The release of the new stable branch of the network analyzer Wireshark 4.0 has been announced. It is worth noting that the project was originally developed under the name Ethereal, but in 2006, due to a conflict with the owner of the Ethereal trademark, the developers were forced to rename the project to Wireshark. The project's code is licensed under GPLv2.
Key innovations in Wireshark 4.0.0:
- The layout of the elements in the main window has been changed. The panels "Packet Details" and "Bytes" are now placed side by side under the "Packet List" panel.
- The design of the "Conversation" and "Endpoint" dialog windows has been modified.
- Options for resizing all columns and copying items have been added to the context menus.
- The ability to detach and reattach tabs has been provided.
- Support for JSON format export has been added.
- When applying filters, columns are shown that display differences between packets that match and do not match the filters.
- The sorting of different types of data has been changed.
- Identifiers have been attached to TCP and UDP streams, with the ability to filter by them.
- The ability to hide dialogs from the context menu is allowed.
- The import of hexadecimal dumps from the Wireshark interface and using the text2pcap command has been improved.
- The text2pcap tool now allows dumps to be written in all formats supported by the wiretap library.
- The default format in text2pcap has been set to pcapng, similar to the utilities editcap, mergecap, and tshark.
- Support for selecting encapsulation types for output formats has been added.
- New options for logging have been introduced.
- The ability to save fictional IP, TCP, UDP, and SCTP headers in dumps when using Raw IP, Raw IPv4, and Raw IPv6 encapsulation has been provided.
- Support for scanning input files using regular expressions has been added.
- Parity of functionality between the text2pcap utility and the "Import from Hex Dump" interface in Wireshark has been ensured.
- Significant performance improvements for location determination using MaxMind databases have been achieved.
- Changes have been made to the traffic filtering rule syntax:
- The ability to select a specific layer of the protocol stack has been added; for example, when encapsulating IP-over-IP to extract addresses from external and nested packets, you can specify "ip.addr#1 == 1.1.1.1" and "ip.addr#2 == 1.1.1.2."
- Conditional operators now support the quantifiers 'any' and 'all', for example, 'all tcp.port > 1024' to check all tcp.port fields.
- Built-in syntax for referencing fields is implemented as ${some.field}, without the use of macros.
- Arithmetic operations ('+', '-', '*', '/', '%') can now be used with numeric fields, enclosing the expression in curly braces.
- Functions max(), min(), and abs() have been added.
- It is now allowed to use expressions and call other functions as arguments to functions.
- A new syntax has been added for separating literals from identifiers — a value starting with a dot is processed as a protocol or protocol field, while a value in angle brackets is treated as a literal.
- The bitwise operator '&' has been added; for instance, to change individual bits, you can specify 'frame[0] & 0x0F == 3'.
- The precedence of the logical operator AND is now higher than that of the OR operator.
- Support has been added for specifying constants in binary format using the prefix '0b'.
- Negative index values can now be used to index from the end; for example, to check the last two bytes in the TCP header, you can specify 'tcp[-2:] == AA:BB'.
- Separating set elements with spaces is now prohibited; using spaces instead of a comma will now lead to an error instead of a warning.
- Additional escape sequences have been added: \a, \b, \f, \n, \r, \t, \v.
- It is now possible to specify Unicode characters in the format \uNNNN and \UNNNNNNNN.
- A new comparison operator '===' ('all_eq') has been added, which only triggers if in the expression 'a === b' all values of 'a' match 'b'. An inverse operator '!==', ('any_ne'), has also been added.
- The operator '~=' has been deprecated; instead, '!== should be used.
- It is now prohibited to use numbers with an unclosed decimal point; values '.7' and '7.' are now invalid and should be replaced with '0.7' and '7.0'.
- The regular expression handler in the display filter engine has been switched to the PCRE2 library instead of GRegex.
- Null bytes ('\0' in strings) are now correctly handled in strings and regular expression patterns.
- In addition to 1 and 0, boolean values can now also be written as True/TRUE and False/FALSE.
- The HTTP2 dissector module has been enhanced to support the use of spoofed headers for parsing data intercepted without preceding packets containing headers (for example, when analyzing messages in already established gRPC connections).
- The IEEE 802.11 dissector module now includes support for Mesh Connex (MCX).
- Temporary storage (without disk saving) of the password in the Extcap dialog has been ensured to avoid re-entering it during subsequent launches. The option to set a password for extcap via command-line utilities, such as tshark, has been added.
- The ciscodump utility has implemented the capability for remote capturing from devices running IOS, IOS-XE, and ASA.
- Support for the following protocols has been added:
- Allied Telesis Loop Detection (AT LDF),
- AUTOSAR I-PDU Multiplexer (AUTOSAR I-PduM),
- DTN Bundle Protocol Security (BPSec),
- DTN Bundle Protocol Version 7 (BPv7),
- DTN TCP Convergence Layer Protocol (TCPCL),
- DVB Selection Information Table (DVB SIT),
- Enhanced Cash Trading Interface 10.0 (XTI),
- Enhanced Order Book Interface 10.0 (EOBI),
- Enhanced Trading Interface 10.0 (ETI),
- FiveCo’s Legacy Register Access Protocol (5co-legacy),
- Generic Data Transfer Protocol (GDT),
- gRPC Web (gRPC-Web),
- Host IP Configuration Protocol (HICP),
- Huawei GRE bonding (GREbond),
- Locamation Interface Module (IDENT, CALIBRATION, SAMPLES — IM1, SAMPLES — IM2R0),
- Mesh Connex (MCX),
- Microsoft Cluster Remote Control Protocol (RCP),
- Open Control Protocol for OCA/AES70 (OCP.1),
- Protected Extensible Authentication Protocol (PEAP),
- REdis Serialization Protocol v2 (RESP),
- Roon Discovery (RoonDisco),
- Secure File Transfer Protocol (sftp),
- Secure Host IP Configuration Protocol (SHICP),
- SSH File Transfer Protocol (SFTP),
- USB Attached SCSI (UASP),
- ZBOSS Network Coprocessor (ZB NCP).
- Increased requirements for the build environment (CMake 3.10) and dependencies (GLib 2.50.0, Libgcrypt 1.8.0, Python 3.6.0, GnuTLS 3.5.8).
Source: opennet.ru
