Wireshark is one of the world`s foremost network protocol analyzers, and is the standard in many parts of the industry.
WireShark is a project developed on the base of the one that started in 1998.
Hundreds of developers around the world have contributed to it, and it it still under active development.
Here are some key features of "WireShark":
· Deep inspection of hundreds of protocols, with more being added all the time
· Live capture and offline analysis
· Standard three-pane packet browser
· Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
· Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
· The most powerful display filters in the industry
· Rich VoIP analysis
· Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer (compressed and uncompressed), Sniffer Pro, and NetXray, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
· Capture files compressed with gzip can be decompressed on the fly
· Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
· Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
· Coloring rules can be applied to the packet list for quick, intuitive analysis
· Output can be exported to XML, PostScript, CSV, or plain text
Requirements:
· Apple`s X11
What`s New in This Release: [ read full changelog ]
Bug Fixes:
· Wireshark is unresponsive when capturing from named pipes on Windows. (Bug 1759)
· Crash when sorting column while capturing. (Bug 4273)
· Ring buffers are no longer turned on by default when using multiple capture files.
New and Updated Features:
· Wireshark is now distributed as an installation package rather than a drag-installer on OS X. The installer adds a startup item that should make it easier to capture packets.
· Large file (greater than 2 GB) support has been improved.
· Wireshark and TShark can import text dumps, similar to text2pcap.
· You can now view Wireshark`s dissector tables (for example the TCP port to dissector mappings) from the main window.
· Wireshark can export SSL session keys via File???Export???SSL Session Keys...
· TShark can show a specific occurrence of a field when using `-T fields`.
· Custom columns can show a specific occurrence of a field.
· You can hide columns in the packet list.
· Wireshark can now export SMB objects.
· dftest and randpkt now have manual pages....
