Announcement on The Official Wireshark Blog

Those Aren't Packets: How Stratoshark Brings the Power of Wireshark to the Cloud

Wed, 22 Jan 2025 15:00:00 +0000

For over 25 years, network professionals have relied on Wireshark packet captures (pcaps) to analyze and troubleshoot network system behavior. But packets are scarce in the cloud. Is it possible to get the same level of visibility and granularity there? And if so, is there an opportunity to leverage the same principles that have made Wireshark so ubiquitous?

Well, the answer to both questions is yes. We’ve named this new tool Stratoshark, and it’s powered by system calls.

One of the things that has contributed to Wireshark’s success is that it is part of the pcap ecosystem, which is centered around libpcap and the pcap and pcapng file formats. It all started with tcpdump, and over time other tools appeared. The ecosystem now includes Zeek (formerly Bro), Snort, WinPcap, nmap, nTop, Kismet, Suricata, and many others.

Each tool focuses on its specific job but together form a collective powerhouse. A common file format means that you can pivot between each tool with little to no effort. For example, you can take a capture file from Zeek or Snort and load it into Wireshark for detailed analysis. If you take a step back and look at the ecosystem as a whole, you might wonder if that same effectiveness and success can be applied elsewhere. As it turns out, with system calls, it can.

If you’re not familiar with system calls (this is a networking blog, after all), they can be thought of as a boundary between your operating system and all of the applications running on your system. Any time an application wants to do something useful, such as opening a file, connecting to the Internet, or playing a sound, it uses system calls. This is true whether you’re running on Windows, macOS, Linux, or any other OS. System calls can also be used to enforce security boundaries. For example, if an application tries to read or write a file that it shouldn’t, the operating system can say “no.”

If you can tap into that boundary and see what system calls each application is using you can get an excellent view into your system’s behavior. This is what tools like Falco and Sysdig OSS do. Sysdig OSS is a command line tool that works much like tcpdump, and prints system call activity on your terminal screen. Falco works much like an IDS, constantly monitors syscall activity, sending alerts whenever it finds something suspicious. Falco and Sysdig OSS are part of the scap (system capture) ecosystem. This ecosystem is based around the libscap library, which can capture system calls and read and write .scap files, and libsinsp, which enriches the information captured by libscap by adding information such as usernames and file paths. Libscap also has a plugin interface that lets you capture from other sources, such as cloud providers and application logs.

What if we took the powerful analysis features of Wireshark and made it possible to analyze the system call and log data provided by libscap and libsinsp? I’m thrilled to announce that we did that, and it’s called Stratoshark.

Stratoshark is a sibling application to Wireshark that lets you analyze system calls and logs. If you look closely at the screenshot below, it should look familiar to anyone who’s used Wireshark. However, the first thing you might notice is that those aren’t packets. In this case, they’re a capture of the curl utility downloading a file. If you scroll through the event list you can see the various system calls that it uses to get up and running, from loading its dynamic libraries to reading certificate files to connecting to the remote server. You can see the process name, user name, file paths, and other useful information. In this particular instance, I’ve selected an event that reads a dynamic library. After dissecting the system call, Stratoshark proceeds further and dissects the executable header in the library file itself.

I’m really excited about Stratoshark because it lets you peer into the inner workings of systems in the same way that Wireshark lets you peer into the inner workings of networks. I hope that you find it useful, and I’m looking forward to seeing how Stratoshark grows and evolves as part of the scap ecosystem.

You can download Stratoshark for Windows and macOS and find a link to its source code at stratoshark.org. If you’d like to learn more you can find information at the following locations.

Stratoshark: Extending Wireshark’s legacy into the cloud on the Sysdig blog
How Falco and Wireshark paved the way for Stratoshark on the Sysdig blog
Getting Started With Stratoshark on Josh Clark’s blog
How to capture an SCAP for Stratoshark on Medium
Stratoshark on the Wireshark wiki

What’s New In Wireshark 4.4?

Wed, 28 Aug 2024 21:05:31 +0000

Wireshark 4.4.0 has been released and it includes a lot of improvements and updates since version 4.2.0 was released last November. I’ll cover some highlights here, but you will definitely want to check out the release notes¹ for details.

Graph Dialogs 🔗

Many bugs have been fixed in the graph dialogs (I/O Graphs, Sequence Diagrams, and TCP Stream Graphs), and performance has been improved.

The following improvements have been made to the I/O Graphs dialog:

The minimum interval is now 1 microsecond.
The Y axis now uses SI prefixes.
Bar graphs are rendered more sensibly.
The graph list can be reordered by dragging and dropping items.
Graph legends and layer orders always match the graph list order.
The legend can be moved by right-clicking on it.

The new bar graphs and intervals

The Sequence Diagram (Flow Graphs and VoIP Calls) dialog has been improved as well:

The entire graph can be exported as an image. Previously, only the items on screen were exported.
Endpoints with the same address are now displayed correctly.

The TCP Stream Graphs dialog does a better job of identifying the client and server sides of connections.

Custom Columns 🔗

You can now add custom columns that do the following:

Use arithmetic. For example, frame.len * 8 will show the frame length in bits instead of bytes.
Show the raw bytes of fields using the @ operator. For example, @ip.src will show the raw bytes of the IPv4 source address.
Logical tests like tcp.port == 443 will show a check mark in the column when the check matches.

Other Updates 🔗

There are a whole bunch of display filter updates and improvements. If you’re a power user you will definitely want to check them out.

The “Follow Stream” dialog can now show delta times and turns.

You can now add a display filter to a configuration profile. When you open a capture file, Wireshark will automatically switch to that profile if the filter matches.

Automatic profile switching

Links 🔗

The complete Wireshark 4.4.0 release notes can be found at https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html ↩︎

Wireshark Is 25: The email that started it all and the lessons learned along the way

Fri, 14 Jul 2023 16:14:30 +0000

25 years ago, I sent this email, which ended up changing the course of my life

From: Gerald Combs - Unicom Communications <gerald [at] … >
To: gtk-list [at] redhat . com
Subject: ANNOUNCE: Ethereal 0.2.0
Date: Tue, 14 Jul 1998 21:47:01 -0500 (CDT)

Ethereal is a network analyzer that lets you capture and interactively
browse the contents of Ethernet frames.  Packet data can be read from a
file, or live from a local network interface.

More information, including the source distribution, can be found at
http://ethereal.zing.org . 

Comments and patches are welcome.

I remember being nervous and excited at the time, wondering what the reaction would be. I had spent the previous few months working on a protocol analyzer, which was something I needed at work.

There are a couple of things to note: the name wasn’t Wireshark (we changed the name in 2006) and at the time of this email, protocol analyzers were rare, you could even say a precious thing. Back then, if you wanted to see what was happening on your network, command line tools like tcpdump and snoop were available at no cost, but if you wanted a GUI analyzer, you had to pay for a product that might cost the equivalent of a luxury car. I needed an analyzer to do my job, so I ended up writing a simple one and releasing it as open source.

As it turned out, other people needed an analyzer too. A couple of days after I sent this email, I received a patch. Then another, and another. This quickly blossomed into a thriving developer community which has kept me busy ever since. In the intervening years, the project and its community have grown beyond any expectation that I could have had. Today, Wireshark is used by people around the world to make their networks fast, reliable, and secure, and educators use it to teach the next generation of security and network engineers about the low-level aspects of networks.

What does it take to keep a project successful for so long? It would be nice to be able to say that from the very beginning, there was a grand, clear vision of how everything would evolve and unfold. However, as with any significant endeavor, you have to learn to adapt and apply the resources at hand as effectively as you can. In retrospect, Neils Bohr’s quote

“An expert is a person who has made all the mistakes that can be made in a very narrow field.”

rings especially true in our case. I did manage to learn that in order for an open source project to grow and thrive, you have to ensure that needs are met in the following categories:

User support. Living, breathing people make use of your project, and sometimes need assistance. They might be daily power users or novices, and their needs vary.

Educator support. Experts and power users can teach others how to get the most out of your project, and need assistance as well.

Developer support. The easier you can make it for people to contribute code or otherwise improve the project, the healthier the project and community will be.

Attorneys and accountants. Until GitHub and GitLab add “intellectual property law” or “travel reimbursement” buttons, you’re going to need to find outside help for the regulatory, legal, and financial aspects of your project.

Infrastructure. You need servers, containers, and services that provide an online presence and allow for collaboration. GitHub or GitLab may or may not be sufficient for this depending on your specific needs.

This isn’t quite a Maslow-style hierarchy of needs for open source, but it’s close. The lines between users, educators, and developers can be blurry, but in general, users and educators depend on the output that developers produce, and the project as a whole needs a solid infrastructure in order for everyone to collaborate.

It also doesn’t apply uniformly to all projects. For example, a small, single-purpose image processing library might only need infrastructure and developers, and its user community would likely be other developers. A hosting service like GitHub or GitLab would be sufficient for the project’s infrastructure. On the other hand, a large, feature-rich image editing application might have extensive needs in all five categories along with a business model to fund the project.

Wireshark falls into the latter group, and needs quite a bit of care and feeding. Until recently, the business model for meeting these needs has been “ask my employer if they’ll host the project,” which worked surprisingly well. My employers (CACE Technology, Riverbed and now Sysdig) provided the resources for Wireshark that go way beyond what GitHub and GitLab can offer, such as SharkFest, a conference dedicated to protocol analysis.

In recent years, it became clear that the project would best meet its needs by standing on its own, and with the help of Sysdig, we moved the project to the Wireshark Foundation earlier this year so that the project can continue to grow and serve its community.

25 years ago when I sent that email, I never thought I would be blogging about the project today! If you’ve ever thought about starting an open source project, don’t hesitate to do so. Supporting and managing Wireshark has given me a wonderful career, and opportunities to meet and work with brilliant, inspiring people. If I had to distill everything I’ve learned down to a couple of pieces of advice, it would be this:

The community has valuable insights to share. Let them do that.

Don’t be afraid to start something new. You never know where it might take you 25 years from now.

Finally, I can’t thank you all enough for using and contributing to Wireshark over the years. I can’t wait to see what the future brings. Cheers!

Comments 🔗

Comment by Mike B on 2023-07-15 10:58:05 +0000 🔗

Congratulations on 25 years! Thank you for everything you have done to make my job and the jobs of many thousands easier.

Comment by J. Zandbergen on 2023-07-15 12:38:53 +0000 🔗

Hi Gerald,

Congratulations on 25 years wireshark! Thank you so much for ~20 years of lessons learned and problems fixed!

Cheers!

Comment by Dan on 2023-07-15 15:13:16 +0000 🔗

Congrats! it must take a ton of effort and motivation to keep going for 25 years!

Comment by John on 2023-07-15 17:57:58 +0000 🔗

Thank you for so many fixes in many production environment because of Wireshark!

Comment by John on 2023-07-15 17:59:16 +0000 🔗

*environments :)). I may need to run wireshark on my keyboard

Comment by Teknik Industri on 2023-07-16 17:15:23 +0000 🔗

What is the significance of “Wireshark Is 25: The email that started it all and the lessons learned along the way” in relation to Wireshark?

