We’re switching to Qt.

Today I released the next development version of Wireshark, 1.11.0. This marks a major change in the direction of the project. We’re switching our user interface library from GTK+ to Qt. Both libraries make it easy for developers write applications that will run on different platforms without having to rewrite a lot of code. GTK+ has had a huge impact on the way Wireshark looks and feels and on its popularity but it doesn’t cover our supported platforms as effectively as it should and the situation is getting worse as time goes on.

Making such a large change wasn’t an easy decision. It means rewriting thousands of lines of code and requires a lot of careful design. We might be the largest standalone application to make this transition (feel free to correct me below). However, I think it’s well worth it and that it’s important to the long-term direction of the project. Ultimately it came down to one thing:

Wireshark’s job is to show you what’s happening on your network. If it can’t run on your system then it’s not doing that job.

If you’re using Windows, Mac OS X, or Linux Mint we need to support Windows, Mac OS X, and Linux Mint. If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare and think about supporting IOS and Android at some point.

When I started writing Ethereal (Wireshark’s original name) it looked like this:


It looked like that on Linux and Solaris. It didn’t look like that anywhere else because those were the only two platforms we supported. I chose GTK+ for the user interface toolkit because it made the most sense. Compared to the options available at the time it had a number of advantages. It was small, light, easy to work with, had an active development team, and had a compatible license. A short time later we added support for Windows. GTK+ had some initial compatibility issues on Windows but it has gotten better over time.

Since then the platform landscape has changed but unfortunately GTK+ hasn’t. Most notably Mac OS X has gained popularity and people are starting to ask about Wireshark for their tablets. GTK+ supports OS X but it’s definitely a second-tier platform, making it hard to install and use. We either have to require X11 (like Inkscape) or use an experimental native GTK+ port (like GIMP). Either way it requires a lot of effort on the part of developers to produce a substandard application for users. With GTK+ Wireshark doesn’t look or act at all like a Mac OS X application:


Qt on the other hand provides a nice, clean user experience on all of the platforms that we currently support. If you install the 64-bit version it now looks like this:


What does this mean for users?

If you’re a power user you should probably keep using the GTK+ flavor for the time being. You should also test the Qt flavor from time to time to see how your workflow will change. Both are installed by default on Windows and Linux.

If you’re running OS X you should use the Qt flavor. For common tasks it should have a better workflow. Again, if it doesn’t we aren’t doing our job.

What does this mean for developers?

If you’re developing a new feature using GTK+ you should stop. You’re very likely wasting your time. If you would like to help with the migration grab the code and start developing.

What works?

Everything under the “File” and “Edit” menus.

You can capture, filter, and inspect traffic.

You can edit preferences.

You can follow streams.

You can view TCP stream graphs.

What doesn’t work?

Everything else. No capture options, I/O graphs, flow graphs, VoIP analysis, etc. We still have a lot of work to do.

Switching to Qt is a long and arduous process but I’m excited about what the future holds.

P.S. Solaris is still supported.


48 thoughts on “We’re switching to Qt.

  1. user

    Yay! GIMP dropped X11, and now Wireshark too, thats just super cool )
    It would be great if automatic updates would be incorporated at an early stage of the development of the Qt version.

  2. Laura Chappell

    I’m thrilled at this change. I know it was a difficult decision for the you and the entire development team, but it had to be done. Thanks for all your efforts in moving into this next phase!

  3. Djisse

    Well, you see, in my eyes I don’t really care if a button is a flat or pseudo3d. I just need it at the right place. But that is a good thing to learn as much dev libraries as possible.

  4. yegle

    Just downloaded the 1.11.0 and installed on OSX, but I can’t find the QT version in it. Where can I find the QT version?

    I don’t mind to build it myself.

  5. Gerald Combs Post author

    @yegle Did you install the 32- or 64-bit package? The Qt flavor ships with the 64-bit installer but not the 32-bit one. I’m hoping to move both to Qt at some point. If you want to build a 32-bit version from source you’ll have to recompile Qt as well.

