Copy the display filter into the clipboard, then close and restart Wireshark. Reload the file. Was the entire capture saved, or just the displayed packets?

Answer :

Yes, When you close Wireshark, it saves the entire capture file, not just the packets currently displayed with the filter.

To copy the display filter: Apply the filter and then Right-click on it and select "Copy."

Also, to check if the whole capture was saved:

  • Close Wireshark.
  • Restart it and reload the file.
  • Compare the total packet count with the displayed packets count.

So, in Copying the Display Filter, the steps are:

  1. In Wireshark, ensure you have applied the desired display filter to your capture.
  2. Right-click anywhere in the packet list pane (the area showing captured packets).
  3. Select Copy -> Copy Filter String. This copies the current display filter to your clipboard.

So, If the counts match, only displayed packets were saved. If different, the whole capture was saved.