Comment by nicholas ng on 2023-07-21 13:27:43 +0000 🔗

Happy 25th birthday wirrshark

Announcing the Wireshark Foundation

Wed, 01 Mar 2023 16:06:20 +0000

The thing that I most love about working on Wireshark is our community. Our users, educators, and developers have a passion for packets and protocols, and their work is important – modern society runs on computer networks and those networks need to be reliable, fast, and secure. I’m grateful that my employers and other sponsors have ensured that the community has had the resources to grow and thrive over the years.

This is why I’m beyond thrilled to announce that the Wireshark community now has a permanent home: the Wireshark Foundation. The foundation is a 501(c)(3) nonprofit and will host SharkFest, our developer and user conference, help to facilitate Wireshark’s development, and promote analysis and troubleshooting education.

The project leadership and I have been working on this for a long time, and many other people have generously given their time and expertise in order to make this happen. In particular I’d like to thank the following people for helping to make this a reality: the Wireshark core development team for providing much needed support and advice, and for making all of this possible. Sheri Najafi and Angelo Spampinato for keeping the foundation running, and along with Janice Spampinato, bringing us SharkFest. CACE Technologies for being the first home of SharkFest, Riverbed for taking up that mantle and hosting the project for so many years, and Loris Degioanni and everyone else at Sysdig for providing the resources necessary to get us across the finish line.

2023 is shaping up to be a great year for the project. Along with the foundation, we will celebrate our 25th anniversary in July, and we will be meeting in person again at SharkFest in Asia, the U.S., and in Europe. See you there!

You can learn more (and donate of course) at wiresharkfoundation.org.

If you or your employer would like to become a foundation member, you can learn more at https://wiresharkfoundation.org/pdf/become-a-member.pdf.

You can find Sysdig’s press release at https://sysdig.com/press-releases/wireshark-foundation/.

Comments 🔗

Comment by wireblog on 2023-04-03 22:17:09 +0000 🔗

this news is great and we know more about wireshark.

Comment by techradarto on 2023-04-06 20:08:20 +0000 🔗

celebrating 25th anniversary, that news was great .

What’s New In Wireshark 4.0?

Tue, 04 Oct 2022 23:22:08 +0000

Wireshark 4.0 was released today, and as you might have guessed from the version number, quite a few things have changed since 3.6. If you are a regular Wireshark user we recommend that you pay close attention to the release notes this time around, since it includes quite a few changes. I’ll cover some highlights here, but the release notes go into much greater detail.

Display Filter Changes 🔗

Display filters are one of Wireshark’s defining features and 4.0 makes them more powerful and more consistent. These improvements give you more control over the way that multiple occurrences of the same field are handled, let you do arithmetic, and many other things.

First, let’s look at the way multiple field occurrences are handled. Suppose you want to filter on an IPv4 source address. Within Wireshark that means using the “ip.src” filter field. You might assume that the packets on your network have one IPv4 header and therefore one source address, but that’s not necessarily the case. You might be in an environment that uses some form of tunneling like GRE or one of the many VPN protocols, and even on simple networks ICMP errors carry the IPv4 header of the offending packet. Maybe you live on the edge and used scapy to create a packet with a hundred or a thousand layers of IP in IP nesting.

In any case a filter like “ip.src == 10.1.2.3” can be ambiguous. Even worse, Wireshark has a completely made up “ip.addr” field, which is an alias for both “ip.src” and “ip.dst”. It’s convenient, but it also means you’re guaranteed to have two “ip.addr” fields for each IPv4 header which means guaranteed ambiguity.

In order to reduce this ambiguity Wireshark 4.0 adds a layer operator, which lets you select a specific occurrence of a field. To use the layer operator, just put a number sign and a layer number after a field. For example, if we have a GRE packet with both outer and inner IPv4 layers,

ip.src#1 == 10.1.2.3

will match the outer address,

ip.src#2 == 10.1.2.3

will match the inner address, and

ip.src == 10.1.2.3

will match either address.

Along with layers, you can be much more specific about matching zero, one or more, or all fields in a particular packet. You have been able to do the following comparison operators since Wireshark’s inception:

ip.addr == 10.100.100.1

If any of these match, we have a winner.

not ip.addr == 10.100.100.1

If none of these match we have a winner.

Wireshark also has “!=” (not equal), which was a bit confusing in past versions. This was fixed in Wireshark 3.6:

ip.addr != 10.100.100.1

In Wireshark 3.4 and earlier, if any of these don’t match, we have a winner. In Wireshark 3.6 and later, if none of these match, we have a winner.

Wireshark 4.0 adds the following:

ip.addr any_eq 10.100.100.1

If any of these match, we have a winner, similar to “==”.

ip.addr all_ne 10.100.100.1

If none of these match, we have a winner, similar to “!=” in version 3.6 and later.

ip.addr === 10.100.100.1
ip.addr all_eq 10.100.100.1

If all addresses match, we have a winner.

ip.addr !== 10.100.100.1
ip.addr any_ne 10.100.100.1

If any addresses don’t match, we have a winner, similar to “!=” in version 3.4 and earlier.

You can also do arithmetic – you can add, subtract, multiply, and divide. You can use the modulo (%) operator, which gives you the remainder of integer division. Suppose your company has all of its web servers running on a port that ends in 443: 443, 1443, 5443, 21443, etc. You can use the modulo operator to match them like so:

{tcp.port % 1000} == 443

There are a bunch of other changes as well. You can now match bytes starting from the end of a PDU, dates and times can be specified as UTC, Unicode can be matched using code points,

Default main window layout 🔗

In past releases Wireshark followed a standard set by its predecessors and placed the packet list, packet detail, and byte view on top of each other, like so:

That standard was set a long time ago when most monitors had a 4:3 aspect ratio and lower resolutions than they do these days. As of Wireshark 4.0, the default is for the detail and byte view to be next to each other, which makes it easier to take advantage of the real estate available on modern displays:

Conversations and Endpoints 🔗

The Conversations and Endpoints dialogs have been a popular feature for a long time and are often the first place people look when investigating a problem. Wireshark 4.0 makes them more powerful and easier to use. For example, you can tear off tabs — you can now see TCP and UDP conversations side by side in separate windows. Sorting has been improved, you can now hide columns, filter on stream IDs, and export data as JSON.

Hex import 🔗

Sometimes the packets you’re interested in aren’t in a nice pcap or pcapng file that you can just open with Wireshark, and are instead buried in a hex dump. Wireshark provides two ways to convert hex dumps to pcaps: “Import From Hex Dump” in the main application and the text2pcap utility. They had different feature sets and behaved differently in past versions, but they are much more consistent in Wireshark 4.0.

What’s Going Away 🔗

We no longer ship official 32-bit Windows packages for Wireshark 4.0 and later. If you’re still using a 32-bit Windows system, we’ll keep shipping Wireshark 3.6 updates until 2024. You won’t be able to take advantage of the cool new features in 4.0 and later, unfortunately.

What’s Not Here Yet 🔗

There are two features for Windows that we’d really like to add, but didn’t make the cut for 4.0: Dark mode and Arm64 support. Dark mode requires support from Qt, our user interface library. It’s still a work in progress, but we’re hoping it will make its way into Wireshark 4.2.

Building packages for Arm64 requires build hardware and software library support. We hope to have both of those in place for Wireshark 4.2 as well.

If You’re A Developer 🔗

We now require a C11 compiler, the PCRE2 library, and updated versions of many of the third party libraries that we use. We no longer require Perl to build Wireshark.

Summary 🔗

There are a bunch of other new features and improvements coming your way in Wireshark 4.0. Thanks to all of the developers that helped make this happen!

Comments 🔗

Comment by Guy Harris on 2022-10-05 06:35:19 +0000 🔗

Note that “Arm64 support” here specifically refers to Windows binary packages distributed from wireshark.org.

If, for example, a Linux distribution supports Arm64, they may provide Arm64 packages, whether source or binary, for current or past Wireshark versions. The issue is, as Gerald noted, an issue of wireshark.org building binary packages.

Furthermore, we already provide Arm64 binary packages of Wireshark 3.6.8 and, now, 4.0 for macOS.

Comment by Kara on 2022-10-05 14:52:09 +0000 🔗

Good

Comment by Totzi on 2022-10-26 08:14:58 +0000 🔗

YEAY!

We Have A New Sponsor

Thu, 13 Jan 2022 16:48:56 +0000

I’m excited to announce that Wireshark has a new home. I recently accepted a job with Sysdig, and along with that, they are now Wireshark’s primary sponsor.

I’m excited for a couple of reasons. First, I get to work with Sysdig’s founder, Loris Degioanni. We’ve been friends for a long time, and it’s difficult to summarize the impact he’s had on Wireshark. We first met in the early days of the project, back when it was still called Ethereal. At the time he was busy developing the WinPcap packet capture library, which was a natural fit for Ethereal and let us include Windows users in our community. This was a pivotal milestone for the project and it helped us grow into what it is today.

This isn’t the first time he’s asked me to join a company he founded. In 2006, my family and I moved halfway across the U.S. where I joined him at CACE Technologies and he welcomed us to our new town. We renamed the project to Wireshark and proceeded to build a line of products that complemented it. This was another pivotal time for Wireshark. We started hosting SharkFest, our developer and user conference. It allows the community to meet and share ideas in person, and it’s hard to overstate its importance to the project. I was (finally!) able to work on Wireshark full time, and with the help of our wonderful community, it grew to be the world’s most popular network protocol analyzer.

I’m also excited because Wireshark has a great sponsor in Sysdig. I was delighted to find that he’s built a wonderful company culture here. Everyone I’ve met is bright and creative, and open source is a huge part of the company and its culture. They sponsor the Sysdig system visibility tool (which Loris created) and the Falco runtime security tool. As part of Sysdig I’ll be applying what I’ve learned about low-level visibility to cloud environments.

Sysdig’s sponsorship will ensure that Wireshark and its community continues to grow. Wireshark has a wonderful community of users, developers, and educators and the work they do is important. Sysdig is cognizant of that and committed to supporting that community. They will continue to host SharkFest and support the community that builds and delivers the world’s best protocol analyzer.

Finally, I’d like to thank Riverbed for being such a great sponsor for so many years prior to this. Wireshark has been fortunate over its lifetime to have sponsors dedicated to supporting its community, and Riverbed deserves recognition for being a huge part of that.

Comments 🔗

Comment by tony fortunato on 2022-01-14 13:41:08 +0000 🔗

great to hear and excited to see what the future will hold.

Comment by Al Swanke on 2022-01-14 15:34:32 +0000 🔗

This is awesome! Congratulations Gerald!

The Cloudflare Incident And Its Impact On Wireshark.org

Sat, 25 Feb 2017 18:39:29 +0000

Cloudflare recently announced a security incident that potentially impacts anyone who visited various wireshark.org and winpcap.org sites for the past six months.

What happened? 🔗

Cloudflare is a popular service that provides content delivery, DDoS protection and DNS services for web sites.

A software bug Cloudflare’s servers leaked potentially sensitive information. Some of that information ended up in caches all over the Internet. At Google, Microsoft, your ISP, your company’s or university’s proxy servers, and elsewhere. Due to the randomness and distributed nature of the bug, it’s difficult to know what the full impact is. Cloudflare provides the following estimate:

“The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (thatâ€™s about 0.00003% of requests).”

