Wireshark 1.7.1 Development Release

April 6, 2012

Wireshark 1.7.1 has been released. Installers for Windows, OS X, and source code are now available. This is a development release intended to test new features and functionality for Wireshark 1.8.0.

New and Updated Features

The following features are new (or have been significantly updated) since version 1.6:

  • Wireshark supports capturing from multiple interfaces at once.

  • You can now add, edit, and save packet annotations.

  • Wireshark, TShark, and their associated utilities now save files using the pcap-ng file format by default. (Your copy of Wireshark might still use the pcap file format if pcap-ng is disabled in your preferences.)

  • Decryption key management for IEEE 802.11, IPsec, and ISAKMP is easier.

  • OID resolution is now supported on 64-bit Windows.

  • When saving packets, the default choice is now to save only the displayed packets rather than all packets.

  • TCP fast retransmissions are now indicated as an expert info note, rather than a warning, just as TCP retransmissions are.

  • TCP window updates are no longer colorized as "Bad TCP".

  • TShark's command-line options have changed. The previously undocumented -P option is now -2 option for performing a two-pass analysis; the former -S option is now the -P option for printing packets even if writing to a file, and the -S option is now used to specify a different line separator between packets.

  • GeoIP IPv6 databases are now supported.

Official releases are available right now from the download page.