> > Now, if you used a *read* filter (specified with "-R" on the command
> > line, or in the "Open" dialog box when opening a file from the GUI),
> > only packets that pass the read filter are available at all; the
> > display filter only sees those packets.
> >
> > However, "File/Reload" isn't supposed to clear the read filter.
>
> Ah, yes, that's what I did.
I.e., you used a read filter?
> I have never even learned the display filter language, since I've been
> comfortable with the tcpdump language for a while.
If you used a read filter, you *have* learned the display filter
language, because read filters use the display filter language, not the
"tcpdump" capture filter language.
> Consider this another vote "for" using a unified filter language.
Note that when we use a compatible filter language for captures and
other purposes (display filters, read filters, and coloring filters all
use the same syntax), it'll probably be the *display* filter language,
rather than the "libpcap" capture filter language. The capture filter
language would have to be substantially extended to support the sort of
stuff you can do now in display filters, and extended even more to
support stuff we expect you'll eventually be able to do in display
filters (e.g., string comparisons).
> Or, make the reload command clear the read filter, unless there's a good
> reason not to.
The reload command was originally used to change the display filter, as
the "display filter" was, as I remember, just a read filter, with
"tcpdump" syntax, back when libpcap rather than Wiretap was used to read
to read capture files. To change the "display filter" you had to reload
the file with a new read filter.
Display filtering is not done at read time any more; the other use for
reload was to update the display when doing a capture with "-F", but we
now have "-S" which automatically updates the display.
So "reload" should, if we keep it around, be called "reread" - and,
instead of clearing the read filter, should allow you to change it
*arbitrarily*, including clearing it or using a different read filter.