  6. Todd

    I remember writing cross platform desktop applications… for a product we developed SimoHealth… it was first written in Gtk+ but we migrated to XULRunner. It make it incredibly easy to maintain our C++ backend code but have a JS/HTML/XUL frontend… Very similar to now writing web applications… JS/HTML is very good at cross platform user interface… I’m not sure how XULRunner has evolved since 2005 but it was pretty amazing to work with back then… I’d never consider writing native code for user interface again…

  7. Lilian

    Great news guys.
    Qt 5 is an amazing “technology”. Well, I guess the mobile version is not that far away after the desktop version is ported…

  8. Luc

    > people are starting to ask about Wireshark for their tablets.

    Worked fine for me. Real hackers (in the catb.org/hacker-emblem sense of the word) just run Debian on Android phones πŸ˜‰

  9. numerodix

    – We might be the largest standalone application to make this transition (feel free to correct me below).

    Vlc also ported from gtk to qt a few years ago. i’m not sure how the ui codebases compare in size.

  10. Ralph

    As a user, this is a little disappointing. I find Qt apps even worse than GTK+ apps, because Qt tries to look the same as native apps, even though the behavior is still wrong. At least GTK+ looks different, which accurately reflects that it acts different. Current GTK+ Wireshark looks like “a foreign app trying to look like Motif, poorly”, while the new Qt Wireshark looks like “a foreign app trying to look like OS X, poorly”.

    The poster child for “free cross platform app using a cross platform GUI toolkit” is perhaps Firefox, which is the most frustrating Mac app in the world, because it looks 99% correct and acts 95% correct for a Mac app. I can sometimes use it for minutes at a time between remembering that the native keyboard shortcuts are only about 75% working (like in this text box).

    I’m not a Wireshark developer, so I can’t really criticize. It’s great that you’re supporting this software at all. I guess if it requires less effort “to produce a substandard application for users” by making this switch, then more power to you. There’s not really any free competition, so it’s not like you’re going to lose any users over this. So while I don’t like it, I realize I don’t have a leg to stand on to criticize anyone here.

    I wonder how hard it’d be to add a native front-end.

  11. Nick Arnold

    This is great news for all OSX converts who’ve grown up on Ethereal (and then Wireshark) in a Win/*nix environment. When you gotta go deep in tubes Charles et. al. just dosen’t cut it.

    Thank you!

    The Internet

  12. Tynach

    Hey, just wanted to say, that the large 3D Animation studio project Maya (not open source though) recently switched to Qt instead of… Well, whatever they used before. I’d say that’s a larger software package than Wireshark to switch to Qt.

  13. yegle

    @Gerald Combs

    I’m using the 64bit OSX version but can’t find the QT version anywhere.
    P.S. I wish this blog uses disqus comment system so that I can get notification when there’s reply to me…

  14. filippo


    that makes a lot of sense ! Qt, either under the ruling of TrollTech, or Nokia, or Digia is really an extremely lively project with outstanding support for a large variety of platforms. I remember that I made that big decision almost ten years ago for a large scientific software project with a large GUI module (massXpert) that I was authoring with Gtk+. I never looked back, *really*. The Qt libs for non-GUI stuff are extremely

  15. Karl Napf

    Welcome to the Qt Community! Great to see the best network analysis tool to finally use the best UI toolkit;-)

  16. Peter Wairuru

    “We might be the largest standalone application to make this transition”. In as much as these statement is true, i thing we also have Opensot (One of the best video editor for linux) that is transitioning currently in order to support more platforms.

  17. tux.

    If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare

    BAHAHAHAHAHAAHA! mmd πŸ˜€ thanks!

  18. Andrew Ziem

    As the developer of BleachBit (currently supporting Linux and Windows), I am also pondering switching from GTK+ to QT. I am already considering a GUI rewrite to improve functionality and to get off of GTK+ 2, and my main problems on Windows are the native look and bloated installer.