The bug was introduced on September 22, 2016 and fixed on February 18th, 2017.

The Google Project Zero bug describing the issue in detail can be found at https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

Cloudflare’s incident report can be found at https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

The initial Hacker News discussion can be found at https://news.ycombinator.com/item?id=13718752

Was Wireshark affected? 🔗

The following wireshark.org and winpcap.org sites were behind Cloudflare proxies during the period in question:

ask.wirehsark.org
blog.wireshark.org
bugs.wireshark.org
sharkfest.wireshark.org
sharkfesteurope.wireshark.org
wiki.wireshark.org
www.wireshark.org
www.winpcap.org

Wireshark’s download servers (*.dl.wireshark.org), buildbot.wireshark.org and code.wireshark.org were not behind Cloudflare.

I browsed to a one of the sites listed above between September 22nd, 2016 and February 18th, 2017. Am I affected? 🔗

The chances are slim, but those chances are not zero.

Most of the content that we serve is “static” and “public.” That is, it’s the same for everyone and doesn’t contain any sensitive information. The risk exposed by Cloudflare is from dynamic content that contains sensitive information such as the login page on ask, bugs, wiki, etc. Our web sites get frequent requests for static content, but dynamic requests are relatively infrequent.

In a world where everyone has infinite free time I would have no qualms about recommending that everyone with a wireshark.org account change his or her passwords. However, this is the real world and your time is valuable. If you logged in to one of our sites and used a unique password it might not be worth your time to change it. On the other hand, if your professional reputation depends on your ask.wireshark.org score you probably should. If you have any sort of administrative access you definitely should. Most of our users fall into the first category.

If you’re wondering why it looks like I’m downplaying the importance of changing your wireshark.org passwords, see the next question.

I used a web browser, smart phone, or an internet-connected wearable doohickey between September 22nd, 2016 and February 18th, 2017. Am I affected? 🔗

I honestly don’t know. The chances are almost certainly not zero.

Cloudflare is a very popular service. At the time of this writing an unofficial list of affected sites stands at more than four million entries and counting. It includes many of the world’s most popular web sites.

If you’re going to spend time changing passwords, doing so for sites that deal with finance, email, DNA testing, dating, and other parts of your personal life probably ranks higher than that for, say, the Wireshark wiki.

Isn’t a vague answer like “the chances are slim but not zero” a frustratingly craptastic one compared to a definitive “yes” or “no”? 🔗

Yes, but it’s also the honest and correct one.

Update: March 2, 2017 🔗

Yesterday Cloudflare posted an update on the issue at https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. In it they posted the following leak estimates:

 Requests per Month       Anticipated Leaks
 ------------------       -----------------
        200B â€“ 300B         22,356 â€“ 33,534
        100B â€“ 200B         11,427 â€“ 22,356
         50B â€“ 100B          5,962 â€“ 11,427
          10B â€“ 50B           1,118 â€“ 5,926
           1B â€“ 10B             112 â€“ 1,118
          500M â€“ 1B                56 â€“ 112
        250M â€“ 500M                 25 â€“ 56
        100M â€“ 250M                 11 â€“ 25
         50M â€“ 100M                  6 â€“ 11
          10M â€“ 50M                   1 â€“ 6
              < 10M                     < 1

The affected wireshark.org web sites get just over 10M requests per month combined. Private traffic is substantially less than that.

Comments 🔗

Comment by Graham Bloice on 2017-02-27 04:12:48 +0000 🔗

And the implications if using a remote authentication service rather than a password held on a Wireshark service, e.g. OAuth?

Comment by Greg Gill on 2017-03-04 13:10:47 +0000 🔗

Not a good news at all.
“I browsed to a one of the sites listed above between September 22nd, 2016 and February 18th, 2017. Am I affected? The chances are slim, but those chances are not zero”

Comment by Dustin DeTorres on 2017-03-23 04:48:57 +0000 🔗

Is there anything a user should do?

Getting Ready for SharkFest ’16

Thu, 09 Jun 2016 20:32:44 +0000

The week leading up to SharkFest is always a busy and hectic time around here, but it’s also exciting. I can’t wait to see everyone, and the talks and labs this year promise to continue our tradition of imparting protocol analysis knowledge and insight.

If you’re sill unsure about attending, perhaps this list of reasons for attending that Laura Chappell recently posted will sway you:

1. Gerald Combs and the Wireshark Developers

Gerald Combs, the creator of Wireshark (formerly Ethereal), and many of the core developers will be there actually working on the code in the Developer’s Den. They will be presenting many of the sessions, joining in on the social events (they are a fun group!) and sharing tips and techniques to improve your analysis process.

2. Wireshark Experts as Presenters and Varied Content Levels

There is no dispute that the presenters at SharkFest are the world-authorities on troubleshooting, security analysis, and network optimization. These are the folks who live in the world at packet-levelÂ and can spot a rogue packet at 50 paces! Through a variety of introductory through advanced lectures and hands-on labs, these presenters will show you some hot Wireshark techniques to speed up your time to resolution.

3. Focus on Wireshark 2

It’s time to move up to Wireshark 2. All the presentations and labs at SharkFest ’16 will be focused around the new version of Wireshark. From new features to new techniques, accelerate your migration to Wireshark 2 by getting an inside look at how the experts work their magic.

4. The Reef at SharkFest

I will be hosting The Reef again at SharkFest. The Reef will host hands-on lab exercises, numerous Wireshark University Certified Instructors, Wireshark experts, and Wireshark Developers. Come in and try your hand at the labs and pick up the SharkFest Packet Challenge. This is a great opportunity to mingle amongst Wireshark gurus and hone your troubleshooting and network forensics skills.

5. Hands-On Labs

Get your hands dirty in one of the lab sessions at SharkFest. This year we have added a 100-seat hands-on classroom to SharkFest. This is in addition to the 300+ seater Hahn auditorium. We will also have numerous lab exercises hosted in the Reef and folks to help out on the more challenging labs.

6. Social Events and Peer Networking

The SharkFest team has put together a Welcome Dinner, Vendor Night Party, “Sake’s Surprise” Dinner, and Closing Reception to give you plenty of time to network with other analysts. The casual atmosphere of the Grand Hall lunch area and the Reef offer plenty of opportunities to meet and mingle with other attendees and the developers.

7. Packet Challenge

Again, you will have the chance to test your skills in the SharkFest Packet Challenge. Pick up the Challenge Worksheet in the Reef and grab the USB stick filled with trace files. Turn in your answers in the Reef by Wednesday evening and join us for the Packet Challenge Awards Ceremony in the closing keynote timeslot.

8. Analysis-Focused Vendors

Vendor night is a highlight of the event. As the band plays and the food sizzles on the grill, visit the vendors who sponsor SharkFest. Each vendor is focused on network analysis, troubleshooting, security, optimization and other related topics. These are the folks we all work with to build the most effective analysis environments possible.

9. Computer History Museum and the Revolution

Considered one of the world’s best collection of historical objects relating to the computer industry, the Computer History Museum is a must-see destination for folks in the tech industry! During SharkFest, you will have time to visit the Revolution exhibit to see history in the making. This is our second year at the Computer History Museum – it’s an amazing venue.

10. Sake’s Surprise

I can’t wait to give you more details on this one. Right now, the surprise is in development. It should really be a highlight at SharkFest ’16. As soon as I’m allowed to spill the beans, I will!

11. Troubleshooting with Wireshark Pre-Conference Class

As an extra here, I will be teaching a 3-day class just before SharkFest. The focus is troubleshooting, troubleshooting, troubleshooting! Get the bundle pricing for SharkFest and the 3-day class at https://sharkfest.wireshark.org/registration16.html.

If you can’t attend SharkFest U.S., these reasons also apply to SharkFest Europe. If you are attending either conference, I’ll see you there!

Comments 🔗

Comment by Richard Stewart on 2016-06-10 14:19:47 +0000 🔗

**NOT A COMMENT – QUERY ON RSS FEED!! **
Hi
Couldn’t find a contact address, so am posting this here….
RSS feed at ‘https://blog.wireshark.org/feed/’ appears badly broken – validation through ‘http://validator.w3.org/feed/’ shows multiple errors. Discovered this as I use Outlook as my RSS reader. Any chance you could look at it/fix it please?

Cool New Stuff

Wed, 17 Dec 2014 16:57:16 +0000

Hello everybody, we’ve got a handful of miscellaneous announcements for you today. They all just happened to occur within a handful of days, so it made more sense to lump them all into one post.

Development version 1.99.1 was released, another milestone on the road to 2.0 and our shiny new Qt interface. You can read the full announcement with release notes here, and download it from the “Development Release” section of here!
Tweet tweet! That’s right, we have an official twitter handle now for announcements and the like. It is shared by several of the core developers, but mostly run by our fearless leader Gerald. Follow us @WiresharkNews to find out more!
Thanks to the hard work of our Debian maintainer Bálint, we now have an Ubuntu PPA (Personal Package Archive) containing the latest stable Wireshark releases pre-built for all the supported Ubuntu releases. If you’ve ever wanted the latest and greatest Wireshark on an older version of Ubuntu, now’s your chance, so get it here.
Last but not least (although this one’s older – it actually launched way back in June), our repository now has an official github mirror. Please note that this is a convenience only; pull requests and issues will still go through our existing Gerrit and Bugzilla sites. The github mirror is very much *just* a mirror, but it is handy to have none-the-less.

That’s all we’ve got for you today, hopefully one or more of the above items caught your eye.

Wireshark 1.12 Officially Released!

Thu, 31 Jul 2014 22:40:45 +0000

We are proud to announce the release of Wireshark 1.12.0! This is a fairly significant release for us, as we expect it to be the very last release using the GTK toolkit in the default interface (see this post for our plans to replace it).

Wireshark 1.12 contains a substantial number of fixes and new features, representing just over a year of development effort. Check out the release notes for full information on what’s new and improved, and download it now!

If you have any issues with the new version, please file a report in our bug tracker.

Comments 🔗

Comment by L.Grove on 2014-08-05 10:37:44 +0000 🔗

Version 1.12 does not capture IEC61850 MMS massage any more. The MMS will be shown in T.125. This is not right.

Comment by Evan Huus on 2014-08-05 12:14:43 +0000 🔗

@L.Grove this is not the best place for bug reports: please file an issue in Bugzilla (https://bugs.wireshark.org/bugzilla/)

Comment by L.Grove on 2014-08-07 08:49:35 +0000 🔗

@Evan Huus, thanks, I didn’t know there is bugzilla

Comment by Andy Konecny on 2014-08-09 18:50:36 +0000 🔗

The install faults on one bit, that it uninstalls the previous version, and only then tells me there may be issues running it on XP and it recommends the version it just uninstalled. Kind of backwards.
Yes some of us are still stuck with some XP around because software doesn’t self recompile its own architecture to work on Vista+, especially when the source code is no longer available. Think about that great tool you found on the internet who’s author passed away years ago.
So far version 1.12 hasn’t blown up on XP.

Comment by Graham Bloice on 2014-08-10 04:12:51 +0000 🔗

@ Andy Konency, from the release notes:

2.4. Platform Support

Support for Windows XP has been deprecated. We will make an effort to support it for as long as possible but our ability to do so depends on upstream packages and other factors beyond our control.

