The following changes have been made since version 0.10.4:
The Windows and macOS installers now ship with Falco libs 0.26.1, which adds a raw scap/pcapng block processing engine.
Many style and theme issues have been fixed.
macOS disk images and applications are now signed using certificates issued by Apple’s Developer ID Certification Authority (G2). The previous certificate was issued by Apple’s Developer ID Certification Authority, which expires in early 2027.
The following changes have been made since version 0.10.3:
The user interface icons have been refreshed, and now scale with the View zoom settings.
Holding down ↓ and ↑ will move rapidly through the event list.
The event bytes pane can show text as UTF-8. Multi-byte characters are drawn over the column of their first byte with a “]” over their last byte, and hovering over any of those bytes highlights the whole character.
Coloring rules are now saved as a JSONC (JSON with comments) file.
The legacy colorfilters file is only read, and converted, when no personal coloring_rules.jsonc exists;
otherwise only the JSONC file is used, so deleted rules no longer reappear from an old legacy file.
A personal coloring_rules.jsonc that cannot be parsed is now reported instead of silently treated as empty.
Support for the legacy file format will be removed in a future release.
Support for automatic update notification and updates on Linux distributions supporting PackageKit >= 1.1.12.
The following changes have been made since version 0.10.2:
The minimum supported Windows version is Windows 10 21H2 (build 19044) or Windows Server 2022.
Extcap interfaces now support "bookmarks," which let you have multiple configurations for the same interfaces. Extcap configurations are now shared across profiles, and existing per-profile configurations will be migrated to bookmarks. Issue 14224.
An issue which prevented loading .scap files generated by Falco or the sysdig CLI utility has been fixed.
The following changes have been made since version 0.10.1:
Timestamps missing in Stratoshark in 0.10.0 and 0.10.1. Issue 21406.
The following changes have been made since version 0.10.0:
The Stratoshark Windows installer now includes a DLL that was required by the cloudtrail and gcpaudit plugins.
The following issues have been fixed: * Wireshark appears in German where Systemlanguage is Dutch. Issue 20347. * If you double-click an interface in the welcome screen interface list, and have typed nothing in the capture filter box, the system reports an invalid capture filter. Issue 21303. * Qt: Appearance mode is stored per-profile while theme name is global — theme flips on profile switch. Issue 21311. * Qt: 'Recent filters' arrow button gives no hover/pressed feedback. Issue 21322. * Qt: Hidden interfaces (Welcome page right-click) not persisted across profile switch or restart. Issue 21325. * Qt: Preferences dialog left category tree cannot be resized (labels truncated, only horizontal scrollbar) Issue 21327. * Stratoshark: no-libpcap compilation broken (actionCaptureRestart) — fix from 554baf6294 never applied. Issue 21328. * Qt: Make theme preview resemble a real Wireshark window (mini packet-list mockup) Issue 21329. * stratoshark -D lists a bunch of network capture devices. Issue 21332.
The following changes have been made since version 0.9.3:
Stratoshark can now read Process Monitor (Procmon) files.
The welcome page has been redesigned to be more informative and easier to navigate. It now highlights the learning sections better and includes a new sidebar with tips and tricks for using Wireshark effectively. The welcome page is now also more accessible, with improved keyboard navigation and screen reader support.
A built-in Lua script debugger has been added. It supports breakpoints, single-stepping, variable inspection, expression evaluation, and stack traces.
Stratoshark now has a theme engine.
Stratoshark now uses the same theme system as Wireshark, driving the colors used throughout the GUI from a single theme instead of many individual color preferences. The renamed preferences page lets you pick a theme, switch between Light, Dark, and System appearance, set the packet pane font, and preview the result. A built-in default theme ships with Stratoshark, and additional themes can be installed as JSONC (JSON with Comments) files. The previous per-color settings (marked and ignored packets, "Follow Stream" client and server text, display filter validity, and the selected packet) are now provided by the active theme. Graph and plot windows (I/O Graph, TCP Stream, SCTP, RTP, and others) now take their grid, text and series colors from the theme, and the display filter field text, packet list row separators, and links stay readable in light and dark themes.
Personal themes can now be dropped as single .jsonc files into $HOME/.local/lib/stratoshark/themes (Unix) or %APPDATA%\Stratoshark\themes (Windows). The exact path is shown in the About dialog’s Folders tab.
On first launch after the upgrade, Stratoshark checks the Default profile’s preferences for customized values of the removed per-color settings. If any are found, a personal theme named Personal (Migrated) is created automatically in the personal themes directory, the legacy keys are removed from the Default profile’s preferences file, and the theme is activated so the original visual customizations are preserved. The migration runs once: the generated personal.jsonc can be edited, renamed, or deleted by hand at any time.
The welcome page section headers ("Open", "Capture", "Learn") and the filter validity tints have been restored to the historical Classic look (Tango sky_blue brand, saturated GTK-era dark green / dark red filter backgrounds).
