diff --git a/net-analyzer/wireshark/Manifest b/net-analyzer/wireshark/Manifest
index e177afdb6..35e974bfa 100644
--- a/net-analyzer/wireshark/Manifest
+++ b/net-analyzer/wireshark/Manifest
@@ -2,15 +2,19 @@ AUX wireshark-1.4.7-btbb.patch 3730 RMD160 6d89255c33d35b9eb8dc26776212cc15401c0
 AUX wireshark-1.4.7-gnutls_nettle.patch 733 RMD160 9b8839b432b5c6231068d784d9fd3e151c509dd1 SHA1 2592ac7fd110cfff4b70a6456fdf655f5aca45cf SHA256 6698b83bd455b626f46c2d446a6c69f6f4c6822f63207ffb1052accde881fc76
 AUX wireshark-1.4.7-wspy_dissectors_dir.patch 460 RMD160 098cc8aa80433dff0423cf64d88be89d7716fffa SHA1 fd23ab1494482e8825c79dfc5df2cac42fbcf97d SHA256 ed59b5d0af20d3c7adffa7742c245e8640e593e519200149810df4022eb8442e
 AUX wireshark-1.6-btbb.patch 3815 RMD160 398923eeb443bec2f502bcc1276fa5bb1a215fa6 SHA1 0c621c9b4eca7ef7e7d7601d3b2987ded31834b1 SHA256 411bfeba974f441c9796c2f73023ba02316fc5f755017949834ea992f7906d98
+AUX wireshark-1.6.4-build.patch 396 RMD160 fa909e374c80f0c637a459750d305cd636e7e18a SHA1 825cb721d7d30cfdec5f53e0b38fa7ee8891ec20 SHA256 8648c0eda8fd4393d4b0513c4d6673d0568b7341f920e55e7ebe7391d1e3b430
+AUX wireshark-1.6.4-doc-build.patch 501 RMD160 65ea45bc7014c5f0bb556b3c964c45d2b0d2f582 SHA1 ea7c00ed98613581791c7c9e53f009efee5e6c08 SHA256 2ae9ad7ce2ceb1b7a2430ae71d04cdb4f9173d74e0d67667965226d8f43d1945
 DIST libbtbb-0.6.tar.gz 50830 RMD160 6c26531a4b0ec01146113ddd69a4de4debea8436 SHA1 db1962540fc64dbf2a918338565bdbe7b33ab374 SHA256 084f3a78f396cfcf65fdcd7391110e8efe4473b954004558c63a9110ba721858
 DIST libbtbb.0.5.tgz 137378 RMD160 c5d68e7620c901cf520e33fc747cc6a0b9535154 SHA1 5465d4520b267bad53c56a67260099e60439c922 SHA256 528cfd3822f98f539cf468d82c63b32c2063bcca53299befe14200723bec7d52
 DIST wireshark-1.4.7.tar.bz2 20515206 RMD160 012ec4d7750c03bcc23e9140f31e778cde6fd645 SHA1 ba80ed0c2aa6a12fa50155bbf5b58ad41a46024e SHA256 6671a185d3cd5222a04b6c425d2ef70b84e50ebf50ace9738ae772e87bf492c1
 DIST wireshark-1.6.0.tar.bz2 21820220 RMD160 d30ba785f8e8ac6d74b4f3f55f9e797a8bc0dec3 SHA1 c54ab0d77f6bbe6a2b7329de69ed10614d57aa35 SHA256 63a5fb15c4cf43495553a0568ecbab69ea94e4d189a75bc1297f6d090a92cdf7
 DIST wireshark-1.6.0rc2.tar.bz2 21824421 RMD160 e67dddd9946585e510ea04ccddea74fe0c59d5a8 SHA1 014a87dd8c840612acb0de33a8400586157dbb0f SHA256 fb8c0ec8b2ed7e6544acaa6e6fd39f93996ab84e3afb0175af83771487e39632
 DIST wireshark-1.6.2.tar.bz2 21408664 RMD160 e343d9bb5600b236dea708bb68ecad805a9ee20a SHA1 a18d4e8eaf56fe0214b19d7fde0eb91a06817a49 SHA256 5343f514ce98c28498ec4734e40e34e2bbf779a6c57d958837e3f70234471e7f
+DIST wireshark-1.6.4.tar.bz2 21464517 RMD160 9437c416a5963aee1c049c0275bdfd3edd7488e8 SHA1 8abd7681e8c05841b7cf31d5dc83c1092c54e79f SHA256 7f98191f53d375f020312a99a9747ff3b846ac4029af4027fc883f685fabef5d