However the installer could warn XP users before doing anything.

Comment by ladroop on 2014-08-11 08:42:45 +0000 🔗

i’m not a specialist in this but i used it to capture some packages from a rtmpt stream (filter rtmpt.function.response).
version 1.10.7 captures them , version 1.12 does not

Comment by Evan Huus on 2014-08-11 08:58:08 +0000 🔗

@ladroop this is not the best place for bug reports: please file an issue in Bugzilla (https://bugs.wireshark.org/bugzilla/)

Comment by OSX Fangirl on 2014-08-14 10:48:21 +0000 🔗

So I see wireshark still requires X11. Double U, Tee, Eff m8?

Comment by Evan Huus on 2014-08-14 11:09:58 +0000 🔗

@OSXFangirl this is the very last release requiring X11 – as mentioned in the post we are in the process of moving from GTK+ to Qt, which includes a native OSX UI among other goodies. I believe the x64 development builds (the “1.99” versions at https://www.wireshark.org/download/automated/osx/) already ship with a basic Qt UI, though it is by no means complete yet.

Comment by Idan on 2014-08-23 09:22:41 +0000 🔗

Evan,
Just wondering whether the new UI will support retina displays, right now it looks quite pixelated.

Comment by Evan Huus on 2014-08-23 10:42:55 +0000 🔗

@Idan I don’t know; I imagine Qt does support retina for the things it provides, but we may need to do some work on our end to provide retina logos etc. Perhaps try asking on one of our mailing lists: https://www.wireshark.org/lists/

To Infinity and Beyond! Capturing Forever with Tshark

Tue, 08 Jul 2014 00:57:25 +0000

Over the last couple of years that I’ve been involved with Wireshark, one issue has reared its head a significant number of times in a surprisingly varied number of ways. These range from “Capturing with tshark uses more and more memory!” to “I set tshark to capture in the background, and it keeps crashing!” to “How do I set up tshark to capture forever?”

Historically we’ve had no good answer to these complaints – Wireshark and tshark both only do what is called stateful dissection. This means that they store what they’ve seen in memory and use that information to provide additional details about future packets, for example by matching requests with responses. While this provides substantial benefits — reassembly of protocols over TCP being probably the most obvious — it means that as the amount of traffic increases, so does the amount of memory needed to store all of that state. It also means that there’s no way for tshark to run forever unless you’ve got infinite memory (what’s your secret!?) or no traffic at all.

All of that has just changed. Wireshark and tshark have long had a feature that lets you rotate your packet capture across multiple files, preventing any one file from getting too large; to do this, check out the “-b” flag to tshark. This was handy for systems limited in disk space, but did nothing for the ever-growing memory usage. A few days ago, however, I landed a change in tshark’s master branch that makes it discard its internal state every time the capture rotates to a new file. This has one huge benefit: you can now capture (theoretically) forever with tshark by using the “-b” flag!

Like any experimental change however, it does currently have a number of limitations:

State is lost when we switch to a new file, so if two fragments of the same message get split across that file boundary, they will not be reassembled. This is effectively unavoidable – while we considered discarding only very old state, this turns out to be extremely difficult with our current architecture. However, the result is that the dissection you get when capturing with “-b” should actually be closer now to the dissection you get when opening the individual files after the fact.
Discarding state can be a surprisingly expensive operation, so captures using this feature in high-traffic environments may see their dissection fall behind when switching to a new file. If you see this, please file a bug report with as much detail as you can provide, and we will try to smooth out the rough edges.
Memory usage might still grow a very small amount due to previously-hidden memory leaks now being much more obvious. Again, if you see anything problematic, please file a bug report.
This feature is limited to tshark only, it is not available in the graphical Wireshark interface. The graphical interface has to permit scrolling backwards to look at previously dissected packets, so it can’t discard anything until the entire capture is closed. (Edit: This isn’t strictly true – now that I’ve actually checked my assumptions, it should be possible to make the GUI behave the same way. It will take some additional work though.)
This feature is limited to the master branch only, it will not be in the upcoming 1.12 release. Given the substantial nature of the change, it was decided that it needed a chance to cook before being released as a “stable” feature. It is, however, present in the 1.99 automated development builds as of this morning.

Please test it out and let us know what you think. Happy capturing!

Comments 🔗

Comment by Scott on 2014-07-07 21:03:19 +0000 🔗

I can’t see the reasoning for continuous analysis. If there’s a problem, more often than not, in my experience, a multi-hour or multi-day trace will reveal the source of the problem.

And more to the point, how the heck can pouring through that much information–a continuous capture– produce any improvement? There are incremental opportunities to be sure, but that much information is just not practical. I know. That’s how we were packaging the data just to appease some people asking for it. Not worth it.

Comment by Jim Baxter - PacketIQ on 2014-07-08 06:23:04 +0000 🔗

Great article – Thanks, Evan. Do I correctly interpret your discussion to mean that the graphical Wireshark interface can’t discard state to free memory when using the Ring Buffer option? Wasn’t aware of that.

Comment by Evan Huus on 2014-07-08 12:48:15 +0000 🔗

@Scott People keep asking for it, so there must be use cases somewhere.

@Jim My apologies – you correctly interpreted my post, but I hadn’t checked one of my assumptions, so it should be possible to make the GUI behave the same way. I’ll have to take a look at that.

Comment by Anders Broman on 2014-07-10 03:25:36 +0000 🔗

@Scott

I can’t see the reasoning for continuous analysis. If there’s a problem, more often than not, in my >experience, a multi-hour or multi-day trace will reveal the source of the problem.

That’s exactly it. That might not be possible without Evans change as tshark might run out of memory quite quickly under heavy traffic. Chosing the ring buffer file size apropriatly you would get chunks of a managable size for a given time period.

Comment by Paul Offord on 2014-07-13 00:03:37 +0000 🔗

Hi Evan,

Interesting article.

We run a lot of continuous captures to catch intermittent problems. We have always used dumpcap directly to avoid the memory problem. What advantage would we get running tshark rather than dumpcap.

Cheers…Paul

Comment by Evan Huus on 2014-07-13 05:51:12 +0000 🔗

@Paul

Instantaeous alerting. Dumcap doesn’t do dissection, so if you want to actually find out what’s going on in the traffic you capture that way, you have to pull it off the server and run tshark/wireshark on it separately (in other words, it’s useful diagnostically after the fact, but can’t be used to detect errors itself). With tshark running continuous dissection you get the packets dissected right away, so you can actually raise alerts on that information if something is wrong, without waiting for the application proper to complain.

We’re switching to Qt.

Tue, 15 Oct 2013 21:29:13 +0000

Today I released the next development version of Wireshark, 1.11.0. This marks a major change in the direction of the project. We’re switching our user interface library from GTK+ to Qt. Both libraries make it easy for developers write applications that will run on different platforms without having to rewrite a lot of code. GTK+ has had a huge impact on the way Wireshark looks and feels and on its popularity but it doesn’t cover our supported platforms as effectively as it should and the situation is getting worse as time goes on.

Making such a large change wasn’t an easy decision. It means rewriting thousands of lines of code and requires a lot of careful design. We might be the largest standalone application to make this transition (feel free to correct me below). However, I think it’s well worth it and that it’s important to the long-term direction of the project. Ultimately it came down to one thing:

Wireshark’s job is to show you what’s happening on your network. If it can’t run on your system then it’s not doing that job.

If you’re using Windows, Mac OS X, or Linux Mint we need to support Windows, Mac OS X, and Linux Mint. If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare and think about supporting IOS and Android at some point.

When I started writing Ethereal (Wireshark’s original name) it looked like this:

It looked like that on Linux and Solaris. It didn’t look like that anywhere else because those were the only two platforms we supported. I chose GTK+ for the user interface toolkit because it made the most sense. Compared to the options available at the time it had a number of advantages. It was small, light, easy to work with, had an active development team, and had a compatible license. A short time later we added support for Windows. GTK+ had some initial compatibility issues on Windows but it has gotten better over time.

Since then the platform landscape has changed but unfortunately GTK+ hasn’t. Most notably Mac OS X has gained popularity and people are starting to ask about Wireshark for their tablets. GTK+ supports OS X but it’s definitely a second-tier platform, making it hard to install and use. We either have to require X11 (like Inkscape) or use an experimental native GTK+ port (like GIMP). Either way it requires a lot of effort on the part of developers to produce a substandard application for users. With GTK+ Wireshark doesn’t look or act at all like a Mac OS X application:

Qt on the other hand provides a nice, clean user experience on all of the platforms that we currently support. If you install the 64-bit version it now looks like this:

What does this mean for users? 🔗

If you’re a power user you should probably keep using the GTK+ flavor for the time being. You should also test the Qt flavor from time to time to see how your workflow will change. Both are installed by default on Windows and Linux.

If you’re running OS X you should use the Qt flavor. For common tasks it should have a better workflow. Again, if it doesn’t we aren’t doing our job.

What does this mean for developers? 🔗

If you’re developing a new feature using GTK+ you should stop. You’re very likely wasting your time. If you would like to help with the migration grab the code and start developing.

What works? 🔗

Everything under the “File” and “Edit” menus.

You can capture, filter, and inspect traffic.

You can edit preferences.

You can follow streams.

You can view TCP stream graphs.

What doesn’t work? 🔗

Everything else. No capture options, I/O graphs, flow graphs, VoIP analysis, etc. We still have a lot of work to do.

Switching to Qt is a long and arduous process but I’m excited about what the future holds.

P.S. Solaris is still supported.

Comments 🔗

Comment by user on 2013-10-16 04:12:28 +0000 🔗

Yay! GIMP dropped X11, and now Wireshark too, thats just super cool )
It would be great if automatic updates would be incorporated at an early stage of the development of the Qt version.

Comment by Laura Chappell on 2013-10-16 22:00:16 +0000 🔗

I’m thrilled at this change. I know it was a difficult decision for the you and the entire development team, but it had to be done. Thanks for all your efforts in moving into this next phase!

Comment by Tekn0 on 2013-10-17 08:10:40 +0000 🔗

Glad you still support Solaris!

Comment by Moschops on 2013-10-17 08:18:24 +0000 🔗

Yeah Solaris! 🙂

Comment by ikt on 2013-10-17 08:25:03 +0000 🔗

Grats!

Comment by Djisse on 2013-10-17 08:50:15 +0000 🔗

Well, you see, in my eyes I don’t really care if a button is a flat or pseudo3d. I just need it at the right place. But that is a good thing to learn as much dev libraries as possible.

Comment by yegle on 2013-10-17 09:02:07 +0000 🔗

Just downloaded the 1.11.0 and installed on OSX, but I can’t find the QT version in it. Where can I find the QT version?

I don’t mind to build it myself.

Comment by james chandler on 2013-10-17 09:09:27 +0000 🔗

There’s a discusson on https://news.ycombinator.com/item?id=6565513 about Qt4 or Qt5 usage. Do you have any thoughts on this matter?

Comment by Max Treskin on 2013-10-17 09:12:00 +0000 🔗

Nice to hear this. I was dreaming about it for seven years. Thank you!

Comment by Gerald Combs on 2013-10-17 09:12:02 +0000 🔗

@yegle Did you install the 32- or 64-bit package? The Qt flavor ships with the 64-bit installer but not the 32-bit one. I’m hoping to move both to Qt at some point. If you want to build a 32-bit version from source you’ll have to recompile Qt as well.

