<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 35482 2011-01-11 18:11:35Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
  <!ENTITY WiresharkCurrentVersion "1.4.3">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed. See the
      <ulink url="http://www.wireshark.org/security/wnpa-sec-2011-02.html">security advisory</ulink> for details and a workaround.

      <itemizedlist>

        <listitem>
          <para>
            FRAsse discovered that the MAC-LTE dissector could overflow a buffer.
            <!-- Fixed in trunk: r35292 -->
            <!-- Fixed in trunk-1.4: r35457 -->
            <!-- Fixed in trunk-1.2: r35469 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5530">Bug
            5530</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.13 and 1.4.0 to 1.4.2.</para>
<!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-????">CVE-2010-????</ulink>
          </para>
-->
        </listitem>

        <listitem>
          <para>
            FRAsse discovered that the ENTTEC dissector could overflow a buffer.
            <!-- Fixed in trunk: r35318 -->
            <!-- Fixed in trunk-1.4: r35458 -->
            <!-- Fixed in trunk-1.2: r35471 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5539">Bug
            5539</ulink>)
          </para>
          <para>Versions affected: 1.2.0 to 1.2.13 and 1.4.0 to 1.4.2.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4538">CVE-2010-4538</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            The ASN.1 BER dissector could assert and make Wireshark exit
            prematurely.
            <!-- Fixed in trunk: r35342 -->
            <!-- Fixed in trunk-1.4: r35464 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5537">Bug
            5537</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.2.</para>
<!--
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-????">CVE-2010-????</ulink>
          </para>
-->
        </listitem>

      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!--
        <listitem><para>
          Wireshark can contribute to ennui in adolescent rats.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->

        <listitem><para>
          AMQP failed assertion.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4048">Bug
          4048</ulink>)
        </para></listitem>

        <listitem><para>
          Reassemble.c leaks memory for GLIB > 2.8.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4141">Bug
          4141</ulink>)
        </para></listitem>

        <listitem><para>
          Fuzz testing reports possible dissector bug: TCP.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4211">Bug
          4211</ulink>)
        </para></listitem>

        <listitem><para>
          Wrong length calculation in new_octet_aligned_subset_bits() (PER dissector).
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5393">Bug
          5393</ulink>)
        </para></listitem>

        <listitem><para>
          Function dissect_per_bit_string_display might read more bytes than available (PER dissector).
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5394">Bug
          5394</ulink>)
        </para></listitem>

        <listitem><para>
          Cannot load wpcap.dll &amp; packet.dll from Wireshark program directory.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5420">Bug
          5420</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark crashes with Copy -> Description on date/time fields.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5421">Bug
          5421</ulink>)
        </para></listitem>

        <listitem><para>
          DHCPv6 OPTION_CLIENT_FQDN parse error.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5426">Bug
          5426</ulink>)
        </para></listitem>

        <listitem><para>
          Information element Error for supported channels.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5430">Bug
          5430</ulink>)
        </para></listitem>

        <listitem><para>
          Assert when using ASN.1 dissector with loading a 'type table'.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5447">Bug
          5447</ulink>)
        </para></listitem>

        <listitem><para>
          Bug with RWH parsing in Infiniband dissector.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5444">Bug
          5444</ulink>)
        </para></listitem>

        <listitem><para>
          Help->About Wireshark mis-reports OS.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5453">Bug
          5453</ulink>)
        </para></listitem>

        <listitem><para>
          Delegated-IPv6-Prefix(123) is shown incorrect as X-Ascend-Call-Attempt-Limit(123).
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5455">Bug
          5455</ulink>)
        </para></listitem>

        <listitem><para>
          "tshark -r file -T fields" is truncating exported data.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5463">Bug
          5463</ulink>)
        </para></listitem>

        <listitem><para>
          gsm_a_dtap: incorrect "Extraneous Data" when decoding Packet Flow Identifier.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5475">Bug
          5475</ulink>)
        </para></listitem>

        <listitem><para>
          Improper decode of TLS 1.2 packet containing both CertificateRequest and ServerHelloDone messages.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5485">Bug
          5485</ulink>)
        </para></listitem>

        <listitem><para>
          LTE-PDCP UL and DL problem.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5505">Bug
          5505</ulink>)
        </para></listitem>

        <listitem><para>
          CIGI 3.2/3.3 support broken.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5510">Bug
          5510</ulink>)
        </para></listitem>

        <listitem><para>
          Prepare Filter in RTP Streams dialog does not work correctly.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5513">Bug
          5513</ulink>)
        </para></listitem>

        <listitem><para>
          Wrong decode at ethernet OAM Y.1731 ETH-CC.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5517">Bug
          5517</ulink>)
        </para></listitem>

        <listitem><para>
          WPS: RF bands decryption.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5523">Bug
          5523</ulink>)
        </para></listitem>

        <listitem><para>
          Incorrect LTP SDNV value handling.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5521">Bug
          5521</ulink>)
        </para></listitem>

        <listitem><para>
          LTP bug found by randpkt.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5323">Bug
          5323</ulink>)
        </para></listitem>

        <listitem><para>
          Buffer overflow in SNMP EngineID preferences.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5530">Bug
          5530</ulink>)
        </para></listitem>

      </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title>
    <para>

AMQP,
ASN.1 BER,
ASN.1 PER,
CFM,
CIGI,
DHCPv6,
Diameter,
ENTTEC,
GSM A GM,
IEEE 802.11,
InfiniBand,
LTE-PDCP,
LTP,
MAC-LTE,
MP2T,
RADIUS,
SAMR,
SCCP,
SIP,
SNMP,
TCP,
TLS,
TN3270,
UNISTIM,
WPS

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

Endace ERF, Microsoft Network Monitor, VMS TCPtrace.

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About->Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with the same libraries as the
      32-bit installer.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3610">Bug
      3610</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Commercial support is available from
    <ulink url="http://www.cacetech.com/products/sharknet.html">CACE Technologies</ulink>.
    </para>
    <para>
    Training is available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
