<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 38088 2011-07-18 16:21:42Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
  <!ENTITY WiresharkCurrentVersion "1.6.1">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed. See the
      <ulink url="http://www.wireshark.org/security/wnpa-sec-2011-11.html">security advisory</ulink> for details and a workaround.

      <itemizedlist>

        <listitem>
          <para>
            The Lucent/Ascend file parser was susceptible to an infinite loop.
            <!-- Fixed in trunk: r37625 -->
            <!-- Fixed in trunk-1.6: r37965 -->
            <!-- Fixed in trunk-1.4: r38009 -->
            <!-- Fixed in trunk-1.2: r37809 -->
            <!-- (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=????">Bug
            ????</ulink>) -->
          </para>
          <para>Versions affected: 1.2.0 to 1.2.17, 1.4.0 to 1.4.7, and 1.6.0.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2597">CVE-2011-2597</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            The ANSI MAP dissector was susceptible to an infinite loop.
            <!-- Fixed in trunk: r37930 -->
            <!-- Fixed in trunk-1.6: r37966 -->
            <!-- Fixed in trunk-1.4: r38010 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6044">Bug
            6044</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.7, and 1.6.0.</para>
          <para>
	    <!--
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-????">CVE-2011-????</ulink>
	  -->
          </para>
        </listitem>
      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!-- Sort by bug # -->
<!--
        <listitem><para>
	  Wireshark will ruin your favorite songs by singing them a capella,
	  loudly, and slightly off key.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->

        <listitem><para>
	  TCP dissector doesn't decode TCP segments of length 1.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4716">Bug
          4716</ulink>)
        </para></listitem>

        <listitem><para>
          wireshark 1.4.0rc1 and python - spurious message.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4878">Bug
          4878</ulink>)
        </para></listitem>

        <listitem><para>
	  Missing LUA function.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5006">Bug
          5006</ulink>)
        </para></listitem>

        <listitem><para>
	  Lua API description about creating a new Tvb from a bytearray is not correct in wireshark's user guide.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5199">Bug
          5199</ulink>)
        </para></listitem>

        <listitem><para>
	  Character echo pauses in Capture Filter field in Capture Options.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5356">Bug
          5356</ulink>)
        </para></listitem>

        <listitem><para>
	  White space in protocol field abbreviation causes runtime failure while registering Lua dissector.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5569">Bug
          5569</ulink>)
        </para></listitem>

        <listitem><para>
	  "File not found" box uses wrong filename encoding.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5715">Bug
          5715</ulink>)
        </para></listitem>

        <listitem><para>
	  capinfos: #ifdef HAVE_LIBGCRYPT block includes a line too many .
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5803">Bug
          5803</ulink>)
        </para></listitem>

        <listitem><para>
	  Wireshark crashes if Lua contains "Pref.range()" with missing arguments.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5895">Bug
          5895</ulink>)
        </para></listitem>

        <listitem><para>
	  The "range" field in Lua's "Pref.range()" serves as default while the "default" field does nothing .
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5896">Bug
          5896</ulink>)
        </para></listitem>

        <listitem><para>
	  Wireshark crashes when calling TreeItem:set_len() on TreeItem without tvb.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5941">Bug
          5941</ulink>)
        </para></listitem>

        <listitem><para>
	  TvbRange_string(lua_State* L) call a wrong function.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5960">Bug
          5960</ulink>)
        </para></listitem>

        <listitem><para>
	  VoIP call flow graph displays BICC APM as a BICC ANM.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5966">Bug
          5966</ulink>)
        </para></listitem>

        <listitem><para>
	  Cannot Live-capture VirtualBox network packets with Wireshark; pipe problem.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6002">Bug
          6002</ulink>)
        </para></listitem>

        <listitem><para>
	  Interface list in Capture Options isn't cleared when selecting other host.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6008">Bug
          6008</ulink>)
        </para></listitem>

        <listitem><para>
	  H323 rate multiplier wrong.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6009">Bug
          6009</ulink>)
        </para></listitem>

        <listitem><para>
	  Inclusion of config.h is too late in lex-files resulting in wrong definition of _FILE_OFFSET_BITS.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6012">Bug
          6012</ulink>)
        </para></listitem>

        <listitem><para>
	  tshark crashes when loading Lua script that contains GUI function.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6018">Bug
          6018</ulink>)
        </para></listitem>

        <listitem><para>
	  802.11 Disassociation Packet's "Reason Code" field is imprecisely decoded/described.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6022">Bug
          6022</ulink>)
        </para></listitem>

        <listitem><para>
	  Wireshark crashes when setting custom column's field name with conditional.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6028">Bug
          6028</ulink>)
        </para></listitem>

        <listitem><para>
	  Crash after applying "expert.severity" field as column.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6035">Bug
          6035</ulink>)
        </para></listitem>

        <listitem><para>
	  GTS Descriptor count limited to 3 instead of 7.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6055">Bug
          6055</ulink>)
        </para></listitem>

        <listitem><para>
	  The SSL dissector can not resemble correctly the frames after TCP zero window probe packet.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6059">Bug
          6059</ulink>)
        </para></listitem>

        <listitem><para>
	  Packet parser takes too long for this trace.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6073">Bug
          6073</ulink>)
        </para></listitem>

        <listitem><para>
	  The SSL dissector can not resemble correctly the frames after TCP zero window probe packet.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6059">Bug
          6059</ulink>)
        </para></listitem>

        <listitem><para>
	  Wireshark crashes after repeating "File -> Import -> Cancel".
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6080">Bug
          6080</ulink>)
        </para></listitem>

        <listitem><para>
	  Decoding of MQ ASCII and EBCDIC Traffic Flow - ASCII shows fine, EBCDIC does not.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6084">Bug
          6084</ulink>)
        </para></listitem>

        <listitem><para>
	  802.11 Association Response Packet's "Status Code" field is imprecisely decoded/described.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6093">Bug
          6093</ulink>)
        </para></listitem>

        <listitem><para>
	  Abis interface not correctly handled in gsmtap dissector.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6097">Bug
          6097</ulink>)
        </para></listitem>

        <listitem><para>
	  Wrong decoding of RLC/MAC EGPRS Packet Downlink Ack/Nack (3GPP TS 44.060).
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6098">Bug
          6098</ulink>)
        </para></listitem>

        <listitem><para>
	  CSN Ack/Nack Description wrongly handled in gsm_rlcmac_dl dissector (3GPP TS 44.060).
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6101">Bug
          6101</ulink>)
        </para></listitem>

        <listitem><para>
          wireshark 1.6.0 and python support: installer fails to create the wspy_dissectors subdirectory and .
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6110">Bug
          6110</ulink>)
        </para></listitem>

        <listitem><para>
          Wireshark crash during RTP stream analysis.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6120">Bug
          6120</ulink>)
        </para></listitem>

        <listitem><para>
          Tshark custom columns: Why don't I get an error message?
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6131">Bug
          6131</ulink>)
        </para></listitem>

      </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title> <para>

<!-- Sort alphabetically -->

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

Network Monitor.

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About→Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with libsmi.
      (<ulink url="http://wiki.wireshark.org/Development/Win64">Win64
      development page</ulink>)
    </para>

    <para>
      Application crash when changing real-time option.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4035">Bug
      4035</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

    <para>
      Wireshark and TShark will display incorrect delta times in some cases.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5356">Bug
      4985</ulink>
      and
      <ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5356">bug
      5580</ulink>)
    </para>

    <para>
      Character echo pauses in Capture Filter field in Capture Options.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5356">Bug
      5356</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Training is available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
