Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto (and often de jure) standard across many industries and educational institutions.

Feature:

• Deep inspection of hundreds of protocols, with more being added all the time
• Live capture and offline analysis
• Standard three-pane packet browser
• Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
• Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
• The most powerful display filters in the industry
• Rich VoIP analysis
• Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
• Capture files compressed with gzip can be decompressed on the fly
• Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
• Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
• Coloring rules can be applied to the packet list for quick, intuitive analysis
• Output can be exported to XML, PostScript®, CSV, or plain text

System Requirements:

• Operating System: Windows All Version
• Language: English-US
• License: Freeware
• Author: Wireshark Foundation
• Website: www.wireshark.org

Changelog:

#Bugs Fixed:

* A TCP stream would not always be recognized as the same stream. (Bug 2907)
* Wireshark Crashing by pressing 2 Buttons. (Bug 4645)
* A crash can occur in the NTLMSSP dissector. (Bug 5157)
* The column texts from a Lua dissector could be mangled. (Bug 5326) (Bug 5630)
* Corrections to ANSI MAP ASN.1 specifications. (Bug 5584)
* When searching in packet bytes, the field and bytes are not immediately shown. (Bug 5585)
* Malformed Packet: ULP reported when dissecting ULP SessionID PDU. (Bug 5593)
* Wrong IEI in container of decode_gtp_mm_cntxt. (Bug 5598)
* Display filter does not work for expressions of type BASE_DEC, BASE_DEC_HEX and BASE_HEX_DEC. (Bug 5606)
* NTLMSSP dissector may fail to compile due to space embedded in C comment delimiters. (Bug 5614)
* Allow for name resolution of link-scope and multicast IPv6 addresses from local host file. (Bug 5615)
* DHCPv6 dissector formats DUID_LLT time incorrectly. (Bug 5627)
* Allow for IEEE 802.3bc-2009 style PoE TLVs. (Bug 5639)
* Various fixes to the HIP packet dissector. (Bug 5646)
* Display “Day of Year” for January 1 as 1, not 0. (Bug 5653)
* Accommodate the CMake build on Ubuntu 10.10. (Bug 5665)
* E.212 MCC 260 Poland update according to local national regulatory. (Bug 5668)
* IPP on ports other than 631 not recognized. (Bug 5677)
* Potential access violation when writing to LANalyzer files. (Bug 5698)
* IEEE 802.15.4 Superframe Specification – Final CAP Slot always 0. (Bug 5700)
* Peer SRC and DST AS numbers are swapped for cflow. (Bug 5702)
* dumpcap: -q option behavior doesn’t match documentation. (Bug 5716)

# Updated Protocol Support
- ANSI MAP, BitTorrent, DCM, DHCPv6, DTAP, DTPT, E.212, GSM Management, GTP, HIP, IEEE 802.15.4, IPP, LDAP, LLDP, Netflow, NTLMSSP, P_Mul, Quake, Skinny, SMB, SNMP, ULP

# New and Updated Capture File Support
- LANalyzer, Nokia DCT3, Pcap-ng

Wireshark 1.4.4 (32-bit)