Comment by Todd on 2013-10-17 09:25:30 +0000 🔗

I remember writing cross platform desktop applications… for a product we developed SimoHealth… it was first written in Gtk+ but we migrated to XULRunner. It make it incredibly easy to maintain our C++ backend code but have a JS/HTML/XUL frontend… Very similar to now writing web applications… JS/HTML is very good at cross platform user interface… I’m not sure how XULRunner has evolved since 2005 but it was pretty amazing to work with back then… I’d never consider writing native code for user interface again…

Comment by Miguel de Icaza on 2013-10-17 09:31:30 +0000 🔗

Gtk+ on OSX does not require X11, you can compile it to support Cocoa directly.

Xamarin Studio is built entirely in this way, and this is what it looks like:

http://tirania.org/s/138c98b8.png

You can see more screenshots and videos in action here:

http://xamarin.com/

If you are still interested, we can show you how to bundle your own Gtk+ with WireShark to have no external dependencies.

Comment by Markus Goetz on 2013-10-17 09:41:22 +0000 🔗

Yay. I’m so looking forward to not use the ugly unintegrated UI in OS X anymore 🙂
Thanks guys, wireshark is a nice tool.

Comment by Lilian on 2013-10-17 10:09:55 +0000 🔗

Great news guys.
Qt 5 is an amazing “technology”. Well, I guess the mobile version is not that far away after the desktop version is ported…

Comment by fasd on 2013-10-17 10:12:28 +0000 🔗

Yes!!

Comment by Dennis Roberts on 2013-10-17 10:34:17 +0000 🔗

Excellent news. I can’t wait to try out the QT versions.

Comment by Luc on 2013-10-17 10:41:42 +0000 🔗

people are starting to ask about Wireshark for their tablets.

Worked fine for me. Real hackers (in the catb.org/hacker-emblem sense of the word) just run Debian on Android phones 😉

Comment by numerodix on 2013-10-17 11:20:38 +0000 🔗

– We might be the largest standalone application to make this transition (feel free to correct me below).

Vlc also ported from gtk to qt a few years ago. i’m not sure how the ui codebases compare in size.

Comment by Ralph on 2013-10-17 11:34:45 +0000 🔗

As a user, this is a little disappointing. I find Qt apps even worse than GTK+ apps, because Qt tries to look the same as native apps, even though the behavior is still wrong. At least GTK+ looks different, which accurately reflects that it acts different. Current GTK+ Wireshark looks like “a foreign app trying to look like Motif, poorly”, while the new Qt Wireshark looks like “a foreign app trying to look like OS X, poorly”.

The poster child for “free cross platform app using a cross platform GUI toolkit” is perhaps Firefox, which is the most frustrating Mac app in the world, because it looks 99% correct and acts 95% correct for a Mac app. I can sometimes use it for minutes at a time between remembering that the native keyboard shortcuts are only about 75% working (like in this text box).

I’m not a Wireshark developer, so I can’t really criticize. It’s great that you’re supporting this software at all. I guess if it requires less effort “to produce a substandard application for users” by making this switch, then more power to you. There’s not really any free competition, so it’s not like you’re going to lose any users over this. So while I don’t like it, I realize I don’t have a leg to stand on to criticize anyone here.

I wonder how hard it’d be to add a native front-end.

Comment by Nick Arnold on 2013-10-17 12:59:49 +0000 🔗

This is great news for all OSX converts who’ve grown up on Ethereal (and then Wireshark) in a Win/*nix environment. When you gotta go deep in tubes Charles et. al. just dosen’t cut it.

Thank you!

Sincerely,
The Internet

Comment by Tynach on 2013-10-17 13:13:53 +0000 🔗

Hey, just wanted to say, that the large 3D Animation studio project Maya (not open source though) recently switched to Qt instead of… Well, whatever they used before. I’d say that’s a larger software package than Wireshark to switch to Qt.

Comment by Sebastian on 2013-10-17 17:23:18 +0000 🔗

Thank you! Looking forward to the iOS and Android versions 🙂

Comment by yegle on 2013-10-17 20:18:04 +0000 🔗

@Gerald Combs

I’m using the 64bit OSX version but can’t find the QT version anywhere.
P.S. I wish this blog uses disqus comment system so that I can get notification when there’s reply to me…

Comment by b4d on 2013-10-17 23:48:39 +0000 🔗

Looks nice, just add some retina support and we are set 🙂

Comment by filippo on 2013-10-18 01:25:43 +0000 🔗

Greetings,

that makes a lot of sense ! Qt, either under the ruling of TrollTech, or Nokia, or Digia is really an extremely lively project with outstanding support for a large variety of platforms. I remember that I made that big decision almost ten years ago for a large scientific software project with a large GUI module (massXpert) that I was authoring with Gtk+. I never looked back, *really*. The Qt libs for non-GUI stuff are extremely

Comment by Karl Napf on 2013-10-18 03:02:54 +0000 🔗

Welcome to the Qt Community! Great to see the best network analysis tool to finally use the best UI toolkit;-)

Comment by Peter Wairuru on 2013-10-18 03:26:16 +0000 🔗

“We might be the largest standalone application to make this transition”. In as much as these statement is true, i thing we also have Opensot (One of the best video editor for linux) that is transitioning currently in order to support more platforms.

Comment by tux. on 2013-10-18 11:36:43 +0000 🔗

If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare

BAHAHAHAHAHAAHA! mmd 😀 thanks!

Comment by Andrew Ziem on 2013-10-18 14:40:35 +0000 🔗

As the developer of BleachBit (currently supporting Linux and Windows), I am also pondering switching from GTK+ to QT. I am already considering a GUI rewrite to improve functionality and to get off of GTK+ 2, and my main problems on Windows are the native look and bloated installer.

Comment by onox on 2013-10-18 18:48:08 +0000 🔗

Is qt designer still about micromanagement of positions (pixel precision) of UI elements? Or can it do like Glade (app for building GTK+ UI’s) do the right thing by giving elements a sensible padding and spacing, so that it’s very easy to reproduce a UI again (from you brain).

Comment by yama on 2013-10-20 14:19:29 +0000 🔗

@onox: Given that qt designer always was about layouts with padding and spacing and never about pixel positions it sounds a bit like you are asking the question wrongly.

Comment by SmokeX on 2013-10-21 04:12:27 +0000 🔗

Qt designer isn’t the tool of choice these days any way. People do graphical UI design through Qt Creator while the vast majority prefer to use the force and write their UIs entirely in code.

Comment by Robert Smol on 2013-10-21 14:12:17 +0000 🔗

So it seems Miguel actually provided some good insight about GTK on Mac, so this all might not be necessary. Still it would be interesting to hear actuall advanteages from QT over GTK2/GTK3 as you keep coding. I doubt there is real demand fot iPad/Android version, been working in with telco engineers and workstation is still a must today.

Comment by Gerald Combs on 2013-10-21 14:47:12 +0000 🔗

@Robert The big advantage of Qt is that Windows, OS X, and Linux are all tier 1 platforms, complete with SDKs, documentation, active support, and a large, active community. Miguel is doing some amazing work but his experience with GTK+ on OS X is the exact opposite of mine.

The reason I mentioned iOS and Android is that people keep asking for it. The demand is most definitely there.

Comment by Guy Harris on 2013-10-21 18:03:27 +0000 🔗

The biggest problem with Wireshark – or any other network analyzer – on iOS is that you cannot capture traffic on a non-jailbroken iOS machine; you need root access either to open BPF devices or to install a launchd LaunchDaemon to make the BPF devices available to users.

Comment by Sudhir Khanger on 2013-10-22 19:44:46 +0000 🔗

This transition was much warranted. Keep the good work up.

Comment by Frank Salcido on 2013-10-24 14:39:15 +0000 🔗

Great call!

Comment by David Demelier on 2013-10-25 01:15:08 +0000 🔗

Very very great news!

In any case Qt is so much superior to Gtk and so much more convenient to use :-).

No more

gtk_window_get_object_converted_from_my_very_large_number_of_parameters_passed_like_that(GTK_WINDOW(myobject), G_OBJECT(that_super_cast);

Comment by Manis on 2013-11-03 10:27:02 +0000 🔗

The most important question for me is:
Will you keep supporting PowerPC Macs?
And how will Qt affect the look on Ubuntu which is made for GTK+?

Comment by Guy Harris on 2013-11-07 13:13:20 +0000 🔗

Will you keep supporting PowerPC Macs?

1.10 already dropped support for them; if you have a PPC Mac, you’ll have to run 1.8, which will not switch to GTK+.

Comment by Nabeel Sowan on 2013-11-08 07:30:42 +0000 🔗

I like both GTK+ and Qt toolkits.
Qt has for many years been number one when it comes to platform integration on platforms other than X11. So I can understand the need for a change…

Comment by Wycliffe arasa on 2013-11-11 05:19:20 +0000 🔗

Congratulations! Can the new platfom support wireless networks?

Comment by Khoulaiz on 2013-11-16 02:34:25 +0000 🔗

@Gerald Combs
Sorry that I have to repeat the questions regarding the QT version of wireshark for OSX. but I simply can’t find it. Where is it?
I’ve downloaded the 1.11.1 64-bit dmg, installed it and after starting the wireshark app, it tells me that it cannot run it without X11 support. I currently have no XQuartz installed, because of the recent update to Maverick.
Do I miss the correct download or is it a bug in the current package?

Comment by Khoulaiz on 2013-11-16 02:48:20 +0000 🔗

@Gerald Combs
Actually it looks like that the 1.11.1 version doesn’t install wireshark at all. Looks like I am starting the old version. After a complete remove of wireshark and then reinstall I can’t find the wireshark app anywhere.

Comment by Gerald Combs on 2013-11-18 13:54:18 +0000 🔗

@Khoulaiz The OS X packaging issues should be fixed in 1.11.2.

Comment by Jeremy Impson on 2013-11-19 20:01:25 +0000 🔗

Are there any plans to re-work some of the expert mode & packet analysis functions to be less memory intensive, or to be able to use files rather than memory to store computational state? I thinking about functions like RTP stream analysis or using display filters to reduce then export the capture data. Somewhere I read that these deep analysis functions were intrinsically linked to the visualization code, and thus are susceptible to the same memory limitations that Wireshark has when rendering huge captures for display.

I realize ultimately this is a big data problem (and thus not high on Wireshark’s priority list) but I figured I’d ask. I’d love to be able to just run tshark on a huge file without having to chunk it up with editcap beforehand and reassemble it after, hoping I guessed well about what chunk size to use to avoid memory issues.

Regardless, thank you Gerald and the entire dev team for all the work that goes in to producing and maintaining my favorite tool of all time.

Comment by Kelly on 2013-12-02 14:03:55 +0000 🔗

Have capture filters changed in the dev release? Testing out the new Mac OSX build and cant see, to form a valid capture filter..

Comment by Kelly on 2013-12-02 14:33:11 +0000 🔗

Found the 1.11.3 dev build and it fixed my issue mentioned above.

