.

  Vendor-supplied Packages

   Most Linux and Unix vendors supply their own Wireshark packages.
   You can usually install or upgrade Wireshark using the package
   management system specific to that platform. A list of third-party
   packages can be found on the [10]download page on the Wireshark
   web site.

File Locations

   Wireshark and TShark look in several different locations for
   preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
   These locations vary from platform to platform. You can use
   About->Folders to find the default locations on your system.

Known Problems

   The Filter button is nonfunctional in the file dialogs under
   Windows. ([11]Bug 942)

Getting Help

   Community support is available on the wireshark-users mailing
   list. Subscription information and archives for all of Wireshark's
   mailing lists can be found on [12]the web site.

   Commercial support, training, and development services are
   available from [13]CACE Technologies.

Frequently Asked Questions

   A complete FAQ is available on the [14]Wireshark web site.

References

   Visible links
   1. http://www.wireshark.org/security/wnpa-sec-2007-02.html
   2. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1394
   3. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1415
   4. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1264
   5. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1582
   6. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1416
   7. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1342
   8. http://www.wireshark.org/docs/wsug_html_chunked/ChDisplayFilterMacrosSection.html
   9. http://www.wireshark.org/download.html
  10. http://www.wireshark.org/download.html#otherplat
  11. http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=942
  12. http://www.wireshark.org/lists/
  13. http://www.cacetech.com/
  14. http://www.wireshark.org/faq.html
