The mechanisms for defining and saving capture filters and display
filters are almost identical. So both will be described here,
differences between these two will be marked as such.
You must use Save to save your filters permanently.
Ok or Apply will not save the filters,
so they will be lost when you close Wireshark.
Figure 6.7. The "Capture Filters" and "Display Filters" dialog boxes
This button adds a new filter to the list of filters. The currently
entered values from Filter name and Filter string will be used. If
any of these fields are empty, it will be set to "new".
This button deletes the selected filter. It will be greyed out, if no
filter is selected.
You can select a filter from this list (which will fill in the
filter name and filter string in the fields down at the bottom of the
You can change the name of the currently selected filter here.
The filter name will only be used in this dialog to identify the
filter for your convenience, it will not be used elsewhere. You can
add multiple filters with the same name, but this is not very useful.
You can change the filter string of the currently selected filter here.
Display Filter only: the string will be syntax checked while you are