Fifteen Years

Mon, 15 Jul 2013 03:22:47 +0000

Fifteen years ago I released a little network protocol analyzer. At the time it wasn’t very special. It only dissected five protocols and only ran on Linux and Solaris. I decided to share it with the world and released it as open source. I made use of quite a bit of open source software at that point (and still do), and it seemed like a good way to give back to the community.

Immediately after the release an amazing thing happened — I started receiving code from people around the world. They had problems similar to mine and were able to modify the little analyzer to suit their needs. They were also kind enough to contribute those modifications back. Those contributions haven’t stopped to this day and Wireshark has grown into a mature, feature-rich, award-winning network analysis tool. People around the world use it to troubleshoot networks, develop software and protocols, and to learn about networking.

Wireshark has been a source of pride many times over the years but I’m particularly proud of two accomplishments. First, your network is not a black box. This is important inasmuch as our daily lives depend on networks operating efficiently, reliably and securely. Wireshark lets you peer into your network and see how it operates at a low level. It’s also accessible. Anyone can download and run it. Protocol analysis is a fascinating world and if you don’t understand what you’re looking it we have a large community of users and educators that can help you.

Second, it turns out that a protocol analyzer makes a great open source project and Wireshark is an example of open source at its best. People who know a lot about protocols are typically know how to write software. If you provide a platform that allows them to give meaning and context to the bits and bytes that make up network packets they will do so on a massive scale. Wireshark now supports over 1,000 protocols and 140,000 different protocol fields and those numbers keep growing.

We’ve had quite a few challenges in the past and we still do. These days all of your interesting traffic is either off in the cloud or speeding across your LAN at multiple gigabits a second. Wireshark doesn’t run on my tablet and it looks awful on my Macbook. However, these are solvable problems and I’m looking forward to the challenge of fixing them.

When I made that first release I had no idea how big it would become or how much it would impact my life. Wireshark is a great and wonderful thing due to the following people:

The development team, who seem to generate an endless stream of brilliance and cleverness.
The user community, for their knowledge and enthusiasm, and for putting up with the odd wart here and there.
Educators, researchers, developers, and everyone else who help people peer into their networks.
My employer for sponsoring the project and being such an awesome place to work, and my co-workers for their passion for network performance.
My family and friends, for their support and encouragement over the years.

It’s been a wonderful journey so far and I can’t wait to see what lies ahead. Thank you all.

Comments 🔗

Comment by dredgie on 2013-07-14 22:22:14 +0000 🔗

Happy bday, Wireshark! And thanks for everything you do for the community, Gerald

Comment by Jasper on 2013-07-16 02:04:28 +0000 🔗

Happy Birthday, Wireshark! Thanks, Gerald, and thanks to all the developers that push the cart with all their dedication and time!

Comment by Harry on 2013-07-20 02:10:05 +0000 🔗

Congratulations to the entire team …. ethereal to wireshark what a fabulous journey.

Sharkfest ’12 Recap

Fri, 29 Jun 2012 22:49:41 +0000

The fifth annual Sharkfest wrapped up a couple of days ago. You are no doubt feeling terrible if you missed it. Don’t despair, you can find a retrospective at the Sharkfest web site. The events team tried to make sure each session was recorded so we should have videos to go along with the slides soon.

As usual I wanted to attend more presentations than physics allowed but unfortunately missed some, so I’m waiting for the retrospective videos along with everyone else. (Hansang Bae observed that this is one of the few conferences where presenters attend other sessions.) Here are some quick notes about the sessions I was able to attend:

Monday’s keynote was delivered by Cliff Stoll. He kept insisting that he didn’t have much to say while simultaneously delivering an informative and entertaining talk.

Steve Riley provided a lot of insights into cloud computing: how it’s changing computing and how it can best be utilized.

Loris Degioanni (aka my boss) gave a great presentation on the new platform API that some people have been working on here at Riverbed. I think this is going to be a must-have once people realize the cool and crazy ways that this can be leveraged.

Wireless was well-represented Thomas D’Otreppe taked about OpenWIPS-ng, his new wireless IPS/IDS project. Metageek’s Ryan Woodings talked about wireless below the packet level. Mike Kershaw and Michael Ossman talked about the development of the Kisbee and Ubertooth adapters, and how you too can design and implement real hardware devices.

Hansang Bae showed modern TCP stacks and network devices can collude to make connectivity really slow, and at a really low level.

Laura Chappell showed off a lot of the new features in Wireshark 1.8. I even learned something — you can type a color name (e.g. “bisque3”) into the color picker in the preferences. She also released the second edition of Wireshark Network Analysis. It’s even heavier than the first edition, which I learned first-hand.

I led one session this year, Ask The Experts. We ended up talking about ways to improve Wireshark and a few of the core developers and I discussed these ideas the next day.

We got logs of great feedback on the conference as well. Several people commented that we didn’t have as many devlopment-oriented sessions this year as we have in the past. Maybe we can add more next time.

Wireshark is a great and wondrous thing due to its community. The developers, users, educators, sponsors all play a big role in its development and evolution. I see small reminders of this every day but it becomes abundantly clear each year at Sharkfest.

Thanks to the attendees, presenters, and to the Riverbed events team for creating a wonderful experience. I can’t wait to see what next year’s Sharkfest has in store.

Comments 🔗

Comment by Ian Brown on 2012-07-04 22:18:16 +0000 🔗

Thank you for the post. Unfortunately I was unable to attend so the videos are a must have to keep me on track… thanks again for the great work.

Best regards

Ian

Wireshark and Pcap-ng

Tue, 06 Mar 2012 18:47:56 +0000

When Wireshark 1.8.0 is released in the next few months it will introduce two major features: the ability to capture from multiple interfaces at once and the ability to annotate packets. These features have been on the wishlist for years and they will make Wireshark much more useful. They both share dependency on pcap-ng.

Packet comment example

Pcap-ng is Wireshark’s new default file format. It is more complex than its predecessor (pcap) but it’s also more flexible. Along with multiple interface types and annotations you can store host information, extended interface information, and much more. Wireshark has had basic support for pcap-ng for several years now and 1.8.0 will bring it to the forefront.

But there’s a catch. Suppose you sit down at a computer with Wireshark 1.7 or 1.8 installed. What file format will Wireshark use by default? Unfortunately the answer is “It depends.” If this is a fresh install of Wireshark on a new computer you’ll get pcap-ng files. If this is an upgrade from 1.6 or below you’ll get pcap files. If the preferences were changed or copied from another machine the default format will be affected as well.

There’s another catch. Suppose you’ve just saved a capture file and you want to read it using tcpdump, Cascade Pilot, Snort, or any of the dozens of other applications that use the classic pcap file format. What will happen? Again, it depends. If that application has been updated to support pcap-ng or if it’s using a recent version of libpcap it will probably work. Otherwise don’t hold your breath.

If you’re a Wireshark user you might want to try a recent build of Wireshark 1.7 to see the new features and new file format in action. If you’re a developer and your application reads pcap files you’re most likely in for some grief. For that I apologize. You should probably investigate adding pcap-ng support now before your users start complaining.

Despite the migration pains the switch to pcap-ng is long overdue and will make Wireshark more useful to more people.

Comments 🔗

Comment by Guy Harris on 2012-03-06 11:05:49 +0000 🔗

In “If that application has been updated to support pcap-ng or if it’s using a recent version of libpcap it will probably work.”, “a recent version of libpcap” means “libpcap 1.1.0 or later”. Libpcap 1.1.0 and later versions (the current version is 1.2.1) can read pcap-NG files that have packets only from one interface (the “any” device counts as one interface in this context) or packets from multiple interfaces if all interfaces have the same link-layer header type and snapshot length.

For applications such as tcpdump that use libpcap to read capture files, using libpcap 1.1.0 or later is sufficient – no changes to the application itself are needed. The application won’t see the additional information Gerald refers to, but it will see the packets.

Applications that have their own code to read pcap files aren’t so lucky. (That’s why, when people asked what pcap files look like, I always warned them not to write their own code to read them, but to use libpcap instead. Wrappers for libpcap exist for languages such as Perl, Python, etc.)

Unfortunately, there’s currently no version of WinPcap based on libpcap 1.1.0 or later, so even WinPcap-based applications are out of luck on Windows.

Comment by Mario Vilas on 2012-03-12 02:58:05 +0000 🔗

Will it be possible to migrate files from one format to the other? I understand some information may be lost in the process, even if it’s possible to extract packets coming from different interfaces into different .pcap output files.

Comment by Gerald Combs on 2012-03-12 11:19:58 +0000 🔗

@Mario You can translate trace files with only one encapsulation type between a variety for formats (not just pcap and pcap-ng) using Wireshark, TShark, editcap, and mergecap. It’s a bit more complicated when multiple encapsulation types are involved. For example the current development version of mergecap returns an error when I try to merge files containing Ethernet, PPP, and IEEE 802.11 packets when it should arguably Just Work. Hopefully we’ll have that fixed for 1.8.0.

Comment by Laura on 2012-03-13 15:16:05 +0000 🔗

HOORAH!

I can’t wait to see how people like the annotations! I’m going through hundreds of trace files adding notes regarding what’s good/bad in those files. This is a FABULOUS feature that I’ve been not-so-patiently waiting for! Congrats Gerald and all the faboo developers!

Comment by Manjari Shukla on 2012-04-03 22:51:51 +0000 🔗

I need just that. thanks. Keep the good job up.

Used Cars and Stub Installers

Tue, 06 Dec 2011 19:59:28 +0000

The Wireshark development team works hard to earn the respect of our users. This includes making sure that downloading and installing Wireshark is as easy and trouble-free as possible. Right now the vast majority of our users can go to www.wireshark.org, follow the big green arrows, and immediately download the appropriate Wireshark package for their platform.

For many years a number of third party sites have also offered Wireshark downloads. Typing “wireshark download” into your favorite search engine will turn up a bunch of them, usually just below links to wireshark.org. These sites are popular and often provide valuable services such as reviews and malware prescreening. They also reside outside the Wireshark ecosystem — we don’t link to them and aren’t affiliated with any of them.

"This is the Cadillac of invasive toolbars at a Chevy price!"

Sometimes these sites abuse their relationship with their users. For example a few months ago Download.com started using a stub installer which tries to get you to install various toolbars and who-knows-what-else before it installs the package you ultimately want, much like a sleazy car salesman trying to bundle add-ons you don’t want or need.

This sort of bottom-feeding behavior is harmful to our user community and exploits the goodwill we have with our users. Brian Krebs and Gordon “Fyodor” Lyon describe the problem with much more depth and eloquence than I can.

I sent a request to Download.com to disable their stub installer for Wireshark. They complied, but there are dozens of other download sites. Trying to keep tabs on all of them would result in a never-ending game of Whac-A-Mole®.

On behalf of the Wireshark development team I promise to provide easily accessible, direct downloads of Wireshark from wireshark.org just as we always have. If you choose to download Wireshark somewhere else we can’t guarantee that the experience will be free of shenanigans so please be careful.

Comments 🔗

Comment by Sean B on 2011-12-07 01:36:37 +0000 🔗

But they just wanted to ‘wrap’ all these nice programs in an extra little blanket for…warmth, and safe-keeping…and stuff. I mean who notices extra toolbars and new default search engines? Intrusive? Infuriating? Nonsense.

