New Features and Changes in Wireshark 4.0

Wireshark is the world’s most popular network protocol analyzer, used for troubleshooting, analysis, development, and education. Wireshark 4.0 was recently released, bringing many changes since version 3.6.

Default main window layout

In past versions, Wireshark followed the traditional layout that stacked the packet list, packet details, and byte view on top of each other. This standard was created when most monitors had a 4:3 aspect ratio and lower resolution. Starting with Wireshark 4.0, the default layout places the details and byte view side by side, making better use of modern screen space.

Conversations and Endpoints

The Conversations and Endpoints dialog is a popular feature that users often check first when investigating a problem. Wireshark 4.0 makes it more powerful and easier to use: TCP and UDP conversations can now be viewed side‑by‑side in separate windows, sorting has been improved, columns can be hidden, streams can be filtered, and data can be exported as JSON.

Hex Dump Import

Sometimes the packets of interest are embedded in a hex dump rather than in a pcap/pcapng file. Wireshark provides two ways to convert a hex dump to a pcap: the “Import From Hex Dump” option in the main program and the text2pcap tool. In earlier versions these methods behaved differently, but in Wireshark 4.0 they are more consistent.

Features that will disappear

Official 32‑bit Windows packages will no longer be provided for Wireshark 4.0 and later. Users on 32‑bit Windows will continue to receive updates for Wireshark 3.6 until 2024, but will miss the new features introduced in 4.0 and beyond.

Features still under development

Two highly requested Windows features are not yet available in 4.0: dark mode and Arm64 support. Dark mode depends on Qt UI library support and may arrive in Wireshark 4.2. Building Arm64 packages requires hardware and library support, also expected in Wireshark 4.2.