ImShark v1.0.0

ImShark 1.0.0

ImShark is a Dear ImGui desktop packet analyzer for capture files and live network traffic.

1.0.0 is the first stable release. From now on, the settings file format, display filter syntax and field names, command-line flags and export formats follow the promise in docs/COMPATIBILITY.md: they change incompatibly only in a new major version. The security model, including how live capture obtains privileges, is described in docs/THREAT_MODEL.md and docs/CAPTURE_PRIVILEGES.md.

Changes since 0.9.2

Added

• Capture helper: live capture runs through imshark --capture-worker, which starts only after an explicit Authorize and capture click, opens the device with elevated rights and drops privileges before touching any file, instead of opening system-wide permissions. Also adds the ImShark icons and welcome-screen logo (#8).
• Display filters run on a background thread with progress and cancellation, and exports keep nanosecond timestamps (#11).
• Settings file format version, atomic saves, docs/COMPATIBILITY.md (the 1.0 stability promise) and docs/THREAT_MODEL.md (#10).
• CodeQL and clang-tidy in CI, one warning set for all targets and an IMSHARK_WERROR option (#12).
• libFuzzer harnesses with seed corpora, replayed as tests in every build and run in CI, plus docs/FUZZING.md (#13).
• CHANGELOG.md, docs/RELEASING.md, an updated user guide, a third-party licence audit of the 0.9.2 packages (docs/VALIDATION.md) and the logo licence (CC0 1.0) (#14).

Changed

• The macOS bundle identifier changes from com.imshark.app (0.9.1 and 0.9.2) to io.github.zaryob.imshark (#8); macOS treats the 1.0 app as a different application for per-app permissions.
• Regular expressions in display filters and coloring rules are evaluated with PCRE2 (Perl-compatible syntax, like Wireshark) under match, depth and heap limits instead of std::regex; a pattern that hits a limit counts as no match and is reported in the status bar (#15).
• Decompression of .gz captures has an output limit and an expansion-ratio guard, and temporary files are created exclusively with random names in a private directory (#9).

Fixed

• A heavy regular expression in a display filter no longer terminates the application (#11) or runs for seconds through catastrophic backtracking (#15).
• Parser bugs found by fuzzing: a DNS-over-TCP over-read, a length underflow after the FCS, BGP and HTTP/2 nodes reaching past their payload, and quadratic growth of the info column (#13).
• Checked integer parsing for HTTP status and X.509 years and other findings from the new static analysis (#12).

Known limitations

• The macOS application is ad hoc signed, without Developer ID signing or notarization: on first launch allow it under System Settings > Privacy & Security > Open Anyway.
• The macOS bundle identifier changed to io.github.zaryob.imshark; macOS asks for per-app permissions again.
• The Windows package has not yet been tested on a clean machine and has no live capture (see docs/RELEASING.md for the checklist).
• Regular expressions now use PCRE2 syntax; patterns relying on ECMAScript-only behaviour may need adjusting.

Downloads

System	Package
Linux x86_64	AppImage, DEB or tar.gz (Ubuntu 24.04 baseline)
macOS Apple Silicon	DMG
Windows x86_64	ZIP

Compare your download's SHA-256 digest with SHA256SUMS.txt. Linux and macOS support libpcap live capture with the required device permissions. The Windows package supports offline capture analysis; live capture needs a separate Npcap-enabled build. The macOS application is ad hoc signed, without Developer ID signing or notarization.

All platform Release builds run CTest before packaging. Publication also requires sanitizer/minimal regressions and the Linux Docker test, which opens the sample capture with Mesa software OpenGL and verifies the installed DEB in a clean Ubuntu image. Linux screenshots and logs are available in the associated Actions run.

ImShark v0.9.2

ImShark 0.9.2

ImShark is a Dear ImGui desktop packet analyzer for capture files and live network traffic.

0.9.2 is the first published 0.9 release. The 0.9.0 tag never produced packages because the Windows test build failed, and 0.9.1 stopped when Docker Hub rate-limited and then timed out the Linux GUI check before it built anything. 0.9.2 contains everything planned for 0.9.0 and 0.9.1.

Changes in 0.9.2

• Reliable Linux GUI check: the Docker images used by the release check are pulled through mirror.gcr.io instead of Docker Hub.

Changes in 0.9.1

• Refreshed interface: tuned dark and light themes with one accent color and crisp text on scaled displays; coloring rules stay readable in the dark theme and the selected row stands out in both themes.
• Welcome screen: Open / Start live capture, recent files and a drop hint instead of an empty list.
• Toolbar and status bar: a toolbar (View > Toolbar) with shortcut tooltips; the status bar shows displayed/total and selected packets.
• Layout: a visible, draggable list/details splitter, a hex view sized to its content, and the window size and position remembered between sessions.
• macOS bundle identifier: the app and DMG now carry com.imshark.app as CFBundleIdentifier (it was empty).
• Windows build: fixed the MSVC test build failure that stopped 0.9.0 and made text fixtures check out with LF on every platform.
• Testing and CI: 43 headless UI interaction tests (menus, context menus, dropped files, exports); CI now runs on every push and pull request, including Windows.

Changes from 0.9.0

This minor release introduces database session tracking, rich query and row decoding for PostgreSQL and MySQL, and enhanced RPCSEC_GSS handling for ONC RPC / NFS.

• Database Session Table: Track connection-level state in db_session.{h,cpp} for PostgreSQL and MySQL with strict memory bounds and caps (256 statements, 64 portals, 1024-byte queries, 128 columns).
• PostgreSQL Extended Query & Values: Decode Parse, Bind, Describe, Execute, and Close messages; map prepared statements and portals to query text; decode typed parameters and DataRow values (int, float, numeric, date, timestamp, uuid, bytea, JSON); recognise text and binary COPY data (PGCOPY).
• MySQL Result Sets & Prepared Statements: Track response phases in flight (column definitions, EOF, rows, OK); decode text rows and binary result set rows (null bitmap and column types); resolve COM_STMT_PREPARE statement IDs to their queries and decode COM_STMT_EXECUTE parameters.
• RPCSEC_GSS Handling: Identify RPCSEC_GSS credentials, integrity/privacy wrapped arguments, and context messages for NFS/RPC without treating them as plain arguments; track wrapped status in the RPC session table.
• New Filter Fields: Added pgsql.statement, pgsql.value, pgsql.count, mysql.value, and mysql.statement_id.

Downloads

System	Package
Linux x86_64	AppImage, DEB or tar.gz (Ubuntu 24.04 baseline)
macOS Apple Silicon	DMG
Windows x86_64	ZIP

Compare your download's SHA-256 digest with SHA256SUMS.txt. Linux and macOS support libpcap live capture with the required device permissions. The Windows package supports offline capture analysis; live capture needs a separate Npcap-enabled build. The macOS application is ad hoc signed, without Developer ID signing or notarization.

All platform Release builds run CTest before packaging. Publication also requires sanitizer/minimal regressions and the Linux Docker test, which opens the sample capture with Mesa software OpenGL and verifies the installed DEB in a clean Ubuntu image. Linux screenshots and logs are available in the associated Actions run.