Sharkfest ’11 Recap

Tue, 21 Jun 2011 00:35:31 +0000

The fourth annual Sharkfest was held last week. If you missed it, don’t worry. We are busy uploading all of the presentations to sharkfest.wireshark.org.

The conference started with a keynote by Dr. Steve McCanne, CTO of Riverbed. He described the history of BPF and how its optimizing compiler works. It was interesting to see all of the problems he ran into and the solutions he found. The presentation was easy to follow despite its technical level. (Steve created BPF, and co-wrote tcpdump and libpcap.)

The keynote set the tone for the rest of the conference, which featured a lot of talented speakers. Jeff Carrell’s IPv6 was so popular it had be repeated several times over the course of the conference. Lara Chappell, Hansang Bae, and Betty Dubois drew their usual huge crowds. The other presenters did great jobs as well.

People have great ideas for improving Wireshark. Plenty of these ideas and suggestions were heaped our way throughout the conference, especially during the last two sessions. I hope to spend some time this summer implementing some of them.

Wireshark is very much a community-owned project. It is where it is today because of the developer and user communities. Steve stressed this fact during his keynote and it was readily apparent throughout the conference. On behalf of the developer team, the Sharkfest organizers, and Riverbed I extend my heartfelt thanks to the Wireshark community. This continues to be an amazing adventure and I can’t wait to see what the future has in store.

Comments 🔗

Comment by Free Webcam Chat on 2011-07-02 00:44:17 +0000 🔗

Great get it upload soon I would like to refer it…

Comment by Gerald Combs on 2011-07-02 08:48:00 +0000 🔗

@Free Webcam Chat The keynote and presentations are up at http://sharkfest.wireshark.org/sharkfest.11/ .

Comment by depannage mac on 2011-07-18 08:51:21 +0000 🔗

@ Gerald : just try to see video at http://www.lovemytool.com/blog/sharkfest/

but website not responding (FFv5 MAC OS 10.5)

is there aother way to watch it ?

Thanks Sebastien

Looking forward to Sharkfest ’11

Thu, 12 May 2011 21:57:20 +0000

I’ve been looking over the session schedule for Sharkfest ’11. Once again Janice and Sheri have created an event which guarantees a wealth of knowledge and insight for everyone attending.

What to expect 🔗

Sharkfest is small. This is on purpose. We limit the size of the conference in order to allow more one-on-one communication between the attendees and presenters.

It has a high knowledge density. Our strategy is to gather together a bunch of people who are excited about Wireshark and protocol analysis, and know what the heck they’re talking about. We do our best to make sure the presentations focus on usable information with a minimum of fluff.

How to get the most out of Sharkfest 🔗

Sharkfest is active, not passive. Mingle. Compare notes. Many of the attendees are Wireshark power users, but many are not. Everyone has something insightful to share. The worst thing you can do is keep to yourself.

For the past three years I’ve had the opportunity to witness the top people in protocol analysis exchanging and sharing ideas. I look forward to seeing the same thing this year. See you there.

Comments 🔗

Comment by madinah on 2011-06-01 08:51:43 +0000 🔗

please, you know how to use wireshark

and how to read ports from wireshark

Comment by madinah on 2011-06-01 08:58:05 +0000 🔗

please, you know how to use wireshark

and how to read ports from wireshark

send step using wireshark

Is there an RFC for hashtags?

Wed, 04 May 2011 23:28:09 +0000

On May 24, Steve McCanne, Loris Degioanni and I will answer questions sent to us on Twitter via #packetcap. We’ve given talks about the origins of tcpdump, BPF, WinPcap, and Wireshark live but this is the first time we’ll do so remotely and capped at a 140-byte MTU. It should be fun and informative and I hope you’ll join us.

Full details on the Riverbed blog.

Wireshark Has a New Home

Thu, 21 Oct 2010 20:33:08 +0000

By now you may have seen the press release and announcement about the purchase of CACE Technologies (my as-of-three-and-a-half-seconds-ago former employer) by Riverbed Technology (my new employer). In the announcement to the wireshark-users and wireshark-dev mailing lists I mentioned Riverbed’s commitment to the Wireshark community. I’d like to expand on that a bit.

Wireshark is more than a protocol analyzer. It is the foundation for relationships between several groups of people: the user community, the developer community, Wireshark University (driven by Laura Chappell), and CACE Technologies. Each one is an important part of Wireshark as a whole. We often referred to it as “the ecosystem” at CACE. It is an honor to be a part of it.

The important, wonderful, and rare thing about the ecosystem is that it benefits everyone involved. You can see this in action on Wireshark’s mailing lists, Laura’s seminars, and at SHARKFEST. It’s something that we worked hard to foster at CACE. What’s even better is that with Riverbed this commitment doesn’t change. Everyone I’ve talked to at Riverbed, from the CEO and CTO on down is committed to Wireshark and to its community. They realize we have a good thing going and they want to keep it that way.

On a personal level this has been an incredible journey so far. Every day I get to work with the amazing people on the Wireshark development team and at CACE. I also get to interact with the amazing people who make up the Wireshark community. For that I am grateful and I look forward to helping the ecosystem grow and evolve in the coming years.

Comments 🔗

Comment by Chrisliom on 2010-10-22 01:56:55 +0000 🔗

At the moment we will not see any change but slowli we will see a dramatic change. Riverbed is a company on the stock exchange and the only purpose of this guys is to make as much money as possible. In the bigining they are always nice but ….. I take a bet this will happen and we will see a commercial wireshark soon

Comment by Brian on 2010-10-22 05:36:22 +0000 🔗

I agree with Chrisliom. Riverbed’s purpose is to make money. Why is a WAN optimization company interested in Wireshark? Watch out for the commercial wireshark.

Comment by Frankie J. on 2010-10-22 07:11:27 +0000 🔗

why would they want to make a commercial shark? what good does it do to add yet another analyzer appliance in the market? if we are talking about integration, doesn’t riverbed already have these application & protocol awareness in their products? How much more can either scenario really add to the top line?

Comment by Gerald Combs on 2010-10-22 08:36:36 +0000 🔗

@Frankie is correct. Wireshark is the product of brilliant people in many different domains of expertise. Taking it commercial would a) require copyright reassignments from ~700 people and b) destroy the magic that makes it work.

CACE Technologies’ business model focused on building great products that complemented Wireshark and WinPcap. The model works, and works well. Those products happen to complement Riverbed’s. That’s why they bought us.

Comment by Karol on 2010-10-22 10:21:44 +0000 🔗

Riverbed’s CEO created tcpdump. He’s had his eyes on wireshark for a while now. Let’s see what happens.

Comment by Guy Harris on 2010-10-22 10:37:20 +0000 🔗

Note that Wireshark is GPLed, which makes it difficult to make a “commercial version” in the sense of a closed-source version.

(Slight correction to Karol – Steve McCanne, the co-creator of tcpdump with Van Jacobson, is the CTO, not the CEO.)

Comment by jeff on 2010-10-22 11:38:34 +0000 🔗

Last year Riverbed acquired Mazu Networks – re-branded as Cascade and has a done a great job in integrating it and providing resources to it. Cascade is doing really well and killing it in the market …. with the addition of Wireshark capabilities that product will rock. From flow to packet all in one …. sweetness.

Comment by clyde in ohio on 2010-10-22 13:20:58 +0000 🔗

i love wireshark. add this to Cascade asap and we are all set. i am a riverbed steelhead customer and had no idea what cascade was until they introduced me to it. i use it all the time for troubleshooting and security.

Comment by Chrisliom on 2010-10-25 02:36:48 +0000 🔗

@Gerald i think CACE was a good idea it was small good working company, now you are a small group in a very big organisation. In the past you know who is the owner you can talk to a person now you had to talk to inverstors and they dont take care about the cummunity the are interested only on return on investment, and they want 20 % profit at least. I saw many of this storys in the past years. I know riverbed is different 🙂 everone told me this in the beginning. This is a pond with sharks i hope wireshark will be survive.

Comment by Fernando Correia on 2010-10-30 04:26:09 +0000 🔗

That probably means more resources and exposure. Any acquisition brings challenges, but the opportunities look great. Good luck!

Comment by Huston on 2010-11-01 08:47:44 +0000 🔗

Last time I checked Riverbed does not do charity work, so for Gerald to say things are not going to change is simply trying to ignore the fact that he sold out. In the long term you’ll see the cost increase go up on Wireshark as well.

Comment by Gerald Combs on 2010-11-01 10:31:51 +0000 🔗

@Huston Riverbed does in fact do charity work: http://www.riverbed.com/us/company/reach_out/ However, that’s outside the scope of this discussion. Wireshark isn’t a charity and shouldn’t be characterized as such.

What are you paying for Wireshark now? Why do you expect that cost to increase? What if we have a sound business model that involves keeping Wireshark strong, open, and free-as-in-both-speech-and-beer?

Comment by Jesper on 2010-11-05 14:39:00 +0000 🔗

I’ve never visited wireshark’s website until now and frankly I’m quite surprised to see it. It struck me as very commercial and seeing terms like “business model” only increases that feeling.

As it’s only really a transition from one company to another I guess I shouldn’t say much. Already the old company seemed to offer a lot of solutions around Wireshark. I can’t help but think that this only weakens Wireshark itself as if these tools complement and in some ways address shortcomings of Wireshark itself, there will be little motive to ever improve the application in those areas for fear of eating away one’s own market.

Gerald:
A question, these companies seem intent on running Wireshark on windows and have gone to great lengths making it so (winpcap comes to mind) – is the emphasis on Windows or is the application still every bit as strong on Linux ?

Comment by Guy Harris on 2010-11-24 00:13:22 +0000 🔗

For all those who worry about a commercialized Wireshark, I have only one word:

fork

As I said over a month ago:

Note that Wireshark is GPLed, which makes it difficult to make a “commercial version” in the sense of a closed-source version.

And as for the “cost increase [going] up on Wireshark”, one could, with 100% certainty, predict all of the following:

the cost of Wireshark will go up 50%;

the cost of Wireshark will go up 100%;

the cost of Wireshark will go up 1000%;

the cost of Wireshark will remain the same;

the cost of Wireshark will go down 50%;

the cost of Wireshark will go down 100%;

the cost of Wireshark will go down 1000%;

as, given the *current* cost of Wireshark, all those statements say the same thing. 🙂

And, again, if somebody charges money for it – fork. Read the GPL.

Comment by Guy Harris on 2010-11-24 00:22:55 +0000 🔗

“I can’t help but think that this only weakens Wireshark itself as if these tools complement and in some ways address shortcomings of Wireshark itself, there will be little motive to ever improve the application in those areas for fear of eating away one’s own market.”

The majority of the members of the Wireshark core team do *not* work for Riverbed, and do *not* have any inherent incentive to avoid adding extensions to Wireshark that might take away the market for enhancements from Riverbed.

“A question, these companies seem intent on running Wireshark on windows and have gone to great lengths making it so (winpcap comes to mind) – is the emphasis on Windows or is the application still every bit as strong on Linux ?”

Wireshark is more “native” to Linux (or other UN*X+X11 platforms) than it is to Windows. Many of the developers work primarily on non-Windows platforms (including a platform where Wireshark looks more “non-native” than it does on Windows, the fact that the platform is a UNIX(R) nonwithstanding). Windows has a plethora of packet-capture applications; UN*X+X11, and that other UNIX platform, don’t have so many, so the Wireshark developers not working on Windows have more of an incentive to keep Wireshark working.

