#2 Wireshark Version Bump Required

[Andrew Fernandes]

Hey, Roland - thanks for taking the time and effort to do this... much, much appreciated!

Would it be asking too much to ask for a wireshark plugin version for the official 1.99.6+ release of Wireshark?

There is a practical reason for this request.

The 1.12.x wireshark release requires apple's standard X11 install. However, I'm a macports developer, and I have the xquarts X11 stack installed. The 1.12.x wireshark release hard-codes a requirement check on apple's deprecated X11 stack... so I can't use it.

I can (and have) installed wireshark from macports.

However, the version check that your software uses fails the version check on the macports 1.12.x version since the output of 'tshark' does not match the expected regex. (There is no 'v' in front of the version and no '-' before the brackets. Sigh.)

So what I had to do is install the macports 1.12.x, edit the binary to match the expected version, and make a shell 'tshark' wrapper that spat out the expected version string if invoked with '-v' and exec'ed the actual program otherwise.

This is nasty, as you can imagine.

With the 1.99.x official wireshark release, all of those problems go away.

I'd also happily volunteer my time to compile, build, test, etc and would be fine to sign a restricted NDA if required.

You can email me directly at andrew~AT~fernandes.org

Cheers, and thanks!
-Andrew.

[Roland King]

What's the 1.99.x wireshark series? I haven't been keeping up recently. I know there was 1.10 which was X11 and then they started on 1.11 which was going to be the Qt port and the next release, however it seems the amount of work was completely underestimated and the wireshark team ended up releasing 1.12 which is an X11 version using some of the underlying dissector code which was going to the 1.11 Qt port but not the Qt bit.

I actually started developing this on 1.11, got all the dissector stuff going, only to find wireshark itself at that point was missing so many features it didn't work, eg capture from a pipe which was a pretty basic requirement :). There were another couple of completely unimplemented showstoppers too, I don't recall what they were now, all I remember is every time I filed a bug report I got back 'not yet implemented - planned'.

If Wireshark 2.0 is the Qt release and it's getting close, that's great because I'd love not to have to run X11 any more either and the Qt one looked quite pretty, well the bits which worked did.

From a stability and version spew point of view I'd prefer to wait until they actually release a full 2.0 release and then do a bump in the the tool. I chased the 1.11 releases for a month or more at the start of the project and it was somewhat of a frustrating experience.

Am I correct about what 1.99.x is and do you have a good feeling when 2.0 is coming and whether it's feature complete enough to use?

[Roland King]

See ticket #3