Wireshark 3.1.0 Development Release

July 25, 2019

Wireshark 3.1.0 has been released.

This is a semi-experimental release intended to test new features for Wireshark 3.2.

The following features are new (or have been significantly updated) since version 3.0.0:

  • Drag&Drop a field to a column header to create a column for that field, or to the display filter input to create a display filter. If a display filter is applied, the new filter can be added using the same rules as "Apply Filter"

  • Drag&Drop a column entry to the display filter to create a filter for it

  • Import profiles from a .zip archive or an existing directory

  • Dark mode support on macOS and dark theme support on other platforms has been improved.

  • Brotli decompression support in HTTP/HTTP2 (requires the brotli library).

  • The build system now checks for a SpeexDSP system library installation. The bundled Speex resampler code is still provided as a fallback.

  • WireGuard decryption can now be enabled through keys embedded in a pcapng in addition to the existing key log preference (Bug 15571).

  • A new tap for extracting credentials from the capture file has been added. It can be accessed through the "-z credentials" option in tshark or from the "tools" menu in Wireshark.

  • Editcap can now split files on floating point intervals.

  • Windows .msi packages are now signed using SHA-2. .exe installers are still dual-signed using SHA-1 and SHA-2.

New Protocol Support

3GPP BICC MST (BICC-MST), 3GPP log packet (LOG3GPP), 3GPP/GSM Cell Broadcast Service Protocol (cbsp), Bluetooth Mesh Beacon, Bluetooth Mesh PB-ADV, Bluetooth Mesh Provisioning PDU, Bluetooth Mesh Proxy, CableLabs Layer-3 Protocol IEEE EtherType 0xb4e3 (CL3), DCOM IProvideClassInfo, DCOM ITypeInfo, Distributed Replicated Block Device (DRBD), Dual Channel Wi-Fi (CL3DCW), EBHSCR Protocol (EBHSCR), EERO Protocol (EERO), evolved Common Public Radio Interface (eCPRI), File Server Remote VSS Protocol (FSRVP), FTDI FT USB Bridging Devices (FTDI FT), Graylog Extended Log Format over UDP (GELF), GSM/3GPP CBSP (Cell Broadcast Service Protocol), MIDI System Exclusive DigiTech (SYSEX DigiTech), Network Controller Sideband Interface (NCSI), NR Positioning Protocol A (NRPPa) TS 38.455, and NVM Express over Fabrics for TCP (nvme-tcp)

Updated Protocol Support

Too many protocols have been updated to list here.

New and Updated Capture File Support

3gpp phone, Android Logcat Text, Ascend, Candump, Endace ERF, NetScaler, pcapng, and Savvius *Peek

Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More