{"id":119677,"date":"2024-08-30T15:43:12","date_gmt":"2024-08-30T13:43:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-setevyh-analizatorov-wireshark-4-4-0-i-zeek-7-0-0"},"modified":"2024-08-30T15:43:12","modified_gmt":"2024-08-30T13:43:12","slug":"vypusk-setevyh-analizatorov-wireshark-4-4-0-i-zeek-7-0-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-setevyh-analizatorov-wireshark-4-4-0-i-zeek-7-0-0","title":{"rendered":"Release of network analyzers Wireshark 4.4.0 and Zeek 7.0.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A new stable release of the Wireshark network analyzer 4.4 has been published. The program supports over a thousand network protocols and several dozen traffic capture formats. It provides a flexible interface for creating filters, capturing traffic, analyzing saved dumps, and inspecting packets. Advanced features include reassembling packet order, extracting and saving the contents of files transmitted using various protocols, replaying VoIP and RTP streams, decrypting IPsec, ISAKMP, Kerberos, SNMPv3, SSL\/TLS, WEP, and WPA\/WPA2. The project code is distributed under the GPLv2 license. <\/p>\n
Key innovations in Wireshark 4.4.0: <\/p>\n
\n
Support for automatic profile switching with settings has been added. Users can link a display filter to a profile, and when opening a file with captured traffic that falls under the filter, the associated profile will be automatically activated.\n
Support for Lua 5.3 and 5.4 has been added. Support for Lua 5.1 and 5.2 has been discontinued.\n
Display filters now have improved support for string values (numerical fields can now be represented as strings).\n
The ability to define filter functions as plugins, similar to file parsers and protocol dissectors, has been provided.\n
The operation 'Edit > Copy > Display filter as pcap filter' has been added to convert display filters into pcap filters with equivalent fields.\n
Many graphical dialogs have been improved, and input\/output graphs, traffic flows, VoIP calls, and TCP flows have been modernized.\n
The definition of custom columns is now allowed, which can use any operations on fields (filter functions, arithmetic calculations, logical operations, protocol modifiers, etc.).\n
Defining custom output fields for 'tshark -e' is now allowed, using operations on existing fields.\n
Support for building with the zlib-ng library instead of zlib for working with compressed files has been added.\n
Support has been added for the following protocols and formats:\n
\n
Allied Telesis Resiliency Link (AT RL),\n
ATN Security Label,\n
Bit Index Explicit Replication (BIER),\n
Bus Mirroring Protocol,\n
EGNOS Message Server (EMS),\n
Galileo E1-B I\/NAV,\n
IBM i RDMA Endpoint (iRDMA-EDP),\n
IWBEMSERVICES, MAC NR Framed (mac-nr-framed),\n
Matter Bluetooth Transport Protocol (MatterBTP),\n
ZeroMQ Message Transport Protocol (ZMTP). <\/ul>\n
A vulnerability has been fixed (CVE-2024-8250) that could lead to a crash when processing specially formatted packets. <\/ul>\n
Additionally, the release of the traffic analysis and network intrusion detection system Zeek 7.0.0 can be noted, which was previously distributed under the name Bro. Zeek is a traffic analysis platform primarily focused on monitoring security-related events, but not limited to this application. The Zeek platform provides modules for analyzing and parsing various application layer network protocols, taking into account connection states and allowing for detailed logging of network activity. A domain-specific language is offered for writing monitoring and anomaly detection scripts tailored to the specifics of particular infrastructures. The system is optimized for use in high-bandwidth networks. An API is provided for integration with third-party information systems and real-time data exchange. The system's code is written in C++ and distributed under the BSD license. <\/p>\n
In the new release of Zeek: <\/p>\n
\n
The Telemetry framework used for collecting and exporting statistics (e.g., number of open connections and request intensity) has been revamped. Instead of aggregating metrics on the endpoints with their direction to a separate control node, the new version employs a service discovery mechanism based on Prometheus for collecting metrics from nodes.\n
The parser generator for protocol and file parsing has been updated to Spicy 1.11, which features changes to the code representation in memory, improved reliability, enhanced handling of packet loss, extended support for bit fields, and accelerated performance (for some protocols, performance gains reach 30%).\n
Support for the ZAM (Zeek Abstract Machine) script optimization engine has been added, allowing for improved performance of Zeek scripts by compiling syntax tree nodes into a more efficiently executable low-level form.\n
New analyzers for QUIC and LDAP protocols have been proposed, built using the Spicy parser generator.\n
Correct handling of forwarding to newer versions of the HTTP protocol has been ensured.\n
WebSocket analysis has been improved.\n
Support for delayed logging has been added. <\/ul>\n