Today I released the next development version of Wireshark, 1.11.0. This marks a major change in the direction of the project. We’re switching our user interface library from GTK+ to Qt. Both libraries make it easy for developers write applications that will run on different platforms without having to rewrite a lot of code. GTK+ has had a huge impact on the way Wireshark looks and feels and on its popularity but it doesn’t cover our supported platforms as effectively as it should and the situation is getting worse as time goes on.
Making such a large change wasn’t an easy decision. It means rewriting thousands of lines of code and requires a lot of careful design. We might be the largest standalone application to make this transition (feel free to correct me below). However, I think it’s well worth it and that it’s important to the long-term direction of the project. Ultimately it came down to one thing:
Wireshark’s job is to show you what’s happening on your network. If it can’t run on your system then it’s not doing that job.
If you’re using Windows, Mac OS X, or Linux Mint we need to support Windows, Mac OS X, and Linux Mint. If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare and think about supporting IOS and Android at some point.
When I started writing Ethereal (Wireshark’s original name) it looked like this:
It looked like that on Linux and Solaris. It didn’t look like that anywhere else because those were the only two platforms we supported. I chose GTK+ for the user interface toolkit because it made the most sense. Compared to the options available at the time it had a number of advantages. It was small, light, easy to work with, had an active development team, and had a compatible license. A short time later we added support for Windows. GTK+ had some initial compatibility issues on Windows but it has gotten better over time.
Since then the platform landscape has changed but unfortunately GTK+ hasn’t. Most notably Mac OS X has gained popularity and people are starting to ask about Wireshark for their tablets. GTK+ supports OS X but it’s definitely a second-tier platform, making it hard to install and use. We either have to require X11 (like Inkscape) or use an experimental native GTK+ port (like GIMP). Either way it requires a lot of effort on the part of developers to produce a substandard application for users. With GTK+ Wireshark doesn’t look or act at all like a Mac OS X application:
Qt on the other hand provides a nice, clean user experience on all of the platforms that we currently support. If you install the 64-bit version it now looks like this:
What does this mean for users? 🔗
If you’re a power user you should probably keep using the GTK+ flavor for the time being. You should also test the Qt flavor from time to time to see how your workflow will change. Both are installed by default on Windows and Linux.
If you’re running OS X you should use the Qt flavor. For common tasks it should have a better workflow. Again, if it doesn’t we aren’t doing our job.
What does this mean for developers? 🔗
If you’re developing a new feature using GTK+ you should stop. You’re very likely wasting your time. If you would like to help with the migration grab the code and start developing.
What works? 🔗
Everything under the “File” and “Edit” menus.
You can capture, filter, and inspect traffic.
You can edit preferences.
You can follow streams.
You can view TCP stream graphs.
What doesn’t work? 🔗
Everything else. No capture options, I/O graphs, flow graphs, VoIP analysis, etc. We still have a lot of work to do.
Switching to Qt is a long and arduous process but I’m excited about what the future holds.
P.S. Solaris is still supported.
Comments 🔗
Comment by user on 2013-10-16 04:12:28 +0000 🔗
Yay! GIMP dropped X11, and now Wireshark too, thats just super cool )
It would be great if automatic updates would be incorporated at an early stage of the development of the Qt version.
Comment by Laura Chappell on 2013-10-16 22:00:16 +0000 🔗
I’m thrilled at this change. I know it was a difficult decision for the you and the entire development team, but it had to be done. Thanks for all your efforts in moving into this next phase!
Comment by Tekn0 on 2013-10-17 08:10:40 +0000 🔗
Glad you still support Solaris!
Comment by Moschops on 2013-10-17 08:18:24 +0000 🔗
Yeah Solaris! 🙂
Comment by ikt on 2013-10-17 08:25:03 +0000 🔗
Grats!
Comment by Djisse on 2013-10-17 08:50:15 +0000 🔗
Well, you see, in my eyes I don’t really care if a button is a flat or pseudo3d. I just need it at the right place. But that is a good thing to learn as much dev libraries as possible.
