Wireshark

Program preferences have been expanded to include capture, name resolution, and window geometry settings. It is possible to search for all fields in GIOP messages. You can build display filters on the fly by right-clicking on tree view items. Additionally, protocol hierarchy statistics display and MacOS X capture timeout bugs have been fixed.

New features include TCP graphs and ring buffer captures. The SMB dissector was completely rewritten and the UI enhanced. The text2pcap utility and developer documentation also received many updates. A Linux-distribution-related SNMP bug was worked around. Many dissectors were enhanced. Support for EAPOL, M2TP, MS RPC, MTP2, PCNFSD, PPP/EAPOL, QLLC, SMPP, and SUA was added. Support for DBS Etherwatch, Visual Networks Visual UpTime, and VMS TCPIPtrace capture files was added. Handling of other capture formats was improved.

Enhancements for many dissectors (including updates to the SMB, DCE RPC, PPP, and GIOP dissectors). New dissectors include CosEventComm, Quake 3 Arena, GMRP, GTP, HMIPv6, OSPFv3, MMSE, UCP, and Skinny Client Control Protocol.

New dissectors include Appletalk Data Stream Interface, AUTH_DES, DVMRP, GIOP, Gnutella, iSCSI, ISUP, M2PA, MP-BGP message, MSDP, MTP3, PAP, PIMv1, RFC 2250 MPEG1, and for gamers, QuakeWorld and Quake II. Many other dissectors were updated and bugfixed. The release adds a utility to convert text hexdumps into pcap files(text2pcap), and a utility to merge multiple captures into one file (mergecap). A powerful addition is the idl2eth tool, which can generate a dissector from an IDL file.

New dissectors include YPPASSWD, KLM, SPRAY,
rquota, RANAP, and Modbus/TCP support. Many other
dissectors were updated and bugfixed. This release
adds IP fragment reassembly, plugin support on
HPUX machines, and a command line option to set
'automatic scrolling' during captures.