Wireshark 4.4.0 Release Notes

A number of crasher bugs have been fixed.

The protocol tree context menu can open a I/O graph of the currently selected field. Issue 11362

Smaller intervals can be used, down to 1 microsecond. Issue 13682

A larger number of I/O Graph item buckets can be used, up to 2²⁵ (33 million) items. Issue 8460

The size of individual graph items has been reduced, which reduces memory utilization.

When the Y field or Y axis changes, the graph displays the new graph correctly, retapping if necessary, instead of displaying information based on stale data.

The graph is smarter about choosing whether to retap (expensive), recalculate (moderately intensive), or replot (cheap) in order to display the newly chosen options correctly with the least amount of calculations. For instance, a graph that has previously been plotted and is disabled and then reenabled without any other changes will not require a new retap. Issue 15822

LOAD graphs are graphed properly again. Issue 18450

Y axes have human readable units with SI prefixes. Issue 12827

Bar widths are scaled to the size of the interval.

Bar border colors are a slightly darker color than that of the graph itself, instead of always black. Issue 17422

Time values have the correct width when axes are automatically reset.

The precision of the interval time shown in the hint message depends on the interval.

The tracer follows the currently selected row on the table of graphs, and does not appear on an invisible graph.

The tracer moves to the frame selected in the main window. Issue 12909

Pending graph changes are saved when changing profiles when the I/O Graphs dialog is open.

I/O Graph dialog windows for closed capture files are no longer affected by changing the list of graphs (either in that dialogs or in other dialogs for the currently open file.)

Newly created temporary graphs, which will not be saved unless the configuration has changed, are more clearly marked with italics.

When "Time of Day" is selected for a graph, the absolute time will be saved to CSV exports instead of the relative time. Issue 13717

Graphs can be reordered by dragging and dropping their list entries. Issue 13855

The graph layer order and legend order always matches the order in the graph list. Legends also appear properly. Issue 13854

The legend can be moved to other corners of the graph by right-clicking on it and selecting its new location from a menu.

For purposes of displaying zero values, graphs with both lines and data point symbols are treated as line graphs, not scatter plots.

Logarithmic ticks are used when the Y axis is logarithmic.

The graph crosshairs context menu option works.

You can resize the graph list columns to their contents by right clicking on the list header. Issue 18102

The graph is more responsive to mouse movement, especially on Linux Wayland.

When exporting the graph as an image, the entire graph is shown with up to 1000 items instead of only what was visible on-screen. This value can be increased in the preferences. Issue 13504

Endpoints that share the same address now have two distinct nodes with a line between them. Issue 12038

The "Comment" column can be resized by selecting the axis between the "Comment" column and the graph and dragging, and auto-resized by double-clicking the column. Issue 4972

Tooltips are shown for elided comments.

The scroll direction via keyboard is no longer reversed. Issue 12932

The column widths are fixed instead of resizing slightly depending on the visible entries. Issue 12931

The Y axis labels stay in the correct position without having to click the Reset button.

The progress bar appears correctly in the Flow Graph (non VoIP Calls).

The behavior of the "Any" and "Network" combobox is corrected. Issue 19818

"Limit to Display Filter" is checked if a display filter is applied when the Flow Graph is opened, per the documentation.

A better decision is made about which side is the server and thus the initially chosen direction in the graph.

The "Window Scaling" graph axis labels are corrected and show both graphs.

The graph crosshairs context menu option works.

Switching between relative and absolute sequence numbers works again.

Better handling of comparisons with value strings. Now the display filter engine can correctly handle cases where multiple different numeric values map to the same value string, including but not limited to range-type value strings.

Fields with value strings now support regular expression matching.

Date and time values now support arithmetic, with some restrictions: the multiplier/divisor must be an integer or floating point number and appear on the right-hand side of the operator.

The keyword "bitand" can be used as an alternative syntax for the bitwise-and operator.

Functions alone can now be used as an entire logical expression. The result of the expression is the truthiness of the function return value (or of all values if more than one). This is useful for example to write "len(something)" instead of "len(something) != 0". Even more so if a function returns itself a boolean value, it is now possible to write "bool_test(some.field)" instead of having to write "bool_test(some.field) == True". Both forms are now valid.

Display filter references can be written without curly braces. It is now possible to write $frame.number instead of ${frame.number} for example.

There are new display filter functions which test various IP address properties. Check the wireshark-filter(5) man page for more information.

There are new display filter functions which convert unsigned integer types to decimal or hexadecimal, and convert fields with value strings into the associated string for their value, which can be used to produce results similar to custom columns. Check the wireshark-filter(5) man page for more information.

Display filter macros can be written with a semicolon after the macro name before the argument list, e.g. ${mymacro;arg1;…​;argN}, instead of ${mymacro:arg1;…​;argN}. The version with semicolons works better with pop-up suggestions when editing the display filter, so the version with the colon might be removed in the future.

Display filter macros can be written using a function-like notation. The macro ${mymacro:arg1;…​;argN} can be written $mymacro(arg1,…​,argN).

AX.25 addresses are now filtered using the "CALLSIGN-SSID" string syntax. Filtering based on the raw bytes values is still possible, like other field types, with the @ operator. Issue 17973

Display filter functions, like len(tcp.payload), including nested functions like min(len(tcp.payload), len(udp.payload)) and newly defined functions using the plugin system mentioned above. Issue 15990 Issue 16181

Arithmetic calculations, like ip.len * 8 or tcp.srcport + tcp.dstport. Issue 7752

Slices, like tcp.payload[4:4]. Issue 10154

The layer operator, like ip.proto#1, which will return the protocol field in the first IPv4 layer if there is tunneling. Issue 18588

Raw byte addressing, like @ip, which will return the bytes of protocol or FT_NONE fields, among others. Issue 19076

Logical tests, like tcp.port == 443, which produce a check mark if the test matches (similar to protocol and FT_NONE fields without @.) This works with all logical operators, including e.g. regular expression matching (matches or ~.)

Defined display filter macros.

Any combination of the above also works.

Multifield columns are still available. For backwards compatibility, X or Y is interpreted as a multifield column as before. To represent a logical test for the presence of multiple fields instead of concatenating values, use parenthesis, e.g. (tcp.options.timestamp or tcp.options.nop).

Field references are not implemented because there’s no sense of a currently selected frame. "Resolved" column values (such as host name resolution or value string lookup) are not supported for any of the new expressions yet.

For custom output fields, X or Y is the usual logical test; to output multiple fields use multiple -e terms as before.

The various -E options, including -E occurrence, all work as expected.