The Wireshark project's official blog covers releases, history, the move to Qt, and network analysis tooling.
HN commenters link it for how to run Wireshark without root, the GTK to Qt change, and the T-Mobile use of UK MoD address space.
The “US DoD” IP could simply be a mobile network operator’s internal IP address leaking via the XFF header. Mobile network operators are known to use public but unadvertised IP ranges such as 25.0.0.0/8 (UK MoD: https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/) for their internal networks in order to avoid clashes with actual private IPs. For example, by using a “public” IP address, any private IP address requests from a client will route through e.g. WiFi instead of through the cell network. It would not surprise me if a Chinese mobile network operator was using chunks of unadvertised US DoD IP address for the same purpose.
> Does this mean GTK2 and GTK3 are... to be avoided for new projects / dead?
not dead but... here's for instance how Wireshark looked on macOS when it was using GTK :
https://blog.wireshark.org/wp-content/uploads/2013/10/osx-x11.png
and here's how it looks now that it is using Qt :
https://news-cdn.softpedia.com/images/news2/wireshark-3-0-released-as-world-s-most-popular-network-protocol-analyzer-525173-2.jpg
https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/
(amongst others)
Basically some ISPs are 'reclaiming' unused/unadvertised IP addresses that are used by Gov Agencies (Military and Security Services) to use on their internal networks.
Nothing will break (at the moment) because those networks are not accessible from the internet, and also not routed anywhere, despite being allocated.
Making simple apps is simple, probably is much harder to do advanced apps
Wireshark changed from GTK to Qt
https://blog.wireshark.org/2013/10/switching-to-qt/
Linus Torwald, a C fan and c++ hater , decided to port from GTK to Qt https://www.youtube.com/watch?v=ON0A1dsQOV0
If you make a simple GUI like for a python script GTK is enough
tshark[0][1] has been the go-to standard for CLI packet analysis for a long time. It'd be really nice if Gosniff provided some kind of documentation on how it differentiates itself from tshark.
[0] https://tshark.dev/
[1] https://blog.wireshark.org/2014/07/to-infinity-and-beyond-capturing-forever-with-tshark/
I'm sure TMobile is intimately familiar with their networking assets. They pioneered squatting on MoD space for internal routing to avoid dual homed conflicts. (25.0.0.0/8)
https://blog.wireshark.org/2010/04/t-mobile-clever-or-insane/