Fix #725: Incorrect TShark version parsing when dissector plugins are present

[rshayer95]

Summary

This PR fixes an issue where the get_tshark_version function incorrectly parses the TShark version when dissector plugins are present.

Previously, the function always used the first line of the tshark -v output to extract the version. When a dissector plugin was loaded, its version appeared on the first line instead of the actual TShark version, resulting in an incorrect version string being used throughout the library.

The updated implementation filters all lines of the version output and uses the first line that matches the standard TShark version pattern.

File Changed

pyshark/src/pyshark/tshark/tshark.py

Function Changed

get_tshark_version()

Before:

version_line = version_output.splitlines()[0]
pattern = r'.*\s(\d+\.\d+\.\d+).*'
m = re.match(pattern, version_line)
if not m:
       raise TSharkVersionException("Unable to parse TShark version from: {}".format(version_line))
version_string = m.groups()[0]  # Use first match found

After:

pattern = r'TShark.*?(\d+\.\d+\.\d+)'
m = re.search(pattern, version_output)
if not m:
      raise TSharkVersionException(
          "Unable to parse TShark version from: {}".format(version_output)
      )
version_string = m.groups(1)  # Use first version match

[amlamarra]

This may be a duplicate of #730

[rshayer95]

@amlamarra No, #730 doesn't work when dissector plugins are present, this version works in any sort of condition because its sole purpose is to target Tshark version