 EBUILD wireshark-1.4.7.ebuild 6637 RMD160 bc868901ecf0c492ab396d45fa0a5e711c04d224 SHA1 a6a81a9b0baf745f0d20cf680ee9e342cb07d0aa SHA256 3c84c5605bd450bb1043ded4dbfae1f5aaa4acf9053bc412ac1cc9666d9859ec
 EBUILD wireshark-1.6.0.ebuild 6519 RMD160 cb8245bc3c977bba545288fa84097ce7b12d715a SHA1 d11215d8b9e927cfa40a98c4121da4c6cee4e467 SHA256 32f0d87480715a55ef0effeac65af5b20483567c34f6357c944db4f6f3cfd4d2
 EBUILD wireshark-1.6.0_rc2.ebuild 6519 RMD160 cb8245bc3c977bba545288fa84097ce7b12d715a SHA1 d11215d8b9e927cfa40a98c4121da4c6cee4e467 SHA256 32f0d87480715a55ef0effeac65af5b20483567c34f6357c944db4f6f3cfd4d2
 EBUILD wireshark-1.6.2.ebuild 6558 RMD160 80690cd07dbbd60f266e1bd51df368718085bca5 SHA1 f81c6637a31691bc5d95f62b9b7dcd98d6f0e870 SHA256 3824af5943f56508ceb1be65768dd8ffa036ad6f25c44ab7a571dba927524dcb
+EBUILD wireshark-1.6.4.ebuild 6721 RMD160 c1bfc021232160dd1a63577ef9ffc31f124ccff3 SHA1 d921dc95d0255254d536ed7f3e079c2407eb9765 SHA256 ab5396cd49a0de9328a1cf2b32e3c1eeaaa435968041263141dc4826669c41d4
 MISC ChangeLog 43087 RMD160 9e98d25e3064ba15ec05b126dd8d4003443ecceb SHA1 8416fd3639a9459545df2c89000dd3fb1e2a8119 SHA256 8ff0ab790e1dab3bf722cc1149a8bbb0e1de69e1785c086ae8eae0a257712b3e
 MISC metadata.xml 2242 RMD160 66dbbb758acc194df17217183b60a56f61fced38 SHA1 4498ea4c0f0f04213fd1cba2fd3de44565058f7d SHA256 2dfaef45c385c37c7ae8af96f5d8c58d9bff8f6186d55be8f2d034ebd0c60869
diff --git a/net-analyzer/wireshark/files/wireshark-1.6.4-build.patch b/net-analyzer/wireshark/files/wireshark-1.6.4-build.patch
new file mode 100644
index 000000000..8338847ce
--- /dev/null
+++ b/net-analyzer/wireshark/files/wireshark-1.6.4-build.patch
@@ -0,0 +1,13 @@
+https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6614
+
+--- dumpcap.c	2011-12-12 09:40:00.168671726 +0400
++++ dumpcap.c	2011-12-12 09:41:42.338821574 +0400
+@@ -2488,7 +2488,7 @@
+     int       inpkts;
+     gint      packet_count_before;
+     guchar    pcap_data[WTAP_MAX_PACKET_SIZE];
+-#ifndef USE_THREADS
++#if !defined(USE_THREADS) || defined(MUST_DO_SELECT)
+     int       sel_ret;
+ #endif
+ 
diff --git a/net-analyzer/wireshark/files/wireshark-1.6.4-doc-build.patch b/net-analyzer/wireshark/files/wireshark-1.6.4-doc-build.patch
new file mode 100644
index 000000000..9bd9230a4
--- /dev/null
+++ b/net-analyzer/wireshark/files/wireshark-1.6.4-doc-build.patch
@@ -0,0 +1,16 @@
+https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6662
+
+--- docbook/release-notes.xml	2011-12-12 15:38:59 +0000
++++ docbook/release-notes.xml	2011-12-12 15:39:56 +0000
+@@ -43,9 +43,9 @@
+           (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
+           0000</ulink>)
+         </para></listitem>
+--->
+ 
+         Compilation on Windows using the release tarball has been fixed.
++-->
+ 
+         <listitem><para>
+           Patch to fix memory leaks/errors in Lua plugin.
