include::attributes.adoc[]
:stylesheet: ws.css
:linkcss:

= Wireshark {wireshark-version} Release Notes
// Asciidoctor Syntax Quick Reference:
// https://asciidoctor.org/docs/asciidoc-syntax-quick-reference/

== What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer.
It is used for troubleshooting, analysis, development and education.

== What’s New

// The Windows installers now ship with Npcap 1.x.
// They previously shipped with Npcap 1.00.

// The Windows installers now ship with USBPcap 1.5.X.0.
// They previously shipped with USBPcap 1.5.4.0.

// The Windows installers now ship with Qt 5.15.x.
// They previously shipped with Qt 5.12.1.

=== Bug Fixes

// The following vulnerabilities have been fixed:
//
// https://about.gitlab.com/security/cve/#requesting-a-cve-from-gitlab
// CWE-126: Buffer Over-read
// CWE-401: Missing Release of Memory after Effective Lifetime
// https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

* wssalink:2020-16[]
Kafka dissector memory leak.
wsbuglink:16739[].
cveidlink:2020-26418[].
// Fixed in master: f4374967bb
// Fixed in release-3.4: fa53725469
// Fixed in master-3.2: 4736aaae7a

* wssalink:2020-17[]
USB HID dissector crash.
wsbuglink:16958[].
cveidlink:2020-26421[].
// Fixed in master: d5f2657825
// Fixed in release-3.4: c8fedf65b2
// Fixed in master-3.2: 61f17d3c21

* wssalink:2020-18[]
RTPS dissector memory leak.
wsbuglink:16994[].
cveidlink:2020-26420[].
// Fixed in master: 33e63d19e5
// Fixed in release-3.4: 6ece1c896d
// Fixed in master-3.2: 53682b53da

* wssalink:2020-19[]
Multiple dissector memory leak.
wsbuglink:17032[].
cveidlink:2020-26419[].
// Fixed in master: a9fc769d7b
// Fixed in release-3.4: 5edf715c04
// Fixed in master-3.2: n/a


The following bugs have been fixed:

=== New and Updated Features

//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
//* Wireshark exposed details your sordid redneck past, which were subsequently widely disseminated on social media.
// cp /dev/null /tmp/buglist.txt ; for bugnumber in `git log v3.4.2rc0.. | gsed -e 's/\(close\|fix\|resolv\)[^ ]* #/\nclose #/gI' | grep ^close | sed -e 's/close.*#\([1-9][0-9]*\).*/\1/' | sort -V -u` ; do "$(git rev-parse --show-toplevel)/tools/gen-bugnote" $bugnumber; pbpaste >> /tmp/buglist.txt; done

* Lua TvbRanges do not support truncated captures where tvb_captured_length < tvb_reported_length wsbuglink:15655[].

* IETF QUIC TLS decryption errors when a NAT rebinding happens for a connection wsbuglink:16915[].

* IETF QUIC TLS decryption error with key update wsbuglink:16916[].

* IETF QUIC TLS decryption error after the second key update wsbuglink:16920[].

* SOME/IP: Wrong dissection of parameters after Array wsbuglink:16951[].

* Can editcap properly corrupt pcapng file with systemd journal export block? wsbuglink:16965[].

* Lua: abort() called in lua_tap_draw() and lua_tap_reset() on script errors wsbuglink:16974[].

* Crash when a GIOP ior.txt file is present wsbuglink:16984[].

* Protobuf: failed to parse .proto file contains negative enum values or option values of number type wsbuglink:16988[].

* MMRP dissector bug wsbuglink:17005[].

* QUIC: "Loss bits" capability wsbuglink:17010[].

* Stdin capture fails on Windows wsbuglink:17018[].

* SSTP no longer recognized wsbuglink:17024[].

* RFC2190 encapsulated H.263 bitfields masked wrong in Mode A wsbuglink:17025[].

* Packet list bytes text character cursor is misaligned wsbuglink:17033[].

* SOME/IP: Resetting offset of static_array wsbuglink:17057[].

* editcap fails when splitting into multiple pcapng files wsbuglink:17060[].

* SMB Dissector for TRANS2_QUERY_FS_INFO displays truncated FS Name & Label wsbuglink:17064[].

* Wireshark does not display Arabic, Greek, some other characters correctly wsbuglink:17070[].

// === Removed Features and Support

//=== Removed Dissectors

// === New File Format Decoding Support

// [commaize]
// --
// --

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

// Add one protocol per line between the -- delimiters.
[commaize]
--
ACDR
DOCSIS
Ericsson HDLC
F5 Ethernet Trailer
GIOP
GSM A
GSM RLC MAC
HTTP
IEEE 802.11
Kafka
LLC
MBIM
MMRP
NAS 5GS
NAS EPS
Nordic BLE
ProtoBuf
QUIC
Radiotap
RFC 2190
RTCP
RTPS
S1AP
SMB
SMB2
SOME/IP
STUN
USB Video
--

=== New and Updated Capture File Support

// There is no new or updated capture file support in this release.
// Add one file type per line between the -- delimiters.
[commaize]
--
pcapng
--

// === New and Updated Capture Interfaces support

//_Non-empty section placeholder._

// === Major API Changes

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package management system specific to that platform.
A list of third-party packages can be found on the
https://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform.
You can use About → Folders to find the default locations on your system.

== Getting Help

The User’s Guide, manual pages and various other documentation can be found at
https://www.wireshark.org/docs/

Community support is available on
https://ask.wireshark.org/[Wireshark’sQ&A site]
and on the wireshark-users mailing list.
Subscription information and archives for all of Wireshark’s mailing lists can be found on
https://www.wireshark.org/lists/[the web site].

Issues and feature requests can be reported on
https://gitlab.com/wireshark/wireshark/-/issues[the issue tracker].

// Official Wireshark training and certification are available from
// https://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