Selected and hovered rows now share one color family: the hover color of the packet list, details tree, welcome page lists and JSON view is derived from the selection color, so themes no longer define a separate hover color, and the colored gradients of the welcome page header and update bar have been replaced by flat colors. Themes that set packets.selection but not palette.highlight now use that color for selection in lists, the details tree and the bytes pane (and for the welcome page header); palette.highlight still overrides it. The brand.deep color and the header and update gradient tokens are no longer used and can be removed from personal themes. The text of selected and marked rows is now checked against its background when the theme is applied and lifted to a readable contrast (4.5:1) if a theme’s pinned text color would be hard to read, and the text of a pressed button is chosen against the pressed color. The Stratoshark theme uses a deeper teal (#0b828d) for the selection in light mode and pale marked rows (#d9e7ea with dark text) in dark mode, so selected and marked rows are clearly distinguishable.
Zooming ( / ) now scales the whole window, including the capture and display filter fields and other window elements. Previously only the packet list and detail pane text size changed. The new behavior should be much more useful for demos and presentations.
The keyboard shortcuts dialog (About Wireshark → Keyboard Shortcuts) has been moved out of of the About dialog to the menu View → Internals → Keyboard Shortcuts and now has a button to print the list of keyboard shortcuts to an HTML file.
The application icon has been updated to support Liquid Glass on macOS Tahoe.
Stratoshark and strato can now read plain Kubernetes Audit logs and Google Cloud Audit logs, and CloudTrail logs.
The CloudTrail and Google Cloud Audit log plugins have been translated to Rust on macOS and Windows. Issue 20869
The following changes have been made since version 0.9.2:
The Windows installers now ship with Qt 6.8.3. They previously shipped with Qt 6.8.1.
Stratoshark now ships with “strato”, a command line tool similar to tshark.
The Windows and macOS packages now ship with the gcpaudit and k8saudit plugins.
The Falco Events dissector now adds IP geolocation fields alongside IPv4 and IPv6 address fields.
The following changes have been made since version 0.9.1:
A new “Plots” dialog has been added, which provides scatter plots in contrast to the “I/O Graphs” dialog, which provides histograms. The Plots dialog window supports multiple plots, markers, and automatic scrolling.
The Falco Bridge dissector has been renamed to Falco Events. Filter fields now have a "falcoevents" protocol prefix, but a "falcobridge" protocol alias has been added for backward compatibility. Issue 20397
Stratoshark can now show field offsets for supported plugins.
Cloudtrail log messages can now be viewed as formatted JSON data.
The system call dissector now has a "falcoevents.fd.stream" field, which provides a unique number for each file descriptor. The "Follow File Descriptor Stream" feature now uses this field to track streams. Issue 20538
We now ship universal macOS installers instead of separate packages for Arm64 and Intel. Issue 17294
The following changes have been made since version 0.9.0:
The application icons have been updated.
The following bugs have been fixed since version 0.9.3:
In order to work around issue 20869, the macOS package ships with the gcpaudit and k8saudit plugins disabled. In order to enable them, you can rename them from Stratoshark.app/Contents/PlugIns/stratoshark/falco/plugin.so.disabled to Stratoshark.app/Contents/PlugIns/stratoshark/falco/plugin.so.
Interfaces hidden from the welcome page are now remembered across profile switches and restarts. Issue 21325
The following bugs have been fixed since version 0.9.2:
.scap file extension wrongly associated with Wireshark. Issue 20583.
sshdig should have a snaplen option. Issue 20586.
The following bugs have been fixed since version 0.9.1:
Stratoshark help message has Wiresharkisms in it. Issue 20229.
Stratoshark and editcap could write incorrect block types. Merge request 19238.
Stratoshark says I can’t capture on local interfaces. Issue 20494.
Stratoshark: Crash While Sorting on evt.buflen column. Issue 20571.
The following bugs have been fixed since version 0.9.0:
Falco Bridge: Empty frame.protocols field. Issue 20248.
Sysdig event and Falco bridge dissection mismatch due to unsupported pcapng block types. Issue 20358.
Stratoshark can capture system calls locally on Linux and a variety of log sources on Windows, macOS, and Linux.
The following features are either new or have been significantly updated since version 0.9.0:
The welcome screen’s capture-source activity sparklines now keep their history for the whole session. Previously the sparklines, and the activity-first ordering of the source list, were reset whenever you started or stopped a capture or returned to the welcome screen, so the list re-shuffled each time. Now the history persists, the ordering stays stable, and a break in a sparkline marks the interval during which a capture was running (statistics are not sampled while capturing). When a source is dropping packets, the drops are shown as a separate line. Issue 21318
On Linux, Stratoshark can check whether the distribution offers a newer version of the package it was installed from. The check uses PackageKit and never contacts wireshark.org; the update itself is installed through the desktop’s software center (e.g. GNOME Software or KDE Discover). Self-compiled builds and Flatpak, Snap or AppImage installations are not checked. Building with this support requires the optional packagekit-glib2 library, version 1.1.12 or later.
Dumpcap’s TCP@host:port interface has been removed.
Building with Qt 5 is no longer supported.