Wireshark 1.0.3

What's new in this version:

Bug Fixes
- The NCP dissector was susceptible to a number of problems, including buffer overflows and an infinite loop.
- Wireshark could crash while uncompressing zlib-compressed packet data.
- Wireshark could crash while reading a Tektronix .rf5 file.

The following bugs have been fixed:
- 802.11 WPA/WPA2-PSK Unable to decode Group Keys.
- Packets could wrongly be dissected as "Redback Lawful Intercept"
- MIKEY dissector improvements
- tvb_get_bits{16|32} could read past the end of a tvbuff
- Incorrect wslua function names.
- Memory corruption in wslua.
- Unknown PPPoE TAGs which are present in a PPPoE discovery packet are not displayed under "PPPoE Tags" subtree/section.
- Following a TCP stream could incorrectly reassemble packets.
- SIP decode shows fully expanded "Content-Length" header instead of compact form.
- Segmentation fault loading trace containing NCP packets.
- SIP packets might incorrectly be displayed as malformed.
- RTCP BYE padding interpreted incorrectly.
- Reversed RTP stream is saved as silent .au file, forward stream saves correctly.
- Fix some lint warnings.
- Setting a duration on a capture file would capture for an extra second.

New and Updated Features
- There are no new or updated features in this release.

New Protocol Support
- There are no new protocols in this release.

Updated Protocol Support
- AIM, Bluetooth RFCOMM, ERF, K12, NCP, PPP BCP, PPPoE, Q.933, Redback LI, RTCP, RTP, SIP, SNMP, TCP, V.120, WiMAX

New and Updated Capture File Support
- Endace ERF.

Getting Wireshark
- Wireshark source code and installation packages are available from the download page on the main web site.

Vendor-supplied Packages
- Most Linux and Unix vendors supply their own Wireshark packages.
- You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.

File Locations
- Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About->Folders to find the default locations on your system.

Known Problems
- Wireshark may appear offscreen on multi-monitor Windows systems.
- Wireshark might make your system disassociate from a wireless network on OS X.
- Dumpcap might not quit if Wireshark or TShark crashes.
- The BER dissector might infinitely loop.
- Wireshark can't dynamically update the packet list. This means that host name resolutions above a certain response time threshold won't show up in the packet list.
- Capture filters aren't applied when capturing from named pipes.
- Wireshark might freeze when reading from a pipe.
- Capturing from named pipes might be delayed on Windows.
- Filtering tshark captures with display filters (-R) no longer works.

Getting Help
- Community support is available on the wireshark-users mailing list. Subscription information and archives for all of Wireshark's mailing lists can be found on the web site.
- Commercial support and development services are available from CACE Technologies.

Frequently Asked Questions
- A complete FAQ is available on the Wireshark web site.