A number of crasher bugs have been fixed.

The protocol tree context menu can open a I/O graph of the currently selected field. Issue 11362

Smaller intervals can be used, down to 1 microsecond. Issue 13682

A larger number of I/O Graph item buckets can be used, up to 2²⁵ items. Issue 8460

The memory usage has been improved, the size of an item has been reduced from 152 bytes to 88 bytes.

When the Y field or Y axis changes, the graph displays the new graph correctly, retapping if necessary, instead of displaying information based on stale data.

The graph is smarter about choosing whether to retap (expensive), recalculate (moderately intensive), or replot (cheap) in order to display the newly chosen options correctly with the least amount of calculations. For instance, a graph that has previously been plotted and is disabled and then reenabled without any other changes will not require a new retap. Issue 15822

LOAD graphs are graphed properly again. Issue 18450

The I/O Graph y-axis has human readable units with SI prefixes. Issue 12827

I/O Graph bar widths are scaled to the size of the interval.

I/O Graph bar border colors are a slightly darker color than that of the graph itself, instead of always black. Issue 17422

The correct width of times that appear on the graph are used when automatically resetting the axes.

The precision of the interval time shown in the hint message depends on the interval.

The tracer follows the currently selected row on the table of graphs, and does not appear on an invisible graph.

The tracer moves to the frame selected in the main window. Issue 12909

Pending graph changes are saved when changing profiles with the I/O Graphs dialog open.

I/O Graph dialog windows for closed capture files are no longer affected by changing the list of graphs (either in that dialogs or in other dialogs for the currently open file.)

Temporary graphs that have just been added and will not be saved unless the configuration has changed are more clearly marked with italics.

When Time of Day is selected on the graph, the absolute time is copied to the CSV instead of relative time. Issue 13717

The graphs can be reordered via drag and drop. Issue 13855

The graph layer order and order in the legend always matches the order in the table, and the legend appears properly. Issue 13854

The legend can be moved to other corners of the graph by right-clicking on it and selecting from a context menu.

Graphs with both lines and data point symbols are treated as line graphs, not scatter plots, for purposes of displaying zero values.

Logarithmic ticks are used when the Y-scale is logarithmic.

The graph crosshairs context menu option works.

The columns on the table of graphs can be all resized at once via the header context menu. Issue 18102

The graph is more responsive to mouse moves, especially on Linux Wayland

When exporting the graph as an image, the entire graph is shown, up to 1000 items (which can be changed in preferences), instead of only what was visible on-screen. Issue 13504

Endpoints that share a same address now have two distinct nodes with a line between them. Issue 12038

The Comment column can be resized, by selecting the axis between the Comment column and the graph and dragging, and auto-resized by double-clicking the column. Issue 4972

Tooltips are shown for elided comments

The scroll direction via keyboard is no longer reversed. Issue 12932

The column widths are fixed, instead of resizing slightly depending on the visible entries. Issue 12931

The Y-axis labels stay in the correct position without having to click Reset.

The progress bar appears correctly in the Flow Graph (non VoIP Calls.)

The behavior of the "Any" and "Network" combobox is corrected. Issue 19818

"Limit to Display Filter" is checked if a display filter is applied when the Flow Graph is opened, per the documentation.

A better decision is made about which side is the server and thus the initially chosen direction in the graph.

The Window Scaling graph axis labels are corrected and show both graphs.

The graph crosshairs context menu option works.

Switching between relative and absolute sequence numbers works again.

Better handling of comparisons with value strings. Now the display filter engine can correctly handle cases where multiple different numeric values map to the same value string, including but not limited to range-type value strings.

Fields with value strings now support regular expression matching.

Date and time values now support arithmetic, with some restrictions: the multiplier/divisor must be an integer or float and appear on the right-hand side of the operator.

The keyword "bitand" can be used as an alternative syntax for the bitwise-and operator.

Functions alone can now be used as an entire logical expression. The result of the expression is the truthiness of the function return value (or of all values if more than one). This is useful for example to write "len(something)" instead of "len(something) != 0". Even more so if a function returns itself a boolean value, it is now possible to write "bool_test(some.field)" instead of having to write "bool_test(some.field) == True" (both forms are now valid).

Display filter references can be written without curly braces. It is now possible to write $frame.number instead of ${frame.number} for example.

Added new display filter functions to test various IP address properties. Check the wireshark-filter(5) manpage for more information.

Added new display filter functions to convert unsigned integer types to decimal or hexadecimal, and convert fields with value strings into the associated string for their value (used to produce results similar to custom columns). Check the wireshark-filter(5) manpage for more information.

Display filter macros can be written with a semicolon after the macro name before the argument list, e.g. ${mymacro;arg1;…​;argN}, instead of ${mymacro:arg1;…​;argN}. The version with semicolons works better with pop-up suggestions when editing the display filter, so the version with the colon might be removed in the future.

Display filter macros can be written using a function-like notation. The macro ${mymacro:arg1;…​;argN} can be written $mymacro(arg1,…​,argN).

AX.25 addresses are now filtered using the "CALLSIGN-SSID" string syntax. Filtering based on the raw bytes values is still possible, like other field types, with the @ operator. Issue 17973

Display filter functions, like len(tcp.payload), including nested functions like min(len(tcp.payload), len(udp.payload) and newly defined functions using the plugin system mentioned above. Issue 15990 Issue 16181

Arithmetic calculations, like ip.len * 8 or tcp.srcport + tcp.dstport. Issue 7752

Slices, like tcp.payload[4:4]. Issue 10154

The layer operator, like ip.proto#1 to return the proto field in the first IPv4 layer if there is tunneling. Issue 18588

Raw byte addressing, like @ip, useful to return the bytes of a protocol or FT_NONE field, among others. Issue 19076

Logical tests, like tcp.port == 443, which produce a check mark if the test matches (similar to protocol and none fields without @.) This works with all logical operators, including e.g. regular expression matching (matches or ~.)

Defined display filter macros.

Any combination of the above also works.

Multifield columns are still available. For backwards compatibility, X or Y is interpreted as a multifield column as before. To represent a logical test for the presence of multiple fields instead of concatenating values, use parenthesis, like (tcp.options.timestamp or tcp.options.nop.

Field references are not implemented, because there’s no sense of a currently selected frame. "Resolved" column values (such as host name resolution or value string lookup) are not supported for any of the new expressions yet.

For custom output fields, X or Y is the usual logical test; to output multiple fields use multiple -e terms as before.

The various -E options, including -E occurrence, all work as expected.