<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 40426 2012-01-10 17:18:26Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
  <!ENTITY WiresharkCurrentVersion "1.4.11">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed.

      <itemizedlist>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-01.html">wnpa-sec-2012-01</ulink>
          </para>
          <para>
	    Laurent Butti discovered that Wireshark failed to properly check
	    record sizes for many packet capture file formats.
            <!-- Fixed in trunk: r40164, r40165, r40166, r40167, r40168, r40169, r40170, r40174  -->
            <!-- Fixed in trunk-1.6: r40398 -->
            <!-- Fixed in trunk-1.4: r40252 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663">Bug 6663</ulink>,
            <ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666">bug 6666</ulink>,
            <ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667">bug 6667</ulink>,
            <ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668">bug 6668</ulink>,
            <ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669">bug 6669</ulink>,
            <ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670">bug 6670</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.</para>
          <!-- <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-????">CVE-2012-????</ulink>
          </para> -->
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-02.html">wnpa-sec-2012-02</ulink>
          </para>
          <para>
            Wireshark could dereference a NULL pointer and crash.
            <!-- Fixed in trunk: r40194 -->
            <!-- Fixed in trunk-1.6: r40399 -->
            <!-- Fixed in trunk-1.4: r40360 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634">Bug 6634</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.</para>
          <!-- <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-????">CVE-2012-????</ulink>
          </para> -->
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-03.html">wnpa-sec-2012-03</ulink>
          </para>
          <para>
            The RLC dissector could overflow a buffer.
            <!-- Fixed in trunk: r40266, r40275  -->
            <!-- Fixed in trunk-1.6: r40400, r40401 -->
            <!-- Fixed in trunk-1.4: r40360 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391">Bug 6391</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.</para>
          <!-- <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-????">CVE-2012-????</ulink>
          </para> -->
        </listitem>

      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!-- Sort by bug # -->
<!--
        <listitem><para>
          Wireshark can contribute to ennui in adolescent rats.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->
        <listitem><para>
          &quot;Closing File!&quot; Dialog Hangs.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3046">Bug
          3046</ulink>)
        </para></listitem>

        <listitem><para>
          Sub-fields of data field should appear in exported PDML as children of the data field instead of as siblings to it.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3809">Bug
          3809</ulink>)
        </para></listitem>

        <listitem><para>
          Patch to fix memory leaks/errors in Lua plugin.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5575">Bug
          5575</ulink>)
        </para></listitem>

        <listitem><para>
          Incorrect time differences displayed with time reference set.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5580">Bug
          5580</ulink>)
        </para></listitem>

        <listitem><para>
          Wrong packet type association of SNMP trap after TFTP transfer.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5727">Bug
          5727</ulink>)
        </para></listitem>

        <listitem><para>
          Export HTTP Objects -&gt; save all crashes Wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6250">Bug
          6250</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark crashes if a field of type BASE_CUSTOM is applied as a column.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6503">Bug
          6503</ulink>)
        </para></listitem>

        <listitem><para>
          Filter Expression dialog can only be opened once.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6537">Bug
          6537</ulink>)
        </para></listitem>

        <listitem><para>
          80211 QoS Control: Add Raw TID.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6548">Bug
          6548</ulink>)
        </para></listitem>

        <listitem><para>
          CAPWAP dissector tries to allocate -1 bytes of memory during reassembly.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6555">Bug
          6555</ulink>)
        </para></listitem>

        <listitem><para>
          IPv6 frame containing routing header with 0 segments left calculates wrong UDP checksum.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6560">Bug
          6560</ulink>)
        </para></listitem>

        <listitem><para>
          IPv4 UDP/TCP Checksum incorrect if routing header present.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6561">Bug
          6561</ulink>)
        </para></listitem>

        <listitem><para>
          Incorrect Parsing of SCPS Capabilities Option introduced in response to bug 6194.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6562">Bug
          6562</ulink>)
        </para></listitem>

        <listitem><para>
          Add more length checks for integer values in SNMP variable bindings.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6564">Bug
          6564</ulink>)
        </para></listitem>

        <listitem><para>
          UCP dissector bug of operation 61.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6570">Bug
          6570</ulink>)
        </para></listitem>

        <listitem><para>
          Various crashes after loading NetMon2.x capture file.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6578">Bug
          6578</ulink>)
        </para></listitem>

        <listitem><para>
          SIGSEGV in SVN 40046.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634">Bug
          6634</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark dissects TCP option 25 as an &quot;April 1&quot; option.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6643">Bug
          6643</ulink>)
        </para></listitem>

        <listitem><para>
          ZigBee ZCL Dissector reports invalid status.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6649">Bug
          6649</ulink>)
        </para></listitem>

        <listitem><para>
          Large packet length crashes Wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663">Bug
          6663</ulink>)
        </para></listitem>

        <listitem><para>
          5views capture file that crashes wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666">Bug
          6666</ulink>)
        </para></listitem>

        <listitem><para>
          i4b capture file that crashes wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667">Bug
          6667</ulink>)
        </para></listitem>

        <listitem><para>
          iptrace capture file that crashes wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668">Bug
          6668</ulink>)
        </para></listitem>

        <listitem><para>
          netmon2 capture file that crashes wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669">Bug
          6669</ulink>)
        </para></listitem>

        <listitem><para>
          novell capture file that crashes wireshark.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670">Bug
          6670</ulink>)
        </para></listitem>

        <listitem><para>
          [UDP] - Length Field of Pseudo Header while computing CheckSum is not correct.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6711">Bug
          6711</ulink>)
        </para></listitem>

        <listitem><para>
          pcapio.c: bug in libpcap_write_interface_description_block.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6719">Bug
          6719</ulink>)
        </para></listitem>

      </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title>
    <para>

<!-- Sort alphabetically -->

CAPWAP,
HTTP,
IEEE 802.11,
IPv4,
IPv6,
RLC,
SNMP,
TCP,
TFTP,
ZigBee ZCL

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

Accellent 5Views,
AIX iptrace,
HP-UX nettl,
I4B,
Microsoft Network Monitor,
Novell LANalyzer,
PacketLogger,
Pcap-ng,
Sniffer,
Tektronix K12,
WildPackets {Airo,Ether}Peek.

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About->Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with the same libraries as the
      32-bit installer.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3610">Bug
      3610</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Training is available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
