<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 39688 2011-10-31 16:53:15Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
  <!ENTITY WiresharkCurrentVersion "1.4.10">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed.

      <itemizedlist>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2011-18.html">wnpa-sec-2011-18</ulink>
          </para>
          <para>
            Huzaifa Sidhpurwala of Red Hat Security Response Team discovered
            that the Infiniband dissector could dereference a NULL pointer.
            <!-- Fixed in trunk: r39500 -->
            <!-- Fixed in trunk-1.6: r39584 -->
            <!-- Fixed in trunk-1.4: r39642 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6476">Bug
            6476</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2.</para>
          <!-- <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para> -->
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2011-19.html">wnpa-sec-2011-19</ulink>
          </para>
          <para>
            Huzaifa Sidhpurwala of Red Hat Security Response Team discovered a
            buffer overflow in the ERF file reader.
            <!-- Fixed in trunk: r39508 -->
            <!-- Fixed in trunk-1.6: r39585 -->
            <!-- Fixed in trunk-1.4: r39643 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6479">Bug
            6479</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.9, 1.6.0 to 1.6.2.</para>
          <!-- <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
          </para> -->
        </listitem>

      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!-- Sort by bug # -->
<!--
        <listitem><para>
          Wireshark can contribute to ennui in adolescent rats.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->

        <listitem><para>
          Assertion failed when doing File-&gt;Quit-&gt;Save during live capture.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1710">Bug
          1710</ulink>)
        </para></listitem>

        <listitem><para>
          Wrong PCEP XRO sub-object decoding.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3778">Bug
          3778</ulink>)
        </para></listitem>

        <listitem><para>
          Decoding [Status Records] Timestamp Sequence Field in Bundle Protocol fails if over 32 bits.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4109">Bug
          4109</ulink>)
        </para></listitem>

        <listitem><para>
          wireshark-1.4.2 crashes when testing the example python dissector because of a dissector count assertion.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5431">Bug
          5431</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark crashes when attempting to open a file via drag &amp; drop when there's already a file open.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5987">Bug
          5987</ulink>)
        </para></listitem>

        <listitem><para>
          Add the ability to save filters from the Filter Toolbar into buttons on the Filter Toolbar.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6207">Bug
          6207</ulink>)
        </para></listitem>

        <listitem><para>
          Adding and removing custom HTTP headers requires a restart.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6241">Bug
          6241</ulink>)
        </para></listitem>

        <listitem><para>
          Can't read full 64-bit SNMP values.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6295">Bug
          6295</ulink>)
        </para></listitem>

        <listitem><para>
          BACnet property time-synchronization-interval (204) name shown incorrectly as time-synchronization-recipients.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6336">Bug
          6336</ulink>)
        </para></listitem>

        <listitem><para>
          [ASN.1 PER] Incorrect decoding of BIT STRING type.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6347">Bug
          6347</ulink>)
        </para></listitem>

        <listitem><para>
          Export -&gt; Object -&gt; HTTP -&gt; save all: Error on saving files.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6362">Bug
          6362</ulink>)
        </para></listitem>

        <listitem><para>
          Incorrect identification of UDP-encapsulated NAT-keepalive packets.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6414">Bug
          6414</ulink>)
        </para></listitem>

        <listitem><para>
          S1AP protocol can't decode IPv6 transportLayerAddress.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6435">Bug
          6435</ulink>)
        </para></listitem>

        <listitem><para>
          RTPS2 dissector doesn't handle 0 in the octestToNextHeader field.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6449">Bug
          6449</ulink>)
        </para></listitem>

        <listitem><para>
          packet-ajp13 fix, cleanup, and enhancement.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6452">Bug
          6452</ulink>)
        </para></listitem>

        <listitem><para>
          Network Instruments Observer file format bugs.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6453">Bug
          6453</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark crashes when using &quot;Open Recent&quot; 2 times in a row.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6457">Bug
          6457</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark packet_gsm-sms, display bug: Filler bits in TP-User Data Header.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6469">Bug
          6469</ulink>)
        </para></listitem>

        <listitem><para>
          wireshark unable to decode NetFlow options which have system scope size != 4 bytes.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6471">Bug
          6471</ulink>)
        </para></listitem>

        <listitem><para>
          Display filter Expression Dialog Box Error.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6472">Bug
          6472</ulink>)
        </para></listitem>

      </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title>
    <para>

<!-- Sort alphabetically -->
AJP13,
ASN.1 PER,
BACapp,
DTN,
GSM SMS,
Infiniband,
IPsec,
NetFlow,
PCEP,
RTPS2,

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

.

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About->Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with the same libraries as the
      32-bit installer.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3610">Bug
      3610</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Training is available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
