Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Is it a bug with Wireshark?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 14 Apr 2008 12:53:16 -0700
Jason wrote:

However, the OP of this thread appeared to be talking about using '-R' to set the Display Filter in wireshark during an autostarted, '-k', live capture. So, we're not looking for setting a capture filter with '-R' like tshark does for reading files. Only to set the Diplay Filter when autostarting. Maybe it should have a different switch, to clarify it.

Given that the "R" in "-R" stands for "read", as in "read filter", as in "filter that's applied when reading packets", that would be the wrong flag for a *display* filter that's not applied when Wireshark initially reads in the packets - i.e., a "set the display filter" flag wouldn't cause packets that don't match the filter to be discarded when the capture is being read, it would just cause them not to be displayed - clearing the display filter would show those packets.