  19. onox

    Is qt designer still about micromanagement of positions (pixel precision) of UI elements? Or can it do like Glade (app for building GTK+ UI’s) do the right thing by giving elements a sensible padding and spacing, so that it’s very easy to reproduce a UI again (from you brain).

  20. yama

    @onox: Given that qt designer always was about layouts with padding and spacing and never about pixel positions it sounds a bit like you are asking the question wrongly.

  21. SmokeX

    Qt designer isn’t the tool of choice these days any way. People do graphical UI design through Qt Creator while the vast majority prefer to use the force and write their UIs entirely in code.

  22. Robert Smol

    So it seems Miguel actually provided some good insight about GTK on Mac, so this all might not be necessary. Still it would be interesting to hear actuall advanteages from QT over GTK2/GTK3 as you keep coding. I doubt there is real demand fot iPad/Android version, been working in with telco engineers and workstation is still a must today.

  23. Gerald Combs Post author

    @Robert The big advantage of Qt is that Windows, OS X, and Linux are all tier 1 platforms, complete with SDKs, documentation, active support, and a large, active community. Miguel is doing some amazing work but his experience with GTK+ on OS X is the exact opposite of mine.

    The reason I mentioned iOS and Android is that people keep asking for it. The demand is most definitely there.

  24. Guy Harris

    The biggest problem with Wireshark – or any other network analyzer – on iOS is that you cannot capture traffic on a non-jailbroken iOS machine; you need root access either to open BPF devices or to install a launchd LaunchDaemon to make the BPF devices available to users.

  25. David Demelier

    Very very great news!

    In any case Qt is so much superior to Gtk and so much more convenient to use :-).

    No more

    gtk_window_get_object_converted_from_my_very_large_number_of_parameters_passed_like_that(GTK_WINDOW(myobject), G_OBJECT(that_super_cast);

  26. Manis

    The most important question for me is:
    Will you keep supporting PowerPC Macs?
    And how will Qt affect the look on Ubuntu which is made for GTK+?

  27. Guy Harris

    Will you keep supporting PowerPC Macs?

    1.10 already dropped support for them; if you have a PPC Mac, you’ll have to run 1.8, which will not switch to GTK+.

  28. Nabeel Sowan

    I like both GTK+ and Qt toolkits.
    Qt has for many years been number one when it comes to platform integration on platforms other than X11. So I can understand the need for a change…

  29. Khoulaiz

    @Gerald Combs
    Sorry that I have to repeat the questions regarding the QT version of wireshark for OSX. but I simply can’t find it. Where is it?
    I’ve downloaded the 1.11.1 64-bit dmg, installed it and after starting the wireshark app, it tells me that it cannot run it without X11 support. I currently have no XQuartz installed, because of the recent update to Maverick.
    Do I miss the correct download or is it a bug in the current package?

  30. Khoulaiz

    @Gerald Combs
    Actually it looks like that the 1.11.1 version doesn’t install wireshark at all. Looks like I am starting the old version. After a complete remove of wireshark and then reinstall I can’t find the wireshark app anywhere.

  31. Jeremy Impson

    Are there any plans to re-work some of the expert mode & packet analysis functions to be less memory intensive, or to be able to use files rather than memory to store computational state? I thinking about functions like RTP stream analysis or using display filters to reduce then export the capture data. Somewhere I read that these deep analysis functions were intrinsically linked to the visualization code, and thus are susceptible to the same memory limitations that Wireshark has when rendering huge captures for display.

    I realize ultimately this is a big data problem (and thus not high on Wireshark’s priority list) but I figured I’d ask. I’d love to be able to just run tshark on a huge file without having to chunk it up with editcap beforehand and reassemble it after, hoping I guessed well about what chunk size to use to avoid memory issues.

    Regardless, thank you Gerald and the entire dev team for all the work that goes in to producing and maintaining my favorite tool of all time.

  32. Kelly

    Have capture filters changed in the dev release? Testing out the new Mac OSX build and cant see, to form a valid capture filter..

Comments are closed.