Wireshark 1.6.2

Major Features:

1. Deep inspection of hundreds of protocols, with more being added all the time
2. Live capture and offline analysis
3. Standard three-pane packet browser
4. Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
5. Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
6. The most powerful display filters in the industry
7. Rich VoIP analysis
8. Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
9. Capture files compressed with gzip can be decompressed on the fly
10. Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
11. Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
12. Coloring rules can be applied to the packet list for quick, intuitive analysis
13. Output can be exported to XML, PostScript®, CSV, or plain text

Enhancements:

• Bug Fixes
• • The following vulnerabilities have been fixed.
  • wnpa-sec-2011-12
  • • A large loop in the OpenSafety dissector could cause a crash. (Bug 6138)
    • Versions affected: 1.6.0 to 1.6.1.
  • wnpa-sec-2011-13
  • • A malformed IKE packet could consume excessive resources.
    • Versions affected: 1.4.0 to 1.4.8, 1.6.0 to 1.6.1.
  • CVE-2011-3266
  • wnpa-sec-2011-14
  • • A malformed capture file could result in an invalid root tvbuff and cause a crash. (Bug 6135)
    • Versions affected: 1.6.0 to 1.6.1.
  • wnpa-sec-2011-15
  • • Wireshark could run arbitrary Lua scripts. (Bug 6136)
    • Versions affected: 1.4.0 to 1.4.8, 1.6.0 to 1.6.1.
  • wnpa-sec-2011-16
  • • The CSN.1 dissector could crash. (Bug 6139)
    • Versions affected: 1.6.0 to 1.6.1.
• The following bugs have been fixed:
• • configure ignores (partially) LDFLAGS. (Bug 5607)
  • Build fails when it tries to #include , not present in Solaris 9. (Bug 5608)
  • Unable to configure zero length SNMP Engine ID. (Bug 5731)
  • BACnet who-is request device range values are not decoded correctly in the packet details window. (Bug 5769)
  • H.323 RAS packets missing from packet counts in "Telephony->VoIP Calls" and the "Flow Graph" for the call. (Bug 5848)
  • Wireshark crashes if sercosiii module isn't installed. (Bug 6006)
  • Editcap could create invalid pcap files when converting from JPEG. (Bug 6010)
  • Timestamp is incorrectly decoded for ICMP Timestamp Response packets from MS Windows. (Bug 6114)
  • Malformed Packet in decode for BGP-AD update. (Bug 6122)
  • Wrong display of CSN_BIT in CSN.1. (Bug 6151)
  • Fix CSN_RECURSIVE_TARRAY last bit error in packet-csn1.c. (Bug 6166)
  • Wireshark cannot display Reachable time & Retrans timer in IPv6 RA messages. (Bug 6168)
  • ReadPropertyMultiple-ACK not correctly dissected. (Bug 6178)
  • GTPv2 dissectors should treat gtpv2_ccrsi as optional. (Bug 6183)
  • BGP : AS_PATH attribute was decode wrong. (Bug 6188)
  • Fixes for SCPS TCP option. (Bug 6194)
  • Offset calculated incorrectly for sFlow extended data. (Bug 6219)
  • [Enter] key behavior varies when manually typing display filters. (Bug 6228)
  • Contents of pcapng EnhancedPacketBlocks with comments aren't displayed. (Bug 6229)
  • Misdecoding 3G Neighbour Cell Information Element in SI2quater message due to a coding typo. (Bug 6237)
  • Mis-spelled word "unknown" in assorted files. (Bug 6244)
  • tshark run with -Tpdml makes a seg fault. (Bug 6245)
  • btl2cap extended window shows wrong bit. (Bug 6257)
  • NDMP dissector incorrectly represents "ndmp.bytes_left_to_read" as signed. (Bug 6262)
  • TShark/dumpcap skips capture duration flag occasionally. (Bug 6280)
  • File types with no snaplen written out with a zero snaplen in pcap-ng files. (Bug 6289)
  • Wireshark improperly parsing 802.11 Beacon Country Information tag. (Bug 6264)
  • ERF records with extension headers not written out correctly to pcap or pcap-ng files. (Bug 6265)
  • RTPS2: MAX_BITMAP_SIZE is defined incorrectly. (Bug 6276)
  • Copying from RTP stream analysis copies 1st line many times. (Bug 6279)
  • Wrong display of CSN_BIT under CSN_UNION. (Bug 6287)
  • MEGACO context tracking fix - context id reuse. (Bug 6311)
• New and Updated Features
• • There are no new features in this release.
• New Protocol Support
• • There are no new protocols in this release.
• Updated Protocol Support
• • BACapp, Bluetooth L2CAP, CSN.1, DCERPC, GSM A RR, GTPv2, ICMP, ICMPv6, IKE, MEGACO, MSISDN, NDMP, OpenSafety, RTPS2, sFlow, SNMP, TCP
• New and Updated Capture File Support
• • CommView, pcap-ng, JPEG.
• Getting Wireshark
• • Wireshark source code and installation packages are available from http://www.wireshark.org/download.html.
• Vendor-supplied Packages
• • Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.
• File Locations
• • Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About→Folders to find the default locations on your system.