Wireshark 4.4.0 has been released and it includes a lot of improvements and updates since version 4.2.0 was released last November. I’ll cover some highlights here, but you will definitely want to check out the release notes1 for details.
Graph Dialogs 🔗
Many bugs have been fixed in the graph dialogs (I/O Graphs, Sequence Diagrams, and TCP Stream Graphs), and performance has been improved.
The following improvements have been made to the I/O Graphs dialog:
- The minimum interval is now 1 microsecond.
- The Y axis now uses SI prefixes.
- Bar graphs are rendered more sensibly.
- The graph list can be reordered by dragging and dropping items.
- Graph legends and layer orders always match the graph list order.
- The legend can be moved by right-clicking on it.
The Sequence Diagram (Flow Graphs and VoIP Calls) dialog has been improved as well:
- The entire graph can be exported as an image. Previously, only the items on screen were exported.
- Endpoints with the same address are now displayed correctly.
The TCP Stream Graphs dialog does a better job of identifying the client and server sides of connections.
Custom Columns 🔗
You can now add custom columns that do the following:
-
Use arithmetic. For example,
frame.len * 8will show the frame length in bits instead of bytes. -
Show the raw bytes of fields using the
@operator. For example,@ip.srcwill show the raw bytes of the IPv4 source address. -
Logical tests like
tcp.port == 443will show a check mark in the column when the check matches.
Other Updates 🔗
There are a whole bunch of display filter updates and improvements. If you’re a power user you will definitely want to check them out.
The “Follow Stream” dialog can now show delta times and turns.
You can now add a display filter to a configuration profile. When you open a capture file, Wireshark will automatically switch to that profile if the filter matches.
Links 🔗
-
The complete Wireshark 4.4.0 release notes can be found at https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html ↩︎