 | 1 | initial version |
Without seeing the file, my guess is that this is related to SIP PDUs that are segmented across multiple TCP segments, and where the SIP dissector is called on the first pass, doesn't actually dissect any data because it needs to be combined with a later segment, and tells the TCP dissector that. On the second pass, the SIP dissector is not called at all for those frames.
When you open/reload a file with a filter active, you apply the filter on the first linear pass through the packets. That is, it's a case of https://gitlab.com/wireshark/wireshark/-/issues/16350 Usually that results in finding fewer packets (e.g., things like fields that refer to "what later frame had the response for this frame?" don't work on the first pass) but this is the opposite case.
