Release of the network analyzer Wireshark 3.6

After a year of development, a new stable branch of the network analyzer Wireshark 3.6 has been released. It’s worth noting that the project originally developed under the name Ethereal, but due to a trademark conflict with the owner of the Ethereal brand in 2006, the developers were forced to rename the project to Wireshark. The project code is distributed under the GPLv2 license.

Key innovations in Wireshark 3.6.0:

• Changes have been made to the traffic filtering rule syntax:
  • Support for the syntax "a ~= b" or "a any_ne b" has been added to select any values except one.
  • Support for the syntax "a not in b" has been added, which acts similarly to "not a in b."
  • The specification of string literals similar to raw strings in Python is now allowed, without the need to escape special characters.
  • The expression "a != b" is now always equivalent to the expression "!(a == b)" when used with values covering multiple fields (i.e., "ip.addr != 1.1.1.1" is now equivalent to specifying "ip.src != 1.1.1.1 and ip.dst != 1.1.1.1").
  • Set list elements must now be separated only by commas; separating them with spaces is prohibited (i.e., the rule ‘http.request.method in {"GET" "HEAD"}’ must be replaced with ‘http.request.method in {"GET", "HEAD"}’).
• For TCP traffic, a tcp.completeness filter has been added, allowing the separation of TCP streams based on the connection's activity state, i.e., identifying TCP streams for which packet exchanges were made to establish, transmit data, or terminate the connection.
• An ‘add_default_value’ setting has been added that allows you to specify default values for Protobuf fields that are not serialized or are skipped during traffic capture.
• Support for reading files with captured traffic in ETW (Event Tracing for Windows) format has been added. A dissector module for DLT_ETW packets has also been included.
• A ‘Follow DCCP stream’ mode has been added, allowing you to filter and extract content from DCCP streams.
• Support for parsing RTP packets containing audio data in OPUS format has been added.
• The ability to import captured packets from text dumps into libpcap format with parsing rules based on regular expressions has been provided.
• The RTP stream player (Telephony > RTP > RTP Player) has been significantly revamped, which can be used to play VoIP calls. Playlist support has been added, the interface responsiveness improved, mute capabilities and channel switching provided, and an option for saving played sounds in multichannel .au or .wav files has been added.
• The dialogs related to VoIP (VoIP Calls, RTP Streams, RTP Analysis, RTP Player, and SIP Flows) have been redesigned and are no longer modal, allowing them to be opened in the background.
• The 'Follow Stream' dialog now includes the ability to track SIP calls based on the Call-ID value. Output detail has been increased in YAML format.
• The capability to reconstruct fragments of IP packets with different VLAN IDs has been implemented.
• A handler for reconstructing USB packets (USB Link Layer) captured using hardware analyzers has been added.
• An option '—export-tls-session-keys' has been added in TShark to export TLS session keys.
• The RTP stream analyzer's export dialog has been modified to CSV format.
• Package creation has begun for macOS systems equipped with Apple M1 chips. For Apple devices with Intel chips, the macOS version requirements have been raised (10.13+). Portable 64-bit packages for Windows (PortableApps) have been added. Initial support for building Wireshark for Windows using GCC and MinGW-w64 has been introduced.
• Support for decoding and capturing data in BLF (Informatik Binary Log File) format has been added.
• Support for the following protocols has been added:
  • Bluetooth Link Manager Protocol (BT LMP),
  • Bundle Protocol version 7 (BPv7),
  • Bundle Protocol version 7 Security (BPSec),
  • CBOR Object Signing and Encryption (COSE),
  • E2 Application Protocol (E2AP),
  • Event Tracing for Windows (ETW),
  • EXtreme extra Eth Header (EXEH),
  • High-Performance Connectivity Tracer (HiPerConTracer),
  • ISO 10681,
  • Kerberos SPAKE,
  • Linux psample protocol,
  • Local Interconnect Network (LIN),
  • Microsoft Task Scheduler Service,
  • O-RAN E2AP,
  • O-RAN fronthaul UC-plane (O-RAN),
  • Opus Interactive Audio Codec (OPUS),
  • PDU Transport Protocol, R09.x (R09),
  • RDP Dynamic Channel Protocol (DRDYNVC),
  • RDP Graphic pipeline channel Protocol (EGFX),
  • RDP Multi-transport (RDPMT),
  • Real-Time Publish-Subscribe Virtual Transport (RTPS-VT),
  • Real-Time Publish-Subscribe Wire Protocol (processed) (RTPS-PROC),
  • Shared Memory Communications (SMC),
  • Signal PDU, SparkplugB,
  • State Synchronization Protocol (SSyncP),
  • Tagged Image File Format (TIFF),
  • TP-Link Smart Home Protocol,
  • UAVCAN DSDL,
  • UAVCAN/CAN,
  • UDP Remote Desktop Protocol (RDPUDP),
  • Van Jacobson PPP compression (VJC),
  • World of Warcraft World (WOWW),
  • X2 xIRI payload (xIRI).

Source: opennet.ru