Comment by yegle on 2013-10-17 09:02:07 +0000 🔗
Just downloaded the 1.11.0 and installed on OSX, but I can’t find the QT version in it. Where can I find the QT version?
I don’t mind to build it myself.
Comment by james chandler on 2013-10-17 09:09:27 +0000 🔗
There’s a discusson on https://news.ycombinator.com/item?id=6565513 about Qt4 or Qt5 usage. Do you have any thoughts on this matter?
Comment by Max Treskin on 2013-10-17 09:12:00 +0000 🔗
Nice to hear this. I was dreaming about it for seven years. Thank you!
Comment by Gerald Combs on 2013-10-17 09:12:02 +0000 🔗
@yegle Did you install the 32- or 64-bit package? The Qt flavor ships with the 64-bit installer but not the 32-bit one. I’m hoping to move both to Qt at some point. If you want to build a 32-bit version from source you’ll have to recompile Qt as well.
Comment by Todd on 2013-10-17 09:25:30 +0000 🔗
I remember writing cross platform desktop applications… for a product we developed SimoHealth… it was first written in Gtk+ but we migrated to XULRunner. It make it incredibly easy to maintain our C++ backend code but have a JS/HTML/XUL frontend… Very similar to now writing web applications… JS/HTML is very good at cross platform user interface… I’m not sure how XULRunner has evolved since 2005 but it was pretty amazing to work with back then… I’d never consider writing native code for user interface again…
Comment by Miguel de Icaza on 2013-10-17 09:31:30 +0000 🔗
Gtk+ on OSX does not require X11, you can compile it to support Cocoa directly.
Xamarin Studio is built entirely in this way, and this is what it looks like:
http://tirania.org/s/138c98b8.png
You can see more screenshots and videos in action here:
If you are still interested, we can show you how to bundle your own Gtk+ with WireShark to have no external dependencies.
Comment by Markus Goetz on 2013-10-17 09:41:22 +0000 🔗
Yay. I’m so looking forward to not use the ugly unintegrated UI in OS X anymore 🙂
Thanks guys, wireshark is a nice tool.
Comment by Lilian on 2013-10-17 10:09:55 +0000 🔗
Great news guys.
Qt 5 is an amazing “technology”. Well, I guess the mobile version is not that far away after the desktop version is ported…
Comment by fasd on 2013-10-17 10:12:28 +0000 🔗
Yes!!
Comment by Dennis Roberts on 2013-10-17 10:34:17 +0000 🔗
Excellent news. I can’t wait to try out the QT versions.
Comment by Luc on 2013-10-17 10:41:42 +0000 🔗
people are starting to ask about Wireshark for their tablets.
Worked fine for me. Real hackers (in the catb.org/hacker-emblem sense of the word) just run Debian on Android phones 😉
Comment by numerodix on 2013-10-17 11:20:38 +0000 🔗
– We might be the largest standalone application to make this transition (feel free to correct me below).
Vlc also ported from gtk to qt a few years ago. i’m not sure how the ui codebases compare in size.
Comment by Ralph on 2013-10-17 11:34:45 +0000 🔗
As a user, this is a little disappointing. I find Qt apps even worse than GTK+ apps, because Qt tries to look the same as native apps, even though the behavior is still wrong. At least GTK+ looks different, which accurately reflects that it acts different. Current GTK+ Wireshark looks like “a foreign app trying to look like Motif, poorly”, while the new Qt Wireshark looks like “a foreign app trying to look like OS X, poorly”.
The poster child for “free cross platform app using a cross platform GUI toolkit” is perhaps Firefox, which is the most frustrating Mac app in the world, because it looks 99% correct and acts 95% correct for a Mac app. I can sometimes use it for minutes at a time between remembering that the native keyboard shortcuts are only about 75% working (like in this text box).
I’m not a Wireshark developer, so I can’t really criticize. It’s great that you’re supporting this software at all. I guess if it requires less effort “to produce a substandard application for users” by making this switch, then more power to you. There’s not really any free competition, so it’s not like you’re going to lose any users over this. So while I don’t like it, I realize I don’t have a leg to stand on to criticize anyone here.
