Wireshark · Ethereal-users: Re: [ethereal-users] Is File/Reload needed any more?

[Guy Harris <guy@xxxxxxxxxx>]

> I don't know if this is related, but I ran into a bit of weirdness in
> this area.  I was using Ethereal to view tcpdump packet dumps.  I'd use
> Ethereal to filter the raw dumps down to something readable, then try to
> change the filter, but it wouldn't work.  I'm hazy on the details, but
> it either filtered on the subset of packets created by the first filter
> operation,

If it does that, it's a bug - a new display filter is supposed to be
applied to *all* packets, with any packet that passes the new filter
being displayed and any packet that doesn't not being displayed,
regardless of whether the previous filter showed the packet or not.

Now, if you used a *read* filter (specified with "-R" on the command
line, or in the "Open" dialog box when opening a file from the GUI),
only packets that pass the read filter are available at all; the
display filter only sees those packets.

However, "File/Reload" isn't supposed to clear the read filter.