Release Notes

2025.12

December 18th, 2025

The new FilterMenu component allows you to provide your users with one-click access to complex display filters without requiring them to type filter expressions. The component reads filters directly from the active Wireshark profile, but we’ve included some useful defaults to get you started. We’ve also added support for specifying multiple profile directories, upgraded to Wireshark 4.6.2, and made the usual bugfixes and tweaks.

Default Filter Menu example Included Packages

  • React package @qacafe/pv-react version 1.20.0
  • DeepPacket API version 0.0.15
  • Docker tag 2025.12
  • Wireshark 4.6.2

Key Changes

  • New Filter Menu for one-click access to commonly-used display filters
  • Support for loading multiple profile directories
  • Upgraded to Wireshark 4.6.2 with latest protocol updates

UI Components

Deep Packet API

  • New /profiles/filters endpoint to retrieve filter menu configuration

Docker Service

  • Multiple Profile Directories:

    • The profiles-dir option can now be specified multiple times
    • Later directories take precedence for profiles with the same name
    • Useful for separating global and user-specific profiles, or overriding shipped profiles without write access to system paths
    • See profile configuration documentation for examples

Wireshark 4.6.2 Upgrade

This release upgrades to Wireshark 4.6.2, bringing the latest protocol dissector updates and bug fixes.

Bugfixes and Other Changes

  • Fixed flickering “Apply” button when typing in the display filter input field
  • Fixed HTTP Requests table resetting when clicking on rows
  • Fixed issue where the selected packet was lost when clearing a display filter

2025.11

November 24th, 2025

This release introduces a powerful new Follow Stream standalone view with dramatically improved performance through virtualized scrolling. Additionally, we’ve upgraded to Wireshark 4.6.0, bringing hundreds of protocol updates and improvements while eliminating our previous custom patch requirement.

Follow Stream view

Included Packages

  • React package @qacafe/pv-react version 1.19.0
  • DeepPacket API version 0.0.14 (unchanged)
  • Docker tag 2025.11
  • Wireshark 4.6.0

Key Changes

  • New standalone Follow Stream view for dedicated stream analysis
  • Major performance improvements to Follow Stream components using virtualized scrolling
  • Upgraded to Wireshark 4.6.0 with hundreds of protocol updates
  • Removed requirement for custom Wireshark patch
  • Various bug fixes improving display filter autocomplete and component rendering

UI Components

  • New Follow Stream Standalone View:

    • Dedicated view for analyzing application layer data from TCP, UDP, HTTP, TLS, and other protocol streams
    • Easy navigation between different streams of the same protocol
    • Flexible visualization options: show entire conversation or single direction, toggle between ASCII and hexadecimal formats, control long-line wrapping
    • Available as a standalone view complementing the existing Follow Stream tab in the 3-pane interface

  • Follow Stream Performance Improvements:

    • Applied virtualized scrolling technology to the Follow Stream tab in the 3-pane PacketViewer
    • Significantly faster rendering and scrolling with streams containing large amounts of data

Bugfixes and Other Changes

  • Fixed display filter autocomplete issue when the first character was a number that also matches a protocol name
  • Fixed unnecessary re-rendering when using custom PacketList highlight functions
  • Fixed text selection in PacketList being interrupted by keyboard application switching on macOS
  • Fixed percent row visibility in Protocol Hierarchy Table and HTTP Requests Table

Wireshark 4.6.0 Upgrade

This release upgrades to Wireshark 4.6.0, the latest stable release. This major upgrade brings hundreds of protocol dissector updates and improvements while eliminating the need for the custom Wireshark patch that was required in previous PacketViewer releases. This streamlines our maintenance and ensures you benefit from the latest protocol analysis capabilities.

2025.10

October 23rd, 2025

This release brings two major enhancements for protocol analysis workflows. The new ProtocolSequenceView component makes it easy to isolate and analyze individual protocols like DHCP, DNS, and SIP with dedicated ladder diagrams and filtered packet trees. Additionally, experimental Active Capture support lets you monitor and analyze packets as they’re being captured, perfect for interactive troubleshooting.

protocol sequence view

Included Packages

  • React package @qacafe/pv-react version 1.18.0
  • DeepPacket API version 0.0.14
  • Docker tag 2025.10
  • Wireshark 4.4.10 (supports all versions in the 4.4.x series)

Key Changes

  • New Protocol Sequence View for protocol-focused ladder diagrams
  • Experimental Active Capture File Support for analyzing packets as they’re written to the file
  • Upgraded to Rocky Linux 8.10 base OS

UI Components

  • New ProtocolSequenceView:

    • Display ladder diagrams filtered to a specific protocol (DHCP, DNS, HTTP, and more)
    • Customizable packet tree views showing only protocol-specific fields
    • Protocol picker for quickly switching between different protocol views
    • Improved performance for protocol-focused analysis workflows

  • Experimental Active Capture File Support:

    • Analyze packets as they’re appended to capture files being written
    • Automatic detection and display of new packets in open files
    • Full PacketViewer functionality including display filters and custom columns
    • Ideal for monitoring low-bandwidth active packet captures

Deep Packet API

  • New protocol filter parameter for decode endpoints to extract protocol-specific trees
  • Follow Stream endpoint now accepts max_load parameter to prevent loading entire files for those requests

Bugfixes and Other Changes

  • Exported NavChart and SinglePacketProvider for integrators
  • Various stability improvements and bug fixes

2025.9

September 25th, 2025

This release adds interactive packet sequence analysis with clickable ladder diagrams and expandable packet details. The PacketSequenceView now includes time-based filtering via the new NavChart component, and we’ve completed dark mode support across all remaining components.

Interactive PacketSequenceView with expanded packet details

Included Packages

  • React package @qacafe/pv-react version 1.17.0
  • DeepPacket API version 0.0.13
  • Docker tag 2025.9
  • Wireshark 4.4.9 (supports all versions in the 4.4.x series)

Key Changes

  • Interactive PacketSequenceView with expandable packet details
  • New NavChart component provides visual time-based filtering alongside display filters
  • Dark mode is completed across all remaining components and views
  • Enhanced developer experience with dark mode Storybook documentation
  • Improved filter bar layout spanning full interface width

UI Components

  • Enhanced PacketSequenceView:

    • Interactive ladder arrows now expand/collapse PacketTree views for detailed packet analysis
    • New alwaysExpanded and disablePacketTree props for flexible configuration
    • Integrated NavChart support via enableNavChart prop for time-based filtering
    • Drag-and-drop support from PacketTrees to Display Filter for advanced workflows
    • Improved accessibility with proper ARIA labels and keyboard navigation

  • New NavChart Component:

    • Sparkline visualization shows packet distribution across the entire capture
    • Interactive time range selectors to help zero in on spikes or dips for focused analysis
    • Significantly improves navigation for longer capture durations
    • Available in both PacketViewer and PacketSequenceDiagram components via enableNavChart prop (disabled by default)

  • LadderDiagram Enhancements:

    • New defineLadderDiagram() function for creating custom ladder diagram configurations
    • alwaysExpanded prop to force all children visible by default
    • Improved button elements with better hover states and visual feedback

Deep Packet API

  • Added duration field to the /graphs/sparkline endpoint response

2025.8

August 28th, 2025

This release continues our dark mode implementation by adding support to all DataTable components, along with styling improvements and important bugfixes.

Dark mode conversations

Included Packages

  • React package @qacafe/pv-react version 1.16.0
  • DeepPacket API version 0.0.12 (unchanged)
  • Docker tag 2025.8
  • Wireshark 4.4.8 (supports all versions in the 4.4.x series)

Key Changes

  • Dark mode support extended to all DataTable components (Conversations, Endpoints, DNS Lookups, Protocol Hierarchy)
  • New --pv-ui-hover-shadow CSS variable for customizing hover effects
  • Added zebra-striped table rows via --pv-odd-row-color for better readability
  • Fixed display filter autocomplete positioning when scrolling
  • Reduced Node bundle size
  • Upgraded to Wireshark 4.4.8
  • Added copyright notices throughout codebase

2025.7

July 31st, 2025

Summer brings some great improvements our customers have been requesting! This release introduces experimental Quick Load functionality that makes a significant difference when working with larger capture files. We’re also excited to finally deliver dark mode support for the 3-pane PacketViewer interface, as well as easy-to-add views of our VoIP analysis components.

Dark mode interface

Included Packages

  • React package @qacafe/pv-react version 1.15.0
  • DeepPacket API version 0.0.12
  • Docker tag 2025.7
  • Wireshark 4.4.7* (supports all versions in the 4.4.x series)

Key Changes

  • New experimental Quick Load mode for faster time-to-first-packet with large captures
  • Complete dark mode support for the 3-pane PacketViewer interface
  • New specialized VoIP analysis views including SIP Statistics and enhanced RTP Stream components
  • GeoIP database configuration now requires bring-your-own databases for proper licensing compliance
  • Improved loading states across all data table views

UI Components

  • Experimental QuickLoad Mode:

    • Dramatically reduces time-to-first-packet for large capture files
    • Optimizes initial packet display by prioritizing essential data loading
    • Comes with performance caveats and specific Wireshark build requirements - see our QuickLoad documentation for detailed guidance
    • Please try this experimental feature and provide feedback!