WinPcap exists because Windows, unlike most modern UN*Xes, lacks a packet capture mechanism atop which libpcap can run; many of those UN*Xes, including most Linux distributions (and, again, the aforementioned other UNIX platform), ship with libpcap. I’m not even sure WinPcap was developed for Wireshark – it was an academic project at the Politecnico di Torino, which happened to be a convenient tool for porting Wireshark *from* UN*X to Windows.

Comment by Greg Davis on 2010-12-05 07:21:43 +0000 🔗

So, what’s so wrong with making money. I hope that this culture you describe, which sounds amazing, can be maintained and still have a profit motive that is equal to your motives for a great work environment (ecosys) and that is conducive to a pleasant and rewarding experience that you folks seem to have had so far.

I am a new user and find the application quite neat on the front-end and I came to your site seeking further documentation on its use.

Here’s hoping that you have a great experience with your new owners and that there will be a sort of symbiosis (to remain consistent with your theme) whereby the ecosystem(s) turn the whole place into an even bigger, better (and even more profitable) paradise of prosperity, inner-peace and quality production !

(Like I said, the software really looks great in my initial trials, and I’m looking forward to digging in deeper).

Oh, and as to the motive for improving software – what better motive can one have than prosperity? The better the software gets, the bigger the profits and the more “well-off” is everyone, most especially your customers.

Remember now W. Edwards Deming and his rule (the only one I remember) “adopt the new paradigm”…in a constant state of chaos and change, it is the very best rule one can apply; (until, that is, someone can get some sense and join the rest of we mugwamps who believe in not changing a good thing when it is working).

Best Regards,

-Greg

PS – I’ve been a technical writer for some twenty years now and have spent a large portion of the time documenting software and data-collection systems.

Comment by Scott on 2010-12-20 10:09:25 +0000 🔗

There’s in interesting precedent in the open source market to monetize user communities. I suspect that Riverbed will be moving in this same direction in leveraging the Shark users.

Announcing ask.wireshark.org

Mon, 13 Sep 2010 05:00:00 +0000

There have been requests over the years for an online forum for Wireshark. I’m not too crazy about traditional forums, particularly for support. You often end up digging through a lot of not-so-useful content to get to the information you’re looking for.

(If you can see where this is going and are impatient, you can go straight to the new support Q&A site now. Otherwise read on.)

Last year Jeff Atwood and Joel Spolsky started Stack Exchange, a collection of question & answer sites including Stack Overflow, Server Fault, and Super User. SE fixes everything that’s wrong with traditional form software. Useful answers can be voted up by the community, and “hot” questions are listed first.

Stack Exchange is wonderful but they require you to host your content on their servers. This is goes against my control freak sensibilities, so I had to look elsewhere for a solution. I found OSQA. The software is still beta, but it’s quite functional and becoming quite popular.

Here are some of the things you can do with OSQA:

Vote questions and answers up and down 🔗

This means that the good stuff floats to the top. Additionally the person who posted the question can select one answer as the best.

Comment on questions and answers 🔗

This lets you have a traditional forum-style linear discussion when you need it.

Tag questions 🔗

Tags let you categorize questions. For instance the python tag on Stack Overflow will give you all of the Python programming questions.

Earn karma 🔗

As you ask questions and provide helpful answers you gain karma points. This lets you do things like…

Edit content 🔗

Power users can correct, clarify, or otherwise make helpful changes to things others have posted.

Q&A sites aren’t for everyone. They tend to work best when you have a bunch of helpful, active, and knowledgeable people willing to exchange ideas in a particular field. As luck would have it this describes the Wireshark community to a tee.

Go try it for yourself at http://ask.wireshark.org.

Comments 🔗

Comment by Srivats P. on 2010-09-18 07:04:07 +0000 🔗

Gerald,

How do you distinguish/differentiate the purpose behind the mailing list and ‘ask’ ?

Srivats

Comment by Gerald Combs on 2010-09-18 17:41:27 +0000 🔗

Their purposes certainly overlap. wireshark-users, wireshark-dev, and “ask” all let Wireshark’s user and developer communities interact and help each other.

The mailing lists get a lot of “drive-by” questions — someone asks a question, (hopefully) gets an answer, and is never heard from again. If the person asking the question subscribes to the list he ends up getting a lot of messages from other threads that may not have anything to do with his problem. If he doesn’t subscribe he may not see any responses to his question. A Q&A site is much more suited to this than a mailing list.

However Q&A sites aren’t discussion forums. Long discussions are much more suited to mailing lists (IMHO at least).

Last but not least, some users prefer mailing lists and other prefer the web.

Comment by Brian Bewick on 2010-09-19 14:11:02 +0000 🔗

Hi, How do I find someone if all I have their email address
and a phone number. Please advise, Brian.

Comment by Gerald Combs on 2010-09-22 08:28:20 +0000 🔗

@Brian That’s way outside our scope.

Comment by Bob on 2010-10-25 08:24:50 +0000 🔗

A couple of questions:
I want to monitor wireless traffic from an iphone going to my home linksys router. The only computer I have at home is my windows laptop, so I would be loading wireshark on that?

Sharkfest ’10 Is Going To Be Awesome

Fri, 12 Mar 2010 23:24:40 +0000

We just finalized the schedule for Sharkfest ’10. This year’s agenda includes:

Van Jacobson and Harry Saal, who formed protocol analysis with their bare hands
Two three wireless security experts including Mike Kershaw and Thomas D’Otreppe, the creators of Kismet and Aircrack-ng
Network security experts including nmap creator Gordon “Fyodor” Lyon
Five six many amazing protocol analysis instructors, including Laura Chappell, Betty DuBois, Sean Walberg, and Joe Bardwell
Several members of Wireshark’s development team
Protocol, network, and application performance experts from Citi, Google, and Intel
Lots of other great presenters. See for yourself.

The attendees are amazing and knowledgeable as well.

Tell your boss I said you should go.

Laura Wrote A Book

Wed, 10 Mar 2010 19:04:15 +0000

Laura Chappell wrote a book about Wireshark: Wireshark Network Analysis (The Official Wireshark Certified Network Analyst Study Guide). In typical Laura fashion, it is amazingly comprehensive, covering everything you need to know to use Wireshark effectively. My review copy is massive. It broke the plastic binder:

Could crush small woodland creatures

The publication copies are still massive but much better looking:

What your copy might look like

The book is great. It covers all of the features in the upcoming 1.4 release and includes a ton of fascinating case studies. Best of all, if you buy it before March 29 you can get 35% off at Wireshark University and Chappell University by using the coupon code 998nws35.

Comments 🔗

Comment by Philip Smith on 2010-03-15 06:15:30 +0000 🔗

I’m interested in Laura’s book, Wireshark Network Analysis The Official Wireshark Certified Network Analyst Study Guide”. How much does it cost and where can I get it from?

Thanks,
Philip Smith

Comment by Gerald Combs on 2010-03-15 14:06:18 +0000 🔗

The book’s purchase page is at http://www.wiresharkbook.com/purchase.html . The Wireshark University and Chappell University links should let you use the coupon code above (998nws35) for a 35% discount as well as a signed copy.

Comment by Roger on 2010-03-22 16:40:59 +0000 🔗

Hm… It look like coupon code did not work on Amazon.com

Comment by Michael Lane on 2010-03-23 17:02:09 +0000 🔗

I tried Amazon as well with no luck. I’d love the 35% without the $10 shipping but if it’s a signed copy, hmmm…

Comment by Gerald Combs on 2010-03-25 13:33:54 +0000 🔗

Roger & Michael – The coupon only applies to orders placed at Wireshark University and Chappell University. I’ve updated the post accordingly.

Comment by John C on 2010-03-31 10:50:36 +0000 🔗

I thought the discount ended on 3/31/10, not 3/29/10 – when will the 35% discount
be offered again?

Comment by Gerald Combs on 2010-03-31 15:40:11 +0000 🔗

The original code expired on the 29th. Laura issued a new code (998exp35) that expires today (the 31st). I’m not sure if or when there will be another discount.

Comment by Chameh A on 2010-04-01 13:59:30 +0000 🔗

I missed out on the discount by a day 🙁 Anyone know of an April Fool’s Day discount?!

Looked at sample pages and seems like a great read but will have to brew over paying full retail for it a little bit 😉

Comment by Michelle on 2010-04-20 10:39:47 +0000 🔗

I thought the discount ended on 3/31/10, not 3/29/10 – when will the 35% discount
be offered again?

Comment by Dan on 2010-04-20 11:26:09 +0000 🔗

Amazon has the book right now for $62.97

Comment by Chameh A on 2010-04-27 15:48:48 +0000 🔗

Thanks Dan! Just ordered me a copy and freeeeee shipping is extra nice 🙂

Sharkfest ’10 Registration Now Open

Thu, 21 Jan 2010 18:34:26 +0000

Registration for the third annual Wireshark Developer and User Conference is now open! If you want to learn how to get the most out of Wireshark, develop dissectors, or just hang around with protocol geeks this is the place to be!

Comments 🔗

Comment by solanki on 2010-02-06 06:09:54 +0000 🔗

HELOO I CANT USED THIS PLZ USE THIS SOFTWARE PROSESS

Leveraging Your Settlement

Wed, 23 Dec 2009 18:01:55 +0000

Comcast owes me money. They owe lots of people money.

In 2007 and 2008 Comcast forged TCP RST packets in order to throttle P2P and other kinds of traffic. This resulted in several class-action lawsuits. They recently settled one of them and agreed to pay each affected customer $16.

From an individual perspective this isn’t a lot. However, for those who are eligible for the settlement I have a proposal: submit your claim form and make it part of a larger donation to your local food bank or homeless shelter.

That’s what I’m going to do.

Sharkfest ’10 – Mark your calendar

Mon, 09 Nov 2009 22:06:49 +0000

Sharkfest ’10 will take place at Stanford University from June 14 to 18. I’ll follow up when I have more details.

Chappell Seminars Summit 09 – Mark your calendar

Thu, 05 Nov 2009 23:57:16 +0000

Laura Chappell will be hosting another tools, troubleshooting, and security summit in Santa Clara, CA December 7th, 8th, and 9th where I’ll be a special guest. See you there!

We made the Today Show! (Sort of)

Thu, 29 Oct 2009 17:20:16 +0000

If you look closely and don’t blink you can see an AirPcap NX and Wireshark in a recent Today Show segment.

Comments 🔗

Comment by Ryan on 2009-11-03 11:32:22 +0000 🔗

I found it amusing how that video calls Wardiving ‘new’.

Comment by Patrick Gryciuk on 2009-11-04 03:06:06 +0000 🔗

bahaha I love it :D. I’ve been using wireshark for a long time (long before it changed it’s name from ethereal.) I just wanted to thank all the developers for their contributions to the project. When I have more free time on my hands I’ll definitely try to join the development group.. or at the very least make a donation.

Comment by jc on 2009-11-05 11:02:41 +0000 🔗

@Ryan: ‘wardiving’? Is that using SCUBA gear to hunt for underwater WiFi networks?