+
diff --git a/net-analyzer/wireshark/wireshark-1.6.4.ebuild b/net-analyzer/wireshark/wireshark-1.6.4.ebuild
new file mode 100644
index 000000000..107ce8aef
--- /dev/null
+++ b/net-analyzer/wireshark/wireshark-1.6.4.ebuild
@@ -0,0 +1,223 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-analyzer/wireshark/wireshark-1.6.4.ebuild,v 1.8 2012/01/06 18:52:52 armin76 Exp $
+
+EAPI="3"
+PYTHON_DEPEND="python? 2"
+inherit libtool flag-o-matic eutils toolchain-funcs python autotools
+
+[[ -n ${PV#*_rc} && ${PV#*_rc} != ${PV} ]] && MY_P=${PN}-${PV/_} || MY_P=${P}
+DESCRIPTION="A network protocol analyzer formerly known as ethereal"
+HOMEPAGE="http://www.wireshark.org/"
+SRC_URI="http://www.wireshark.org/download/src/all-versions/${MY_P}.tar.bz2 \
+	btbb? ( mirror://sourceforge/libbtbb/libbtbb-0.6.tar.gz )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="alpha amd64 hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd"
+IUSE="adns ares btbb doc doc-pdf gtk ipv6 lua gcrypt geoip kerberos
+profile +pcap portaudio python +caps selinux smi ssl threads zlib"
+
+RDEPEND=">=dev-libs/glib-2.14:2
+	zlib? ( sys-libs/zlib
+		!=sys-libs/zlib-1.2.4 )
+	smi? ( net-libs/libsmi )
+	gtk? ( >=x11-libs/gtk+-2.4.0:2
+		x11-libs/pango
+		dev-libs/atk
+		x11-misc/xdg-utils )
+	ssl? ( net-libs/gnutls )
+	gcrypt? ( dev-libs/libgcrypt )
+	pcap? ( net-libs/libpcap )
+	caps? ( sys-libs/libcap )
+	kerberos? ( virtual/krb5 )
+	portaudio? ( media-libs/portaudio )
+	ares? ( >=net-dns/c-ares-1.5 )
+	!ares? ( adns? ( net-libs/adns ) )
+	geoip? ( dev-libs/geoip )
+	lua? ( >=dev-lang/lua-5.1 )
+	selinux? ( sec-policy/selinux-wireshark )"
+
+DEPEND="${RDEPEND}
+	doc? ( dev-libs/libxslt
+		dev-libs/libxml2
+		app-doc/doxygen
+		doc-pdf? ( dev-java/fop ) )
+	>=dev-util/pkgconfig-0.15.0
+	dev-lang/perl
+	sys-devel/bison
+	sys-apps/sed
+	sys-devel/flex
+	!!<net-analyzer/wireshark-1.6.0_rc1"
+
+S=${WORKDIR}/${MY_P}
+
+# borrowed from GSoC2010_Gentoo_Capabilities by constanze and flameyeys
+# @FUNCTION: fcaps
+# @USAGE: fcaps {uid:gid} {file-mode} {cap1[,cap2,...]} {file}
+# @RETURN: 0 if all okay; non-zero if failure and fallback
+# @DESCRIPTION:
+# fcaps sets the specified capabilities in the effective and permitted set of
+# the given file. In case of failure fcaps sets the given file-mode.
+fcaps() {
+	local uid_gid=$1
+	local perms=$2
+	local capset=$3
+	local path=$4
+	local res
+
+	chmod $perms $path && \
+	chown $uid_gid $path
+	res=$?
+
+	use caps || return $res
+
+	#set the capability
+	setcap "$capset=ep" "$path" &> /dev/null
+	#check if the capabilitiy got set correctly
+	setcap -v "$capset=ep" "$path" &> /dev/null
+	res=$?
+
+	if [ $res -ne 0 ]; then
+		ewarn "Failed to set capabilities. Probable reason is missed kernel support."
+		ewarn "Kernel must have <FS>_FS_SECURITY enabled where <FS> is the filesystem"
+		ewarn "to store ${path} (e.g. EXT3_FS_SECURITY). For kernels version before"
+		ewarn "2.6.33_rc1 SECURITY_FILE_CAPABILITIES must be enabled as well."
+		ewarn
+		ewarn "Falling back to suid now..."
+		chmod u+s ${path}
+	fi
+	return $res
+}
+
+pkg_setup() {
+	if ! use gtk; then
+		ewarn "USE=-gtk disables gtk-based gui called wireshark."
+		ewarn "Only command line utils will be built available"
+	fi
+	if use python; then
+		python_set_active_version 2
+		python_pkg_setup
+	fi
+	# Add group for users allowed to sniff.
