What's New

Wireshark 5.0.0rc1 Development Release

October 21, 2026

What’s New

The following changes have been made since version 4.7.4:

I/O Graphs now support exponential weighted moving averages (EWMA) along with simple moving averages (SMA).
Many style and theme issues have been fixed.
Initial support for nDPI TCP fingerprints has been added.

macOS disk images and applications are now signed using certificates issued by Apple’s Developer ID Certification Authority (G2). The previous certificate was issued by Apple’s Developer ID Certification Authority, which expires in early 2027.

The following changes have been made since version 4.7.3:

You can now tag packets with emojis, text, or URLs similar to coloring rules.
The user interface icons have been refreshed, and now scale with the View zoom settings.
The packet bytes pane can show text as UTF-8. Multi-byte characters are drawn over the column of their first byte with a “]” over their last byte, and hovering over any of those bytes highlights the whole character.
Holding down ↓ and ↑ will move rapidly through the packet list.
Coloring rules are now saved as a JSONC (JSON with comments) file. The legacy colorfilters file is only read, and converted, when no personal coloring_rules.jsonc exists; otherwise only the JSONC file is used, so deleted rules no longer reappear from an old legacy file. A personal coloring_rules.jsonc that cannot be parsed is now reported instead of silently treated as empty. Support for the legacy file format will be removed in a future release.
Support for automatic update notification and updates on Linux distributions supporting PackageKit >= 1.1.12.

The following changes have been made since version 4.7.2:

The minimum supported Windows version is Windows 10 21H2 (build 19044) or Windows Server 2022.
Display filter operators' English forms like "and" and "or" are case-insensitive.
Display filter string literals can be surrounded by appropriate pairs of directional (“smart” or “curly”) double quotes instead of "straight" double quotes.
The Export Packet Dissections CSV output is UTF-8 CSV (with optional BOM) by default; the previous format which escapes non-ASCII characters is still available.
The Export Packet Dissections C Arrays output gained an option to add an index array for the arrays of data sources. Also, there is an option to omit secondary data sources like reassembled data or decrypted data. Issue 19616.
Extcap interfaces now support "bookmarks," which let you have multiple configurations for the same interfaces. Extcap configurations are now shared across profiles, and existing per-profile configurations will be migrated to bookmarks. Issue 14224.
Extcap interfaces support graceful shutdown on Windows (already supported on other platforms) via using the control pipe. Third-party extcap interfaces should be updated to take advantage of this capability; see below under Plugin Development Changes. Issue 17131.
MSI packages no longer include Visual C++ Redistributable assets. You must now install them separately.

The following changes have been made since version 4.7.1:

The Follow Stream window is more responsive and has more filtering options.
The following improvements have been added to the HTTP/3 dissector:
- Reassembly is implemented.
- Decompression is implemented for gzip/deflate, brotli, and zstd.
- Media type dissectors are called for the Content-Type.
- Follow Stream is implemented. Issue 20610.
- Export Objects is implemented.
- Request/response tracking is implemented.

The following changes have been made since version 4.7.0:

The following issues have been fixed: * Wireshark appears in German where Systemlanguage is Dutch. Issue 20347. * If you double-click an interface in the welcome screen interface list, and have typed nothing in the capture filter box, the system reports an invalid capture filter. Issue 21303. * Qt: Appearance mode is stored per-profile while theme name is global — theme flips on profile switch. Issue 21311. * Qt: 'Recent filters' arrow button gives no hover/pressed feedback. Issue 21322. * Qt: Hidden interfaces (Welcome page right-click) not persisted across profile switch or restart. Issue 21325. * Qt: Preferences dialog left category tree cannot be resized (labels truncated, only horizontal scrollbar) Issue 21327. * Qt: Make theme preview resemble a real Wireshark window (mini packet-list mockup) Issue 21329. * stratoshark -D lists a bunch of network capture devices. Issue 21332.

The following changes have been made since version 4.6.0:

The welcome page has been redesigned to be more informative and easier to navigate. It now highlights the learning sections better and includes a new sidebar with tips and tricks for using Wireshark effectively. The welcome page is now also more accessible, with improved keyboard navigation and screen reader support.
The welcome page has a new preference to show the Open and Capture sections side-by-side. It falls back to stacked when the window is too narrow.
A built-in Lua script debugger has been added. It supports breakpoints, single-stepping, variable inspection, expression evaluation, and stack traces. The debugger can be opened from the Tools › Lua Debugger menu.
Wireshark now has a theme engine. Wireshark now drives the colors used throughout the GUI from a single theme instead of many individual color preferences. The renamed Appearance › Theme and Font preferences page lets you pick a theme, switch between Light, Dark, and System appearance, set the packet pane font, and preview the result on a mockup of a capture window. A built-in default theme ships with Wireshark, and additional themes can be installed as JSONC (JSON with Comments) files. The previous per-color settings (marked and ignored packets, "Follow Stream" client and server text, display filter validity, and the selected packet) are now provided by the active theme. Graph and plot windows (I/O Graph, TCP Stream, SCTP, RTP, and others) now take their grid, text and series colors from the theme, and the display filter field text, packet list row separators, and links stay readable in light and dark themes. Personal themes can now be dropped as single .jsonc files into $HOME/.local/lib/wireshark/themes (Unix) or %APPDATA%\Wireshark\themes (Windows). The exact path is shown in the About dialog’s Folders tab. On first launch after the upgrade, Wireshark checks the Default profile’s preferences for customized values of the removed per-color settings. If any are found, a personal theme named Personal (Migrated) is created automatically in the personal themes directory, the legacy keys are removed from the Default profile’s preferences file, and the theme is activated so the original visual customizations are preserved. The migration runs once: the generated personal.jsonc can be edited, renamed, or deleted by hand at any time. The welcome page section headers ("Open", "Capture", "Learn") and the filter validity tints have been restored to the historical Classic look (Tango sky_blue brand, saturated GTK-era green and red filter backgrounds). Selected and hovered rows now share one color family: the hover color of the packet list, details tree, welcome page lists and JSON view is derived from the selection color, so themes no longer define a separate hover color, and the colored gradients of the welcome page header and update bar have been replaced by flat colors. Themes that set packets.selection but not palette.highlight now use that color for selection in lists, the details tree and the bytes pane (and for the welcome page header); palette.highlight still overrides it. The brand.deep color and the header and update gradient tokens are no longer used and can be removed from personal themes. The text of selected and marked rows is now checked against its background when the theme is applied and lifted to a readable contrast (4.5:1) if a theme’s pinned text color would be hard to read, and the text of a pressed button is chosen against the pressed color. The Bluetooth dialog tables use the same derived hover color as the other lists.
The Default profile now has additional column "Delta", showing the delta time from the previous displayed packet.
Wireshark ships a “Processes” configuration profile, which adds the new "PID" and "Proc Name" columns, showing the process on the capturing host that sent or received each packet when that was recorded.
Name Resolution SMI paths are now searched recursively. This makes it easier to use MIBs provided by libsmi.

Many other improvements have been made. See the “New and Updated Features” section below for more details.

New and Updated Features

The following features are either new or have been significantly updated since version 4.6.0:

Capture files can be saved with Zstandard compression. The Save Capture File As and Export Specified Packets dialogs offer a Zstandard option, and command-line tools accept --compress zstd when built with Zstandard support. The Advanced preference capture.zstd_compression_level sets the level for Wireshark saves and exports and for TShark capture-file rewrites. Negative levels select fast compression when built with Zstandard 1.4.0 or newer. Output uses independent frames with up to 4 MiB of uncompressed data to support fast seeking when the capture is reopened.
Dumpcap, TShark and Wireshark can record which processes on the capturing host sent or received each packet, with the new --process-info[=basic|full] capture option: the process IDs go in the pcapng epb_processid_threadid packet option and the processes are described in process information blocks, shown as the frame.process fields. By default (basic) a process is described by its ID, name and start time; with full its path, command line, parent and user are recorded as well, which can be sensitive. In Wireshark it is set in the “Output” tab of the “Capture Options” dialog and in the capture preferences (capture.process_info), and IDs and names are recorded by default. A packet that several processes could have sent or received, such as a multicast datagram and its sender and receivers, is attributed to all of them. Supported on Windows, Linux and macOS. editcap --discard-process-info removes the process information from a capture file, e.g. before sharing it.
New IMSI List dialog (Telephony › IMSI List) scans all packets in a capture and lists every unique IMSI with packet count, first/last frame, and protocols. Double-click an IMSI to apply a display filter for that subscriber. Multi-select and "Prepare Filter" combines multiple IMSIs.
New tshark -z imsi statistics lists all unique IMSIs found in a capture with packet counts, first/last frame numbers, and protocols. A new "imsi" tap is registered by the E.212 dissector.
UDX conversations and endpoints are now listed per stream, in Statistics › Conversations and Statistics › Endpoints as well as tshark -z conv,udx and tshark -z endpoints,udx. Several UDX streams can share one UDP socket pair, which the UDP tables count as a single conversation. A new "udx" tap is registered by the UDX dissector.
New compact JSON output option omits indentation and whitespace, significantly reducing output size and improving performance. Available as tshark --json-compact (with -T json or -T jsonraw) and as a "Compact (no indentation)" checkbox in the GUI JSON export dialog.
Process information stored in pcapng captures, in Wireshark custom blocks or in Apple’s Darwin process information blocks, is now shown under "Process information" in the Frame tree as the frame.process fields (process and thread ID, name, executable path, command line, parent process ID, user ID and name, executable UUID and start time), fills the "User name" column, and can be used through the "Process" conversation filter.
On Linux, Wireshark can check whether the distribution offers a newer version of the package it was installed from. The check uses PackageKit and never contacts wireshark.org; the update itself is installed through the desktop’s software center (e.g. GNOME Software or KDE Discover). Self-compiled builds and Flatpak, Snap or AppImage installations are not checked. Building with this support requires the optional packagekit-glib2 library, version 1.1.12 or later.
The Windows installers now ship with Npcap 1.89. They previously shipped with Npcap 1.83.
The Windows and macOS installers now ship with Qt 6.11.1. They previously shipped with Qt 6.9.3.

