Wireshark 3.0.0: Overview of Innovations / Jet Infosystems Blog

The Wireshark Foundation has released the final stable version of the popular network traffic analyzer - Wireshark 3.0.0. The new release fixed several bugs, implemented the ability to analyze new protocols and replaced the WinPcap driver with Npcap.

Wireshark is the world's most popular network protocol analyzer. It is used for troubleshooting, analysis, development and training.

New and Updated Features

• Improved user interface. Support for a number of deprecated features and libraries has been removed.
• The IP card function (Map button in the Endpoints dialog box) was added back in a modernized form (Error 14693).
• The macOS package now ships with Qt 5.12.1. Previously, it came with Qt 5.9.7.
• The macOS package requires version 10.12 or later macOS (High Sierra / Mojave). If you are using an older version of macOS, use Wireshark 2.6.
• Wireshark now supports Swedish and Ukrainian (it supports Russian from version 2.9).
• Added support for using PKCS # 11 tokens to decrypt RSA in TLS.
• Windows installers now ship with Qt 5.12.1. Previously, they came with Qt 5.12.0.
• Windows .exe installers now ship with Npcap instead of WinPcap. Besides active support (by the nmap project), Npcap supports loopback capture and capture of 802.11 Wi-Fi monitoring mode (if supported by the NIC driver).
• Talk time marks are supported for UDP / UDP-Lite protocols.
• TShark now supports the -G elastic-mapping option, which generates an ElasticSearch mapping file.
• The "Capture information" dialog has been added back (error 12004).
• The Ethernet and IEEE 802.11 dissectors no longer check the default frame check sequence (checksum).
• The TCP dissector has a new preference for “Reassembling Unordered Segments” to fix tampering and decryption problems if TCP segments are not received in order.
• Decryption support for the new WireGuard dissector (bug 15011, Libgcrypt 1.8 required).
• The BOOTP dissector has been renamed to DHCP. Except for “bootp.dhcp,” the old display filter fields “bootp. * »Are still supported, but may be removed in a future release.
• The SSL dissector has been renamed TLS. As with BOOTP, the old display filter fields are “ssl. * ”Are supported, but may be removed in a future release.
• APT-X has been renamed aptX.
• When importing from a hex dump, you can now add the ExportPDU header with the name of the payload. This invokes a particular dissector directly without any downstream protocols.
• The extshap sshdump and ciscodump interfaces can now use proxies for SSH connections.
• Dumpcap now supports the -a packets: NUM and -b packets: NUM options.

New Protocol Support

In addition to updating the huge number of protocols that already exist in Wireshark, developers have added support for the following:

Apple Wireless Direct Link (AWDL), Basic Transport Protocol (BTP), BLIP Couchbase Mobile (BLIP), CDMA 2000, Circuit Emulation Service over Ethernet (CESoETH), Cisco Meraki Discovery Protocol (MDP), Distributed Ruby (DRb), DXL, E1AP (5G), EVS (3GPP TS 26.445 A.2 EVS RTP), Exablaze trailers, General Circuit Services Notification Application Protocol (GCSNA), GeoNetworking (GeoNw), GLOW Lawo Emberplus Data format, Great Britain Companion Specification (GBCS) used in the Smart Metering Equipment Technical Specifications (SMETS), GSM-R (User-to-User Information Element usage), HI3CC LinkData, Intelligent Transport Systems (ITS) application level, ISO 13400-2 Diagnostic communication over Internet Protocol (DoIP), ITU- t X.696 Octet Encoding Rules (OER), Local Number Portability Database Query Protocol (ANSI), MsgPack, NGAP (5G), NR (5G) PDCP,Osmocom Generic Subscriber Update Protocol (GSUP), PCOM protocol, PKCS # 10 (RFC2986 Certification Request Syntax), PROXY (v2), S101 Lawo Emberplus transport frame, Secure Reliable Transport Protocol (SRT), Spirent Test Center Signature decoding for Ethernet and FiberChannel (STCSIG, disabled by default), Sybase-specific portions of TDS, systemd Journal Export, TeamSpeak 3 DNS, TPM 2.0, Ubiquiti Discovery Protocol (UBDP), WireGuard, XnAP (5G), and Z39.50 Information Retrieval Protocol.TPM 2.0, Ubiquiti Discovery Protocol (UBDP), WireGuard, XnAP (5G), and Z39.50 Information Retrieval Protocol.TPM 2.0, Ubiquiti Discovery Protocol (UBDP), WireGuard, XnAP (5G), and Z39.50 Information Retrieval Protocol.

WinPcap → Npcap

The most relevant innovation is the replacement of WinPcap with Npcap. Although the Npcap library is based on WinPcap / Libpcap, it is more optimized, has better speed, portability and security. Another important factor is the support for Npcap by the developers of the Nmap Project, unlike WinPcap, which has not been updated since 2013.