  • Dark Mode Support:

    • Dark theme implementation for the 3-pane PacketViewer interface
    • Seamless integration with existing CSS variable customization system
    • New Storybook Style Playground for experimenting with color schemes via CSS variables

  • New VoIP Analysis Views:

  • Enhanced Data Table Loading:

    • Added loading indicators to all DataTable views including Conversations, Endpoints, and DNS Requests

GeoIP Configuration Change

Starting with this release, PacketViewer requires users to provide their own GeoIP databases for location-based analysis features. Previously bundled GeoIP databases have been removed to ensure proper licensing compliance. Organizations with existing GeoIP database licenses can now configure PacketViewer to use their own databases, providing greater control over data sources and compliance requirements.

See our GeoIP configuration documentation for setup instructions.

Deep Packet API

  • New max_load options for Packet List, Fields, and Decode endpoints to limit amount of PCAP that is parsed before returning data
  • Dramatically improved the response time of the /status endpoint for files cached on disk

Bugfixes and Other Changes

  • Fixed issue where stale protocol information persisted in the status bar when switching between packets
  • Improved PacketTree search animations for smoother user interactions

2025.6

June 5th, 2025

This release focuses on security improvements, developer experience enhancements, and general bugfixes.

Included Packages

  • React package @qacafe/pv-react version 1.14.0
  • DeepPacket API version 0.0.11 (unchanged)
  • Docker tag 2025.6

Security & Dependencies

  • Upgraded internal licensing library in the Docker service to reduce security vulnerabilities
  • Updated Docker service dependencies to latest versions
  • Software Bill of Materials (SBOMs) are now included in release downloads for enhanced security transparency and compliance

Developer Experience

  • Exposed usePacketSelector hook for enhanced programmatic access to packet selection
  • Added version number display in Storybook interface
  • Introduced window.PACKET_VIEWER_VERSION for runtime version detection
  • Improved Storybook layout with various quick-fixes

Bugfixes

  • Fixed state and scrolling issues in DNSLookupsTreeView component
  • Fixed file size display in status bar to use proper locale-aware formatting

2025.5

May 28th, 2025

This release delivers a completely rewritten ladder sequence diagram component with major performance improvements, new sparkline visualization capabilities, and improved packet navigation.

Included Packages

  • React package @qacafe/pv-react version 1.13.0
  • DeepPacket API version 0.0.11
  • Docker tag 2025.5

Key Changes

  • Complete rewrite of ladder diagrams with virtual scrolling for dramatic performance improvements
  • New sparkline component for visualizing packet/byte distribution over time
  • Enhanced PacketTree with clickable hyperlinks to referenced packets
  • Improved user experience across multiple components

UI Components

  • Completely Rewritten Ladder Diagrams:

    • Built from the ground up with virtual scrolling for dramatically improved performance
    • Visually redesigned with enhanced appearance and better readability
    • Implements batched, async loading to handle large datasets without UI blocking
    • New delta-time calculations and indicators unique to ladder visualization
    • Enhanced drag-and-drop interactions for sorting nodes and hiding individual endpoints to refine the view

  • New Sparkline Component:

    • Displays packet or byte distribution across capture time intervals
    • Customizable visualization with configurable height, width, and color

  • Enhanced PacketTree Navigation:

    • Added clickable hyperlinks for packet references in decode tree
    • Double-click support to navigate to referenced packets

Deep Packet API

  • Enhanced Packet Fields API:

    • Improved /packets/fields endpoint for efficient field extraction

  • New /graphs/sparkline endpoint:

    • Configurable number of data points for visualization
    • Generates sparkline data for packet or byte distribution over time
    • Supports both packet count and byte volume metrics

  • Backend Improvements:

    • Upgraded to Wireshark 4.4.6
    • Enhanced sharkd timeout configurations for improved reliability

Bugfixes

  • Resolved various issues in the PacketTree Search functionality

2025.4

April 28th, 2025

This release introduces powerful new search capabilities for deep packet analysis and streamlines programmatic access to packet field data, while enhancing error visibility across the UI.

Included Packages

  • React package @qacafe/pv-react version 1.12.0
  • DeepPacket API version 0.0.10
  • Docker tag 2025.4

Key Changes

  • New PacketTree Search functionality for deep field exploration
  • New API endpoint for efficient packet field extraction
  • Improved error reporting in the UI

UI Enhancement: PacketTree Search

PacketTree Search feature

  • Quickly search through all fields in the protocol tree
  • Navigate seamlessly between search matches with your keyboard or mouse
  • Selects matching hex for each search result
  • Enabled by default

Deep Packet API

  • Added new /packets/fields endpoint:
    • Efficiently extracts specific fields from packets
    • Supports up to 32 fields per request
    • Optimized for programmatic access to packet data

Bugfixes and Improvements

  • Various performance optimizations and stability improvements across the board
  • Enhanced internal testing processes for consistent quality
  • Improved error visibility for API errors

2025.3

March 27th, 2025

This release delivers significant performance improvements to the stream analysis functionality and introduces new specialized components for VoIP and RTP analysis, providing integrators with powerful new capabilities to play back audio communications in their own products.