+	enewgroup wireshark
+}
+
+src_prepare() {
+	epatch "${FILESDIR}/${P}-build.patch"
+	epatch "${FILESDIR}/${P}-doc-build.patch"
+	use btbb && mv "${WORKDIR}"/libbtbb-0.6/wireshark/plugins/btbb "${S}"/plugins/
+	use btbb && epatch "${FILESDIR}/${PN}-1.6-btbb.patch"
+	eautoreconf
+
+}
+
+src_configure() {
+	local myconf
+
+	if [[ $(gcc-major-version) -lt 3 ||
+		( $(gcc-major-version) -eq 3 &&
+			$(gcc-minor-version) -le 4 ) ]] ; then
+		die "Unsupported compiler version, please upgrade."
+	fi
+
+	if use ares && use adns; then
+		elog "You asked for both, ares and adns, but we can use only one of them."
+		elog "c-ares supersedes adns resolver thus using c-ares (ares USE flag)."
+		myconf="$(use_with ares c-ares) --without-adns"
+	else
+		myconf="$(use_with adns) $(use_with ares c-ares)"
+	fi
+
+	# profile and pie are incompatible #215806, #292991
+	if use profile; then
+		ewarn "You've enabled the 'profile' USE flag, building PIE binaries is disabled."
+		ewarn "Also ignore \"unrecognized option '-nopie'\" gcc warning #358101."
+		append-flags $(test-flags-CC -nopie)
+	fi
+
+	# Workaround bug #213705. If krb5-config --libs has -lcrypto then pass
+	# --with-ssl to ./configure. (Mimics code from acinclude.m4).
+	if use kerberos; then
+		case `krb5-config --libs` in
+			*-lcrypto*)
+				ewarn "Kerberos was built with ssl support: linkage with openssl is enabled."
+				ewarn "Note there are annoying license incompatibilities between the OpenSSL"
+				ewarn "license and the GPL, so do your check before distributing such package."
+				myconf+=" --with-ssl"
+				;;
+		esac
+	fi
+
+	# Hack around inability to disable doxygen/fop doc generation
+	use doc || export ac_cv_prog_HAVE_DOXYGEN=false
+	use doc-pdf || export ac_cv_prog_HAVE_FOP=false
+
+	# dumpcap requires libcap, setuid-install requires dumpcap
+	econf $(use_enable gtk wireshark) \
+		$(use_enable profile profile-build) \
+		$(use_with ssl gnutls) \
+		$(use_with gcrypt) \
+		$(use_enable ipv6) \
+		$(use_enable threads) \
+		$(use_with lua) \
+		$(use_with kerberos krb5) \
+		$(use_with smi libsmi) \
+		$(use_with zlib) \
+		$(use_with geoip) \
+		$(use_with portaudio) \
+		$(use_with python) \
+		$(use_with caps libcap) \
+		$(use_with pcap) \
+		$(use_with pcap dumpcap-group wireshark) \
+		$(use pcap && use_enable caps setcap-install) \
+		$(use pcap && use_enable !caps setuid-install) \
+		--sysconfdir="${EPREFIX}"/etc/wireshark \
+		--disable-extra-gcc-checks \
+		${myconf}
+}
+
+src_compile() {
+	emake || die
+	use doc && cd docbook && { emake || die; }
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "emake install failed"
+	if use doc; then
+		dohtml -r docbook/{release-notes.html,ws{d,u}g_html{,_chunked}}
+		if use doc-pdf; then
+			insinto /usr/share/doc/${PF}/pdf/
+			doins docbook/{{developer,user}-guide,release-notes}-{a4,us}.pdf || die
+		fi
+	fi
+
+	# FAQ is not required as is installed from help/faq.txt
+	dodoc AUTHORS ChangeLog NEWS README{,.bsd,.linux,.macos,.vmware} \
+		doc/{randpkt.txt,README*}
+
+	insinto /usr/include/wiretap
+	doins wiretap/wtap.h || die
+
+	if use gtk; then
+		for c in hi lo; do
+			for d in 16 32 48; do
+				insinto /usr/share/icons/${c}color/${d}x${d}/apps
+				newins image/${c}${d}-app-wireshark.png wireshark.png
+			done
+		done
+		domenu wireshark.desktop || die
+	fi
+	use pcap && chmod o-x "${ED}"/usr/bin/dumpcap #357237
+}
+
+pkg_postinst() {
+	if use caps && use pcap; then
+		fcaps 0:wireshark 550 cap_net_raw,cap_net_admin "${EROOT}"/usr/bin/dumpcap
+	fi
+	echo
+	ewarn "NOTE: To run wireshark as normal user you have to add yourself to"
+	ewarn "the wireshark group. This security measure ensures that only trusted"
+	ewarn "users are allowed to sniff your traffic."
+	echo
+}