Wireshark 5.0.0rc1 ships with the first major version bump in years
The world's most popular packet analyzer just crossed into a new major version number, and the team made sure it actually meant something. Wireshark 5.0.0rc1 is out now as an experimental release candidate, quietly making changes that would have justified a major-version bump on their own.
The experimental candidate drops Qt 5, ends the odd/even numbering scheme, and adds Zstandard-compressed captures and per-packet process attribution, all landing ahead of SharkFest EU.
Announced Wednesday (October 21) on the wireshark-announce mailing list, the release is led by project head Gerald Combs under the Wireshark Foundation. He called it "an experimental release intended to test new features for Wireshark 5.0." Not the final 5.0.0, and there's no date on that just yet. The team expects a clearer picture after SharkFest EU, which runs November 2 through 6.
A milestone that actually counts
The obvious change: this is the first release to drop Qt 5 support. Qt 6 is now required, and that kind of platform shift is exactly what historically earns a major-version bump.
There's a second one buried in the numbering scheme. 5.0 is the last branch to follow the odd/even rule, where even minor versions are stable and odd ones are development builds. The project's own documentation says it plainly: until major release 5, the minor number basically tracks that scheme. It ends here.
Then there's the new theme engine. Colors now come from a single theme instead of dozens of individual color settings. A renamed "Appearance › Theme and Font" page lets you pick a theme, toggle Light or Dark, set the font, and preview it on a mock window. Custom themes install as single JSONC files in your themes folder, and any old per-color settings auto-migrate on upgrade.
The rest of the headline features are arguably more useful. Capture files can now be saved in Zstandard compression with a tunable level, and every packet can be attributed to the process that sent or received it. Dumpcap, TShark, and Wireshark all record this now, storing it as frame.process fields in pcapng. A new Processes profile adds PID and Proc Name columns.
Deep HTTP/3 dissection lands too, with reassembly, decompression for gzip, deflate, brotli, and zstd, plus Follow Stream and request/response tracking. It's been available since 4.7.2, so this mostly rolls it into the major line. Smaller polish includes packet tagging with emojis, icons that scale with Zoom, and a macOS icon that supports Liquid Glass.
Keep in mind that some of this is incremental rather than fresh, which is fine for a release candidate meant to shake out bugs.
What got cut, and where to grab it
Major releases take things away too. The per-color Appearance preferences are gone, now handled by the active theme. Dumpcap's TCP@host:port interface is gone, so redirect with socat or ncat. Sharkd now only binds to loopback over IPv4 and IPv6, and it rejects Linux abstract domain sockets from processes running under a different UID.
Packagers should note a few more. Windows installers ship Npcap 1.89 and Qt 6.11.1 now, MSI packages no longer bundle the Visual C++ Redistributable, and extcap binaries are searched under libexec by default.
For the long view, this project started in 1997 as Ethereal, a tool Combs built as a grad student at a small ISP because commercial analyzers cost around $1,500 and didn't run on Solaris or Linux. It renamed to Wireshark in 2006 over a trademark dispute, hit 1.0 in 2008, and moved under the Sysdig-run Wireshark Foundation in 2023. A lot of history for a tool to be hitting a new major milestone in.
The candidate is up on the usual download page. The source tarball is about 5.97 MB, and the announcement carries full SHA-256 and SHA-1 hashes so you can verify every file yourself. Head here to grab it.