Zooming (View › Zoom In / View › Zoom Out) now scales the whole window, including the capture and display filter fields and other window elements. Previously only the text size in the three main window panes (packet list, details, and bytes) changed. The new behavior should be much more useful for demos and presentations.
The keyboard shortcuts dialog (About Wireshark › Keyboard Shortcuts) has been moved out of of the About dialog to the View › Internals › Keyboard Shortcuts menu and now has a button to print the list of keyboard shortcuts to an HTML file.
The application icons have been updated and refreshed. The macOS icon now supports Liquid Glass and is sized according to Apple’s specifications on older macOS versions. Issue 18131
The RTP Player now supports AMR-WB and 24-bit linear encoded audio.
The protocol dissection API has been updated to more safely handle packet data offsets and lengths. See the Major API Changes section below for details.
The welcome screen’s interface activity sparklines now keep their history for the whole session. Previously the sparklines, and the activity-first ordering of the interface list, were reset whenever you started or stopped a capture or returned to the welcome screen, so the list re-shuffled each time. Now the history persists, the ordering stays stable, and a break in a sparkline marks the interval during which a capture was running (interface statistics are not sampled while capturing). When an interface is dropping packets, the drops are shown as a separate line. The Capture Options dialog’s interface list now shares the same statistics, so its sparklines match the welcome screen exactly, including the capture-interval gap and the dropped-packet line. Issue 21318
Interfaces hidden from the welcome screen’s right-click menu are now remembered across profile switches and application restarts. Issue 21325
Editcap has a new --sctp-split option that splits SCTP packets containing multiple bundled DATA chunks into individual packets, one per DATA chunk. Each split packet includes a comment indicating its original frame number.
Sharkd supports Unix domain sockets where supported on Windows, which includes all Windows versions supported by Wireshark 4.6 and later. (Windows 10 versions 1803 and later, including Windows Server 2019 and later, all support Unix domain sockets.)
The OPC UA dissector can decode ExtensionObjects of custom datatypes described in an information model, a UANodeSet XML file set in the new opcua.information_model preference, in client/server and PubSub messages. The new opcua.ns_offset preference maps the namespace indexes of the file to those in the packets.

Removed Features and Support

Dumpcap’s TCP@host:port interface has been removed. Tools like socat, ncat, netcat, nc, and others can be used to redirect network interfaces to FIFOs and named pipes on UN*X and Windows to achieve the same interface. Many of those tools have additional security features like enabling TLS encryption.

Sharkd only supports binding to a loopback IPv4 or IPv6 address when listening on a TCP socket. (TCP sockets are only available by default on Windows systems, and are deprecated, since UNIX domain sockets are now supported. IPv6 support is new.) Sharkd now rejects connecting to a Linux abstract domain socket from peer processes with effective UID other than that of the sharkd process.

The individual color preferences under Appearance (marked and ignored packets, "Follow Stream" client and server text, display filter validity, and the selected packet) have been removed. These colors are now provided by the selected theme; see the "What’s New" section above.

Building with Qt 5 is no longer supported.

New File Format Decoding Support

Bachmann M-Module and Xiph.org Ogg Stream

New Protocol Support

Apple Darwin Metadata, Axia Livewire, Controller Interface Transport Protocol (CITP), DCERPC SCARD_PACK, DECT NR+, ESUN, Generic UDP Encapsulation (GUE), HyperDHT / DHT-RPC, JSON Dictionary, Linux mac80211_hwsim Netlink, Linux Open vSwitch Netlink (OVS), MCData, MCTP over SMBus/I2C, MIDI System Exclusive DigiTech, Mikrotik RoMON, Multicast Router Discovery (MRD), MySQL X Protocol (MySQLX), NATS, NMEA 2000, Object Transform Protocol (OTP), OPC UA PubSub UADP, PackClient, Perforce P4RPC, PosiStageNet (PSN), PROFINET SXP (PN-SXP), Qualcomm Diagnostic (QCDIAG), RDP Conctrl virtual channel Protocol (CONCTRL), RDP Video Capture Virtual Channel Extension (RDPECAM), Real-Time Tracking Protocol (RTTrP), RTP over QUIC (RoQ), SMPTE ST2110-40 (ST291-1 Ancillary Data), TCG Storage Interface, TrueConf Protocol (TrueConf), UDX, Ultra Ethernet Transport (UET), XGT, and ZigBee ZCL Generic Tunnel

Updated Protocol Support

Too many protocol updates have been made to list them all here.

Of particular note, "ike" is now preferred to "isakmp" for filtering the Internet Key Exchange (IKE) protocol and its fields (both IKEv1 and IKEv2), including fields primarily associated with RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP) though "isakmp" remains as an alias for the protocol and all its fields.