Wireshark · Wireshark-users: Re: [Wireshark-users] Is it a bug with Wireshark?

[Guy Harris <guy@xxxxxxxxxxxx>]

Jason wrote:

> However, the OP of this thread appeared to be talking about using '-R' 
> to set the Display Filter in wireshark during an autostarted, '-k', live 
> capture.  So, we're not looking for setting a capture filter with '-R' 
> like tshark does for reading files.  Only to set the Diplay Filter when 
> autostarting.  Maybe it should have a different switch, to clarify it.

Given that the "R" in "-R" stands for "read", as in "read filter", as in 
"filter that's applied when reading packets", that would be the wrong 
flag for a *display* filter that's not applied when Wireshark initially 
reads in the packets - i.e., a "set the display filter" flag wouldn't 
cause packets that don't match the filter to be discarded when the 
capture is being read, it would just cause them not to be displayed - 
clearing the display filter would show those packets.