So I will revisit this topic a bit later in the year. Decoding and http3 stream is probably very similar. But I guess and anticipate that this feature is not too far away, as it as also been implemented in Wireshark for http2.

Unfortunately, even 3.7.0 does not decode the data inside the http3 streams, but seeing the http3 headers and the general protocol is better than nothing. When it comes to http3, the difference between Wireshark 3.2.3 and 3.7.0 are quite significant. A nice bonus: The new binary does not overwrite Ubuntu 20.04’s older version, so both can be used in parallel to check for differences in packet decoding. The comments in the repository also contain the command how to give the dumpcap library root rights, so Wireshark itself can be run from a non-root user account. This gap is filled by this Github Gist, which contains a straight forward bash script that installs the required libraries, pulls the Wireshark code from Github and then executes the commands to compile the binary. While the Wireshark repository and the latest source (v3.7.0 at the time of writing) are hosted on Github, the instructions to compile the code and which libraries are required are a bit vague.

Sounds more complicated than it actually is. When it comes to Linux, there are no binaries of the latest version available, one has to compile from source. As I wanted to have a closer look at http3 and also at some 5G core network related interactions (the two topics are independent), I decided to get the latest Wireshark version to see if the dissectors of the latest version would show me more than those in the two year old version of Wireshark. Some programs are evolving quickly, however, and when it comes to Wireshark, it might be good to have the latest version. For most programs, that is just fine for me. This means that some programs are of the same age, as newer versions are not included in the repository. I’m running Ubuntu 20.04 on my notebook, which by now is around 2 years old.

Wireshark for ubuntu 20.04