Wireshark (64-bit)

What's new in this version:

New:
- The Windows installers now ship with Qt 5.9.7. Previously they shipped with Qt 5.9.5

Bug Fixes:
The following vulnerabilities have been fixed:
- The Wireshark dissection engine could crash
- The DCOM dissector could crash
- The LBMPDM dissector could crash
- The MMSE dissector could go into an infinite loop
- The IxVeriWave file parser could crash
- The PVFS dissector could crash
- The ZigBee ZCL dissector could crash

The following bugs have been fixed:
- VoIP Calls dialog doesn’t include RTP stream when preparing a filter
- Wireshark installs on macOS with permissions for /Library/Application Support/Wireshark that are too restrictive
- Closing Enabled Protocols dialog crashes wireshark
- Unable to Export Objects → HTTP after sorting columns
- DNS Response to NS query shows as malformed packet
- Encrypted Alerts corresponds to a wrong selection in the packet bytes pane
- Wireshark crashes/asserts with Qt 5.11.1 and assert/debugsymbols enabled
- ESP will not decode since 2.6.2 - works fine in 2.4.6 or 2.4.8
- Text2pcap generates malformed packets when TCP, UDP or SCTP headers are added together with IPv6 header
- Wireshark tries to decode EAP-SIM Pseudonym Identity
- Infinite read loop when extcap exits with error and error message
- MATE unable to extract fields for PDU
- Malformed Packet: SV
- OPC UA Max nesting depth exceeded for valid packet
- TShark 2.6 does not print GeoIP information
- ISUP (ANSI) packets malformed in WS versions later than 2.4.8
- Handover candidate enquire message not decoded
- TShark piping output in a cmd or PowerShell prompt stops working when GeoIP is enabled
- ICMPv6 with routing header incorrectly placed
- IEEE 802.11 Vendor Specific fixed fields display as malformed packets
- Text2pcap -4 and -6 option should require -i as well
- Text2pcap direction sensitivity does not affect dummy ethernet addresses
- MLE security suite display incorrect
- Message for incorrect IPv4 option lengths is incorrect
- TACACS+ dissector does not properly reassemble large accounting messages
- NLRI of S-PMSI A-D BGP route not being displayed

Updated Protocol Support:
- BGP, DCERPC, DCOM, DNS, EAP, ESP, GSM A BSSMAP, IEEE 802.11, IEEE 802.11 Radiotap, IPv4, IPv6, ISUP, LBMPDM, LISP, MLE, MMSE, OpcUa, PVFS, SLL, SSL/TLS, SV, TACACS+, TCAP, Wi-SUN, XRA, and ZigBee ZCL

New and Updated Capture File Support:
- 3GPP TS 32.423 Trace and IxVeriWave

New and Updated Capture Interfaces support:
- Sshdump

Vendor-supplied Packages:
- Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.

File Locations:
- Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About→Folders to find the default locations on your system.

Known Problems
- The BER dissector might infinitely loop
- Capture filters aren’t applied when capturing from named pipes
- Filtering tshark captures with read filters (-R) no longer works
- Application crash when changing real-time option
- Wireshark and TShark will display incorrect delta times in some cases
- Wireshark should let you work with multiple capture files