Wireshark is the foremost network protocol analyzer that is available and is the de facto standard across many industries and educational institutions. With Wireshark you can undertake deep inspection of hundreds of protocols, with more being added all the time. Wireshark has a Live capture and offline analysis feature.
Wireshark Key Features Include:
Standard three-pane packet browser. Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others. Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility. The most powerful display filters in the industry. Rich VoIP analysis. Read/write many different capture file formats. Capture files compressed with gzip can be decompressed on the fly. Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom). Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2. Coloring rules can be applied to the packet list for quick, intuitive analysis. Output can be exported to XML, PostScript®, CSV, or plain text.
The following updates have been undertaken in this latest version of Wireshark:
The following vulnerabilities have been fixed:
– MEGACO dissector infinite loop.
– Netflow dissector crash.
– CUPS dissector crash.
– HIP dissector infinite loop.
– RTSP dissector crash.
– SES dissector crash.
– Sniffer file parser crash.
The following bugs have been fixed:
– Wireshark can crash during remote capture (rpcap) configuration.
– 802.11 capture does not decrypt/decode DHCP response.
– Extra quotes around date fields (FT_ABSOLUTE_TIME) when using -E quote=d or s.
– No progress line in “VOIP RTP Player”.
– MIPv6 Service Selection Identifier parse error.
– Probably wrong length check in proto_item_set_end.
– 802.11 BA sequence number decode is broken.
– wmem_alloc_array() “succeeds” (and clobbers memory) when requested to allocate 0xaaaaaaaa items of size 12.
– Different dissection results for same file.
– Mergecap wildcard breaks in version 1.12.0.
– Diameter TCP reassemble.
– TRILL NLPID 0xc0 unknown to Wireshark.
– BTLE advertising header flags (RxAdd/TxAdd) dissected incorrectly.
– Ethernet OAM (CFM) frames including TLV’s are wrongly decoded as malformed.
– BGP4: Wireshark skipped some potion of AS_PATH.
– MAC address name resolution is broken.
– Wrong decoding of RPKI RTR End of Data PDU.
– SSL/TLS dissector incorrectly interprets length for status_request_v2 hello extension.
– Misparsed NTP control assignments with empty values.
– 6LoWPAN multicast address decompression problems.
– Netflow v9 flowset not decoded if options template has zero-length scope section.
– GUI Hangs when Selecting Path to GeoIP Files.
– AX.25 dissector prints unprintable characters.
– 6LoWPAN context handling not working.
– SIP: When export to a CSV, Info is changed to differ.
– Typo in packet-netflow.c.
– Incorrect MPEG-TS decoding (OPCR field).
* Updated Protocol Support
– 6LoWPAN, A21, ACR122, Art-Net, AX.25, BGP, BTLE, CAPWAP, DIAMETER, DICOM, DVB-CI, Ethernet OAM, HIP, HiSLIP, HTTP2, IEEE 802.11, MAUSB, MEGACO, MIPv6, MP2T, Netflow, NTP, openSAFETY, OSI, RDM, RPKI RTR, RTSP, SES, SIP, TLS, and Token Ring MAC
* New and Updated Capture File Support
– DOS Sniffer, and NetScaler.
So what are you waiting for? You can download Wireshark from FileHippo.com today.
[Image via commons.wikimedia]