Included Packages

  • React package @qacafe/pv-react version 1.11.0
  • Deep Packet API version 0.0.9 (unchanged)
  • Docker tag 2025.3

Key Changes

  • Major performance improvements to Follow Stream functionality
  • New VoIP Calls Table component for displaying voice communications
  • New RTP Stream Playback component for audio stream analysis
  • Enhanced text selection capabilities in both PacketList and PacketTree components

UI Components

  • Improved Follow Stream implementation:

    • Streams now load only when selected, preventing UI blocking and improving responsiveness
    • Stream content persists when changing packets, eliminating unnecessary reloads

  • Added new VoIP Calls Table component:

    • Displays basic call metadata including to/from, packet count, and state

  • Added new RTP Stream Playback component:

    • Enables audio playback of extracted RTP streams with waveform visualization
    • Provides statistics on packet loss and jitter

  • Enhanced text selection capabilities:

    • Added support for text selection in PacketList with mouse
    • Enabled text selection in PacketTree when holding Cmd (Mac) or Meta (Windows) key

Deep Packet API

  • Upgraded to Wireshark 4.4.5

Bugfixes

  • Resolved packet list sorting inconsistencies for specific column types
  • Fixed inconsistent scrolling behavior when clicking in ASCII decode section

2025.2

February 27th, 2025

This release introduces a powerful new composable component architecture, giving developers unprecedented flexibility to build tailored network analysis interfaces alongside some new visualization capabilities.

Included Packages

  • React package @qacafe/pv-react version 1.10.0
  • DeepPacket API version 0.0.9 (unchanged)
  • Docker tag 2025.2

Key Changes

  • New composable React component architecture for building custom network analysis interfaces
  • New GeoIP map visualization component
  • Enhanced customization options for PacketList and PacketTree components

UI Components

  • New GeoIP Map component for visualizing geographic distribution of network traffic
  • Enhanced PacketList and PacketTree components:
    • Added custom highlighting and formatting props
    • Exposed click event callbacks for improved interactivity
    • Better support for drag and drop operations to create custom columns
  • Improved status bar duration field to display hours/minutes/seconds for longer captures
  • Added extensive documentation in the improved Storybook running on the Docker image

Deep Packet API

  • Upgraded to Wireshark 4.4.3
  • Fixed potential server panic when HTTP clients disconnect unexpectedly

Bugfixes

  • Fixed Enter key not applying display filter in React 16
  • Resolved issue where drag+drop of certain fields created empty columns in PacketList

Documentation

A comprehensive guide to the new Composable Component Architecture is available in the Storybook that ships with the Docker image. Access this documentation by adding the --storybook flag when running the Docker container:

docker run -p 8080:80 packet-viewer:2025.2 --no-tls --storybook

This will serve the complete component documentation on localhost:8080/storybook.

2025.1

January 30th, 2025

This release expands PacketViewer’s HTTP analysis capabilities with comprehensive new views for examining HTTP traffic.

Included Packages

  • React package @qacafe/pv-react version 1.9.0
  • DeepPacket API version 0.0.9
  • Docker tag 2025.1

What’s going on with the version number?

The 2025.1 release introduces our new monthly release labeling system. Libraries and packages will continue maintain semantic versioning to ensure dependency compatibility and version predictability. This change is purely to provide clarity around release timing, with new releases scheduled monthly and labeled by year and month to make planning easier for you.

Key Changes

  • New HTTP Analysis Views providing detailed insights into HTTP traffic
  • New HTTP object extraction and preview capabilities

UI Components

  • Added new HTTP Analysis Views:
    • HTTP Requests Table for listing all HTTP requests in the capture
    • URL Analysis view showing detailed breakdowns of URLs with multiple requests
    • HTTP Objects view for extracting and previewing transferred content (HTML, CSS, JavaScript, images)
  • Enhanced preview capabilities for extracted HTTP content
  • Fixed issues with tab behavior in the PacketDecode component

Deep Packet API

  • Added new HTTP Request Details endpoint for comprehensive HTTP traffic analysis
  • Improved HTTP object extraction capabilities through the API

Older

For release notes before 2025, please check out the Archived section.