Wireshark ships 5.0.0rc2, the second step before its first major update in years
The second release candidate for Wireshark 5.0 is out, carrying a brand-new theme system, per-packet process tracking, and a finally complete HTTP/3 dissector.
Wireshark just published 5.0.0rc2, the second release candidate for its first real version bump in a long while. Announced November 11, it lands about a week after 5.0.0rc1 and roughly five months after the 4.6 stable line. The "rc" tells you everything: this is an experimental pre-release. The Foundation wants testers to break it before the thing is final.
For those who've been living under a rock, Wireshark is what the project calls "the world's most popular network protocol analyzer." It captures traffic, dissects it layer by layer, and lets you pause mid-stream to inspect each field. You load a web page or stream a video, that traffic breaks into packets with headers and payloads, and Wireshark shows you who sent it, to whom, and whether anything looks off.
Its origins are comfortably old-school. In 1998, Gerald Combs launched it as "Ethereal" partly out of irritation, since commercial analyzers cost roughly $1,500 and refused to run on his company's Solaris and Linux boxes. He open-sourced it because he had no better option. A trademark dispute renamed it Wireshark in 2006, and after ownership passed through CACE, Riverbed, and Sysdig, the project settled into the independent Wireshark Foundation in 2023. It turned 25 that July. In late 2026 the board expanded, which is a strange thing to say about software that started on a GTK+ mailing list.
What the "5.0.0rc2" label means
Software on a fast cadence uses semantic versioning, so jumping from 4.x to 5.0 means changes significant enough to break things. Before those land, developers ship release candidates, feature-complete builds flagged as experimental so testers can surface problems.
The timeline is 4.6 as the current stable maintenance line (October 2025), 4.7.x as the series 5.0 is built on, and rc2's notes diff against baselines up through 4.7.4. rc1 shipped October 31. rc2 is here now, making it the second-to-last step before the final 5.0.
Keep in mind that the notes are organized as incremental diffs, the standard Wireshark way of making a massive change set digestible. The bottom line: install it, stress it, file bugs. Most users should wait for the stable build unless they want the features or actually enjoy bug hunting.
The changes worth caring about
Hundreds of changes live in this build, but a handful stand out.
The biggest one for day-to-day use is the theme system. For years, Wireshark's colors came from a pile of individual preferences. Now they come from a single theme file. You pick a theme, pick Light, Dark, or System appearance, and preview before applying. The shipped options cover the Wireshark Default, High Contrast, color-blind-friendly Protanopia and Deuteranopia (plus Tritanopia), Solarized, three Catppuccin variants, and two Tokyo Night themes. A new Contrast setting handles readability, expert-information icons now differ by shape as well as color, and rc2 adds a Theme Designer tool so you can copy and edit any theme visually.
Then there's per-packet process tracking, one of the more interesting plays here. Version 5.0 records which process on the capturing host sent or received each packet, via a new --process-info option, exposing it as frame.process fields. It answers a question analysts have wanted for years,: "which app made that connection?," while keeping a privacy off-switch. The full mode does record command lines and user info, but a new editcap --discard-process-info flag strips that before you share a capture. It works on Windows, Linux, and macOS.
Zstandard compression for captures is another practical win. Save files with zstd, and the command-line tools take --compress zstd. Output uses independent frames up to 4 MiB each, which means fast seeking through large captures.
Elsewhere in the release: a built-in Lua debugger with breakpoints and stack traces, a completed HTTP/3 dissector (reassembly, decompression, Follow Stream, Export Objects), a Distribution dialog, an IMSI List for cellular subscribers, emoji-based packet tagging, and whole-window zooming.
Not everything survived the cut. Qt 5 is gone, so building now needs Qt 6. The old individual color preferences are gone too, folded into themes. Dumpcap's TCP@host:port interface has disappeared, and you'll want socat or ncat to redirect interfaces now. The Windows minimum sits at 10 21H2.
More under the hood
The protocol list grows as it always does, with a large batch spanning media and telecom, industrial and IoT, and enterprise and cloud, alongside a pile of security and crypto dissectors. A new file-format decoder covers Bachmann M-Module and the Xiph.org Ogg Stream. The number of protocol updates is too large to enumerate, so the notes lean on that. One rename worth remembering: "ike" is now preferred over "isakmp", with the older name retained as an alias.
Plugin authors face API changes. The tvb routines now take unsigned offsets, the -1-means-to-end trick is gone, and Heimdal Kerberos linking is deprecated. Extcap binaries now get searched under /usr/libexec/wireshark/extcap by default, and they can accept a graceful quit control message on any platform.
For maintainers there are housekeeping items: Npcap bumped to 1.89, Qt to 6.12.0, and Windows MSI packages no longer bundle the Visual C++ Redistributable. That has to be installed separately now.
It's arguably competing with more endpoint-oriented tooling by adding per-packet process tracking, dragging packet analysis a step closer to EDR-style visibility. However, at the same time, dropping Qt 5 and the legacy coloring files is the expected price of a 5.0, valuable long-term but worth watching if you maintain a package.
How to get it
Source code and install packages are at the official Wireshark download page, with Linux vendors often supplying their own packaged versions.
