Ethereal is the world's most popular network protocol analyzer. It is used for troubleshooting, analysis, development, and education.

The following bugs have been fixed since the previous release: The ISAKMP dissector could exhaust system memory. Versions affected: 0.10.11 to 0.10.12. The FC-FCS dissector could exhaust system memory. Versions affected: 0.9.0 to 0.10.12. The RSVP dissector could exhaust system memory. Versions affected: 0.9.4 to 0.10.12. The ISIS LSP dissector could exhaust system memory. Versions affected: 0.8.18 to 0.10.12. The IrDA dissector could crash. Versions affected: 0.10.0 to 0.10.12. The SLIMP3 dissector could overflow a buffer. Versions affected: 0.9.1 to 0.10.12. The BER dissector was susceptible to an infinite loop. Versions affected: 0.10.3 to 0.10.12. The SCSI dissector could dereference a null pointer and crash. Versions affected: 0.10.3 to 0.10.12. If the "Dissect unknown RPC program numbers" option was enabled, the ONC RPC dissector might be able to exhaust system memory. This option is disabled by default. Versions affected: 0.7.7 to 0.10.12. The sFlow dissector could dereference a null pointer and crash. Versions affected: 0.9.14 to 0.10.12. The RTnet dissector could dereference a null pointer and crash. Versions affected: 0.10.8 to 0.10.12. The SigComp UDVM could go into an infinite loop or crash. Versions affected: 0.10.12. The PCRE library that ships with the Windows installer has been upgraded from version 4.4 to 6.3 in response to a security vulnerability.

The following features are new (or have been significantly updated) since the last release: The timestamp display precision of the Packet List can be adjusted now. The precision will be automatically adjusted depending on the file format loaded, e.g. libpcap typically uses microsecond resolution displayed like "0.000000". In addition you can adjust the precision manually through the View/Time Display Format menu items. The WinPcap version 3.1 installer was released since the last Ethereal release. The version included in the Ethereal Windows installer has been updated from 3.1 beta 4 to 3.1. If you want to upgrade WinPcap separately or install a different version you can download it from: the WinPcap web site. The behavior of the display filter "ip.checksum_bad" has changed. Instead of merely checking for its presence you must now make sure it is set, e.g. instead of using "ip.checksum_bad" you must now use "ip.checksum_bad == 1". A new capture file format "Nanosecond libpcap (Ethereal)" was added. It is very similar to the common libpcap file format but is capable of keeping nanosecond resolution timestamps. This format is currently supported only by Ethereal.

Download ethereal-setup-&EtherealCurrentVersion;.exe from the Windows download area on the main web site. Double-click the installer executable.

Download the appropriate package from the Solaris download area on the main web site. Uncompress the package using bzip2, and install it using pkgadd.

Download ethereal-&EtherealCurrentVersion;.tar.gz from the main download area on the web site. Extract the package using tar and gzip. Run "configure ; make ; make install".

Most Linux and Unix vendors supply their own Ethereal packages. You can install or upgrade Ethereal using the package management system specific to that platform.

Ethereal and Tethereal look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary from platform to platform. You can use About->Folders to find the default locations on your system.

On Windows systems the packet list scroll bar can sometimes disappear or become unusable. Until the problem is fixed you can work around it by resizing the packet list or the main window. (Bug #220)