Wireshark 4.6.4

Wireshark is the world's most popular network protocol analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible.

Razvan Serea News Reporter Neowin · Feb 26, 2026 04:58 EST with 0 comments

Wireshark

Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course). In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed. Wireshark is perhaps one of the best open source packet analyzers available today.

Deep inspection of hundreds of protocols, with more being added all the time
Live capture and offline analysis
Standard three-pane packet browser
Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
The most powerful display filters in the industry
Rich VoIP analysis
Read/write many different capture file formats
Capture files compressed with gzip can be decompressed on the fly
Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
Coloring rules can be applied to the packet list for quick, intuitive analysis
Output can be exported to XML, PostScript®, CSV, or plain text

Wireshark 4.6.4 changelog:

Bug Fixes

wnpa-sec-2026-05 USB HID dissector memory exhaustion. Issue 20972. CVE-2026-3201.
wnpa-sec-2026-06 NTS-KE dissector crash. Issue 21000. CVE-2026-3202.
wnpa-sec-2026-07 RF4CE Profile dissector crash. Issue 21009. CVE-2026-3203.

The following bugs have been fixed:

Wireshark doesn’t start if Npcap is configured with "Restrict Npcap driver’s Access to Administrators only" Issue 20828.
PQC signature algorithm not reported in signature_algorithms. Issue 20953.
Unexpected JA4 ALPN values when space characters sent. Issue 20966.
Expert Info seems to have quadratic performance (gets slower and slower) Issue 20970.
IKEv2 EMERGENCY_CALL_NUMBERS Notify payload cannot be decoded. Issue 20974.
TShark and editcap fails with segmentation fault when output format (-F) set to blf. Issue 20976.
Fuzz job crash: fuzz-2026-02-01-12944805400.pcap [Zigbee Direct Tunneling Zigbee NWK PDUs NULL hash table] Issue 20977.
Wiretap writes pcapng custom options with string values invalidly. Issue 20978.
RDM status in Output Status (GoodOutputB) field incorrectly decoded in Art-Net PollReply dissector. Issue 20980.
Wiretap writes invalid pcapng Darwin option blocks. Issue 20991.
TDS dissector desynchronizes on RPC DATENTYPE (0x28) due to incorrect expectation of TYPE_VARLEN (MaxLen) Issue 21001.
Only first HTTP POST is parsed inside SOCKS with "Decode As". Issue 21006.
TShark: Bogus "Dissector bug" messages generated in pipelines where something after tshark exits before reading all its input. Issue 21011.
New Diameter RAT-Types in TS 29.212 not decoded. Issue 21012.
Malformed packet error on Trigger HE Basic frames. Issue 21032.

Updated Protocol Support

Art-Net, AT, BGP, GSM DTAP, GSM SIM, IEEE 802.11, IPv6, ISAKMP, MBIM, MySQL, NAS-5GS, NTS-KE, SGP.22, Silabs DCH, Socks, TDS, TECMP, USB HID, ZB TLV, and ZBD

New and Updated Capture File Support