Wireshark-users: Re: [Wireshark-users] > How do I change the default capture filter?
From: "Lori" <[email protected]>
Date: Sat, 8 Aug 2009 14:53:35 -0400
Since this seems like something that is being 'remembered,' try to give it something else to remember. ; ) Try going to the 'invalid' filter and Edit it. Make it something that is valid.
It sounds to me like you're using the button on the toolbar to start the 
capture - or using Capture | Start and using the 'default' options.
Double check :
Capture  | Capture Filters
Make sure all the ones you don't want are deleted.
Close Wireshark and open it back up.
Try a capture.

If that doesn't work, try creating a new configuration profile. Under Edit | Configuration Profiles click New. Give it a name and use that instead of the default.
Not sure how other people do this, but I always click Capture and then 
Interfaces and go to Options. I make sure the Options I want are there and 
then click Start from that screen to begin a capture. Never been one of 
those who strives for fewer mouse clicks. YMMV. Another reason I always do 
that is because I want to specifically name each capture and save it in a 
particular folder.
I went digging through the Registry and the things I found didn't really 
pertain to capture filters. I would think that setting would be in the file 
you found - in the 'recent' file. And I'm wondering if what you're seeing is 
in the filters drop-down list.  [Are you trying to clear that list?]
Something else that may give you more information -- try creating a new user 
for that computer. See if it shows up under a different user or not. That 
would probably tell you if what you're trying to accomplish is a global or 
personal setting.
Just some guesses... hope it helps.

----- Original Message ----- From: "Bland, Alan" <[email protected]>
To: <[email protected]>
Sent: Saturday, August 08, 2009 12:03 PM
Subject: [Wireshark-users] > How do I change the default capture filter?


Thanks for the advice.

I found the string in the "recent" history file.  Removing is did not
That file is generated when Wireshark is closed.  Wireshark is still
starting up with the invalid capture filter.

I went in and tried to set the defaul filter to one that exists, but
wireshark started up with the invalid filter selected.

Do you have any other ideas?