I wonder how hard it’d be to add a native front-end.
Comment by Nick Arnold on 2013-10-17 12:59:49 +0000 🔗
This is great news for all OSX converts who’ve grown up on Ethereal (and then Wireshark) in a Win/*nix environment. When you gotta go deep in tubes Charles et. al. just dosen’t cut it.
Thank you!
Sincerely,
The Internet
Comment by Tynach on 2013-10-17 13:13:53 +0000 🔗
Hey, just wanted to say, that the large 3D Animation studio project Maya (not open source though) recently switched to Qt instead of… Well, whatever they used before. I’d say that’s a larger software package than Wireshark to switch to Qt.
Comment by Sebastian on 2013-10-17 17:23:18 +0000 🔗
Thank you! Looking forward to the iOS and Android versions 🙂
Comment by yegle on 2013-10-17 20:18:04 +0000 🔗
@Gerald Combs
I’m using the 64bit OSX version but can’t find the QT version anywhere.
P.S. I wish this blog uses disqus comment system so that I can get notification when there’s reply to me…
Comment by b4d on 2013-10-17 23:48:39 +0000 🔗
Looks nice, just add some retina support and we are set 🙂
Comment by filippo on 2013-10-18 01:25:43 +0000 🔗
Greetings,
that makes a lot of sense ! Qt, either under the ruling of TrollTech, or Nokia, or Digia is really an extremely lively project with outstanding support for a large variety of platforms. I remember that I made that big decision almost ten years ago for a large scientific software project with a large GUI module (massXpert) that I was authoring with Gtk+. I never looked back, *really*. The Qt libs for non-GUI stuff are extremely
Comment by Karl Napf on 2013-10-18 03:02:54 +0000 🔗
Welcome to the Qt Community! Great to see the best network analysis tool to finally use the best UI toolkit;-)
Comment by Peter Wairuru on 2013-10-18 03:26:16 +0000 🔗
“We might be the largest standalone application to make this transition”. In as much as these statement is true, i thing we also have Opensot (One of the best video editor for linux) that is transitioning currently in order to support more platforms.
Comment by tux. on 2013-10-18 11:36:43 +0000 🔗
If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare
BAHAHAHAHAHAAHA! mmd 😀 thanks!
Comment by Andrew Ziem on 2013-10-18 14:40:35 +0000 🔗
As the developer of BleachBit (currently supporting Linux and Windows), I am also pondering switching from GTK+ to QT. I am already considering a GUI rewrite to improve functionality and to get off of GTK+ 2, and my main problems on Windows are the native look and bloated installer.
Comment by onox on 2013-10-18 18:48:08 +0000 🔗
Is qt designer still about micromanagement of positions (pixel precision) of UI elements? Or can it do like Glade (app for building GTK+ UI’s) do the right thing by giving elements a sensible padding and spacing, so that it’s very easy to reproduce a UI again (from you brain).
Comment by yama on 2013-10-20 14:19:29 +0000 🔗
@onox: Given that qt designer always was about layouts with padding and spacing and never about pixel positions it sounds a bit like you are asking the question wrongly.
Comment by SmokeX on 2013-10-21 04:12:27 +0000 🔗
Qt designer isn’t the tool of choice these days any way. People do graphical UI design through Qt Creator while the vast majority prefer to use the force and write their UIs entirely in code.
Comment by Robert Smol on 2013-10-21 14:12:17 +0000 🔗
So it seems Miguel actually provided some good insight about GTK on Mac, so this all might not be necessary. Still it would be interesting to hear actuall advanteages from QT over GTK2/GTK3 as you keep coding. I doubt there is real demand fot iPad/Android version, been working in with telco engineers and workstation is still a must today.
Comment by Gerald Combs on 2013-10-21 14:47:12 +0000 🔗
@Robert The big advantage of Qt is that Windows, OS X, and Linux are all tier 1 platforms, complete with SDKs, documentation, active support, and a large, active community. Miguel is doing some amazing work but his experience with GTK+ on OS X is the exact opposite of mine.
