Wireshark

Display filters can now be constructed via a point and click interface. Protocol dissectors now exist for NFSv4, Mobile IPv6, X.25 over TCP, LAPBETHER, DEC LANBridge Spanning Tree Protocol, X.25 over LLC, Frame Relay, MTP3 User Adaptation Layer, and ISDN Q.921 User Adaptation Layer. Ethereal can capture packets on Linux's "any" device if using libpcap 0.6.1.

A fix for a buffer-overrun exploit in the AFS dissector (recently announced on BugTraq), new dissectors for WAP, SIP, AIM/OSCAR, 802.11, and GIOP v1.2, and other dissectors were also updated.

New dissectors include H.261, TPKT, and IGRP, RTP and RTCP were re-written, and many other dissectors were updated and improved. The wiretap library enables Ethereal to read Nokia-firewall tcpdump files, Shomiti Surveyor 3.x files, pppd log files (pppdump format), and NetXRay ATM files.

Ethereal now dissects Kerberos 5, rsh, and Zebra, has initial support for BXXP, can read Cisco Secure IDS iplog files, and has a working Help menu option. Many other updates and fixes were made.

Dissectors for SCTP, DIAMETER, and Quake 1 were added, other dissectors were enhanced and fixed. There is now a mechanism for user-configurable per-protocol preferences, capturing from a pipe (FIFO or STDIN), and display filters for string fields.