Wireshark 2.0.2 (32-bit)

Wireshark原名ethereal，是一套開放原始碼的網路協定分析儀，支援廣泛的協定剖析器，目前使用率極為廣泛。

• 純軟體的網路協定分析儀。
• 由於社群的力量，讓軟體的功能更臻健全，才有豐富協定剖析器。
• 本軟體擊敗眾多商業化的收費網路協定分析儀。
• 支援MPEG2應用層協定。
• 協定剖析器有IP，TCP，UDP，POP3，telnet，HTTP，SNMP，SMTP等等。
• 具基礎的報表功能。
• 是網路工程師、程式設計師作偵錯時的最佳利器之一。

# Vulnerabilities fixed:
- DLL hijacking vulnerability.
- ASN.1 BER dissector crash.
- DNP dissector infinite loop.
- X.509AF dissector crash.
- HTTP/2 dissector crash.
- HiQnet dissector crash.
- 3GPP TS 32.423 Trace file parser crash.
- LBMC dissector crash.
- iSeries file parser crash.
- RSL dissector crash.
- LLRP dissector crash.
- Ixia IxVeriWave file parser crash.
- IEEE 802.11 dissector crash.
- GSM A-bis OML dissector crash.
- ASN.1 BER dissector crash.
- SPICE dissector large loop.
- NFS dissector crash.
- ASN.1 BER dissector crash.

# Bugs fixed:
- HTTP 302 decoded as TCP when "Allow subdissector to reassemble TCP streams" option is enabled.
- Questionable calling of ethernet dissector by encapsulating protocol dissectors.
- [Qt & Legacy & probably TShark too] Delta Time Conversation column is empty.
- extcap: abort when validating capture filter for DLT 147.
- Missing columns in Qt Flow Graph.
- Interface list doesn’t show well when the list is very long.
- Unable to use saved Capture Filters in Qt UI.
- extcap: Capture interface options snaplen, buffer and promiscuous not being used.
- Improper RPC reassembly
- GTPv1 Dual Stack with one static and one Dynamic IP.
- Wireshark 2.0.1 MPLS dissector not decoding payload when control word is present in pseudowire.
- "…using this filter" turns white (not green or red). Plus dropdown arrow does nothing.
- EIGRP field eigrp.ipv4.destination does not show the correct destination.
- tshark -z conv,type[,filter] swapped frame / byte values from / to columns.
- The field name nstrace.tcpdbg.tcpack should be nstrace.tcpdbg.tcprtt.
- 6LoWPAN IPHC traffic class not decompressed correctly
- Crash with snooping NFS file handles.
- 802.11 dissector fails to decrypt some broadcast messages.
- Wireshark hangs when adding a new profile.
- Issues when closing the application with a running capture without packets.
- New Qt UI lacks ability to step through multiple TCP streams with Analyze > Follow > TCP Stream.
- GTK: plugin_if_goto_frame causes Access Violation if called before capture file is loaded.
- Wireshark 2.0.1 crash on start.
- Wi-Fi 4-way handshake 4/4 is displayed as 2/4.
- ACN: acn.dmx.data has incorrect type.
- editcap packet comment won’t add multiple comments.
- DICOM Sequences no longer able to be expanded.
- Wrong TCP stream when port numbers are reused.
- SSL decryption fails in presence of a Client certificate.
- LUA: TVBs backing a data source is freed too early.
- PIM: pim.group filter have the same name for IPv4 and IPv6.
- Failed to parse M3AP IE (TNL information).
- Wrong interpretation of Instance ID value in OSPFv3 packet.
- MP2T Dissector does parse RTP properly in 2.0.1.
- editcap does not adjust time for frames with absolute timestamp 0 < t < 1 secs.
- Guard Interval is not consistent between Radiotap & wlan_radio.
- Calling dumpcap -i- results in access violation.
- Qt: Friendly Name and Interface Name columns should not be editable.
- PPTP GRE call ID not always decoded.
- Interface list does not show device description anymore.
- Find Packet does not highlight the matching tree item or packet bytes.
- "total block length … is too large" error when opening pcapng file with multiple SHB sections.
- http.request.full_uri is malformed if an HTTP Proxy is used.
- SNMP dissector fails at msgSecurityParameters with long length encoding.
# Updated Protocol Support
- 6LoWPAN, ACN, ASN.1 BER, BATADV, DICOM, DNP3, DOCSIS INT-RNG-REQ, E100, EIGRP, GSM A DTAP, GSM SMS, GTP, HiQnet, HTTP, HTTP/2, IEEE 802.11, IKEv2, InfiniBand, IPv4, IPv6, LBMC, LLRP, M3AP, MAC LTE, MP2T, MPLS, NFS, NS Trace, OSPF, PIM, PPTP, RLC LTE, RoHC, RPC, RSL, SNMP, SPICE, SSL, TCP, TRILL, VXLAN, WaveAgent, and X.509AF
# New and Updated Capture File Support
- 3GPP TS 32.423 Trace, iSeries, Ixia IxVeriWave, pcap, and pcapng
# Vendor-supplied Packages
- Most Linux and Unix vendors supply their own Wireshark packages. You can usually install or upgrade Wireshark using the package management system specific to that platform. A list of third-party packages can be found on the download page on the Wireshark web site.
# File Locations
- Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About→Folders to find the default locations on your system.