Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] How do I change the default capture filter?

From: "Bland, Alan" <Alan.Bland@xxxxxxxxxxxx>
Date: Thu, 6 Aug 2009 11:10:35 -0700
Title: How do I change the default capture filter?

At some time in the past I created a filter and managed to set it as the default filter, because every time I start Wireshark and start a capture that filter is shown in the "capture filter" text box.

This is a problem because I deleted the filter, so it is not found.

How do I remove this default setting.

To fix it I resorted to uninstalling wire shark (1.0.7) and reinstalled it.  The default filter was the non-existent filter.

I uninstalled wireshark and install ethereal (0.99).  The default filter was still the non-existent filter.
I uninstalled ethereal and installed wireshark (2.0 the July 2009 release).  The default capture filter was still the non-existent filter.

I scanned the registry for the name of the filter.  Not found.
I searched the entire C: drive looking for the filter by name.  Not found.

This is like a spirit from the other side that has not found peace and cannot rest.

Your help is needed.  How do I remove this setting?