Wireshark 4.4.2 Released: What’s New!

The Wireshark Foundation has officially announced the release of Wireshark 4.4.2, the latest version of the world’s most popular network protocol analyzer.

Wireshark is wide use in troubleshooting, analysis, development, and educational purposes, Wireshark continues to be a vital tool for network professionals and enthusiasts.

The nonprofit Wireshark Foundation, which promotes protocol analysis education, emphasizes the importance of community contributions to sustain its work.

Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar

Major Bug Fixes and Security Updates

The release focuses on resolving several security vulnerabilities and bugs:

Security Fixes

• wnpa-sec-2024-14: Fixed an infinite loop issue in the FiveCo RAP dissector (Issue 20176).
• wnpa-sec-2024-15: Resolved a crash in the ECMP dissector (Issue 20214).

Notable Bug Fixes

• Resolved an issue where CIP I/O was no longer detected by the “enip” filter (Issue 19517).
• Fixed crashes related to dumpcap when run from TShark with a capture filter (Issue 20108).
• Corrected improper parsing of Wi-Fi 256 Block Ack (BA) frames (Issue 20156).
• Addressed a crash when using the “Follow TCP stream” feature (Issue 20174).
• Fixed decompression failures for HTTP/2 bodies with padded frames (Issue 20167).
• Corrected statistics-related crashes in the I/O Graph when using the simple moving average (Issue 20163).
• Enhanced stability for macOS users by addressing interface disconnections and DMG notarization issues (Issues 20082 and 20129).

Other fixes included improvements to protocol dissectors such as SIP (Session Initiation Protocol), Modbus, and USB CCID, along with addressing various user interface issues, including crashes when dragging fields in the packet details view.

New Features and Updates

While no new protocols were introduced in this version, several existing protocols received updates, including:

• Updated Protocol Support: ARTNET, BACapp, HTTP/2, IEEE 802.11, SIP, TCP, and more.
• Improved Capture File Support: Enhanced BLF file decoding.

Additionally, display filters now handle floating-point conversion errors more accurately, and the Lua API has been updated to support comma-separated ranges in various locales.

TShark Syntax Changes

A notable improvement for TShark users is the updated syntax for dumping fields with a specific prefix. The command has been changed from -G fields prefix to -G fields,prefix, allowing more flexibility and compatibility with configuration profiles.

Previous Enhancements in Wireshark 4.4.0

Released earlier, Wireshark 4.4.0 introduced several significant improvements:

• Automatic profile switching, enabling Wireshark to adapt profiles based on captured file filters.
• Support for Lua 5.3 and 5.4, enhancing scripting capabilities.
• Custom column creation using advanced field expressions, arithmetic calculations, and protocol modifiers.

The 4.4.0 version also boasted performance improvements, such as building with zlib-ng for faster compressed file handling.

How to Get Wireshark 4.4.2

Wireshark’s source code and installation packages are available for download at wireshark.org/download. Linux and Unix users can also check their platform-specific package management systems for updates.

With its focus on reliability and security, Wireshark 4.4.2 is a recommended update for all users.

Those interested in supporting the project can do so by visiting wiresharkfoundation.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial