Wireshark

Major improvement in the time required to load large capture files. NetBEUI is now decoded. The -S option has been fixed. You can now use load-time filters with the -R option.

Some fatal bugs in the new display filter code were fixed. This version should be much more stable than 0.7.0. A progress bar was added for the display filter processing. The X.25 code was worked on a bit, too.

Support has been added for RTSP, SDP, RADIUS, LAPB, and Classical IP over ATM on Linux. The wiretap library is now compiled into Ethereal, allowing Ethereal to read capture files from many different protocol analyzers. A new addition to wiretap is the ability to read RADCOM WAN/LAN Analyzer files. Ethereal now has its own display filter engine, allowing you to filter on many more fields than before. This means that the capture filter language (libpcap) is now different from the display filter language, but you'll appreciated the added power. Also, you can now create a Win32 Ethereal, but without capture facilities.

Decoding support has been added for GRE, RSVP, ISAKMP, PPTP, and PPP over Ethernet. Summary statistics for the trace file can now be produced. The Time column in the packet list can be easily changed between absolute, delta, and relative time. And a new "Match Selected" function allows you to create display filters based upon which bytes you have highlighted in the protocol tree / hex dump. Of course, bug fixes have been added too.

A new "almost-real-time" capture and display mechanism
was added. Initial support for SMB and SNMP decoding has been added, although the SMB decoding will be more useful in the future when Ethereal can de-fragment TCP transmissions. Wiretap can now read NetMon 2.0 files.