The reason I mentioned iOS and Android is that people keep asking for it. The demand is most definitely there.
Comment by Guy Harris on 2013-10-21 18:03:27 +0000 🔗
The biggest problem with Wireshark – or any other network analyzer – on iOS is that you cannot capture traffic on a non-jailbroken iOS machine; you need root access either to open BPF devices or to install a launchd LaunchDaemon to make the BPF devices available to users.
Comment by Sudhir Khanger on 2013-10-22 19:44:46 +0000 🔗
This transition was much warranted. Keep the good work up.
Comment by Frank Salcido on 2013-10-24 14:39:15 +0000 🔗
Great call!
Comment by David Demelier on 2013-10-25 01:15:08 +0000 🔗
Very very great news!
In any case Qt is so much superior to Gtk and so much more convenient to use :-).
No more
gtk_window_get_object_converted_from_my_very_large_number_of_parameters_passed_like_that(GTK_WINDOW(myobject), G_OBJECT(that_super_cast);
Comment by Manis on 2013-11-03 10:27:02 +0000 🔗
The most important question for me is:
Will you keep supporting PowerPC Macs?
And how will Qt affect the look on Ubuntu which is made for GTK+?
Comment by Guy Harris on 2013-11-07 13:13:20 +0000 🔗
Will you keep supporting PowerPC Macs?
1.10 already dropped support for them; if you have a PPC Mac, you’ll have to run 1.8, which will not switch to GTK+.
Comment by Nabeel Sowan on 2013-11-08 07:30:42 +0000 🔗
I like both GTK+ and Qt toolkits.
Qt has for many years been number one when it comes to platform integration on platforms other than X11. So I can understand the need for a change…
Comment by Wycliffe arasa on 2013-11-11 05:19:20 +0000 🔗
Congratulations! Can the new platfom support wireless networks?
Comment by Khoulaiz on 2013-11-16 02:34:25 +0000 🔗
@Gerald Combs
Sorry that I have to repeat the questions regarding the QT version of wireshark for OSX. but I simply can’t find it. Where is it?
I’ve downloaded the 1.11.1 64-bit dmg, installed it and after starting the wireshark app, it tells me that it cannot run it without X11 support. I currently have no XQuartz installed, because of the recent update to Maverick.
Do I miss the correct download or is it a bug in the current package?
Comment by Khoulaiz on 2013-11-16 02:48:20 +0000 🔗
@Gerald Combs
Actually it looks like that the 1.11.1 version doesn’t install wireshark at all. Looks like I am starting the old version. After a complete remove of wireshark and then reinstall I can’t find the wireshark app anywhere.
Comment by Gerald Combs on 2013-11-18 13:54:18 +0000 🔗
@Khoulaiz The OS X packaging issues should be fixed in 1.11.2.
Comment by Jeremy Impson on 2013-11-19 20:01:25 +0000 🔗
Are there any plans to re-work some of the expert mode & packet analysis functions to be less memory intensive, or to be able to use files rather than memory to store computational state? I thinking about functions like RTP stream analysis or using display filters to reduce then export the capture data. Somewhere I read that these deep analysis functions were intrinsically linked to the visualization code, and thus are susceptible to the same memory limitations that Wireshark has when rendering huge captures for display.
I realize ultimately this is a big data problem (and thus not high on Wireshark’s priority list) but I figured I’d ask. I’d love to be able to just run tshark on a huge file without having to chunk it up with editcap beforehand and reassemble it after, hoping I guessed well about what chunk size to use to avoid memory issues.
Regardless, thank you Gerald and the entire dev team for all the work that goes in to producing and maintaining my favorite tool of all time.
Comment by Kelly on 2013-12-02 14:03:55 +0000 🔗
Have capture filters changed in the dev release? Testing out the new Mac OSX build and cant see, to form a valid capture filter..
Comment by Kelly on 2013-12-02 14:33:11 +0000 🔗
Found the 1.11.3 dev build and it fixed my issue mentioned above.