I am using Wireshark v4.4.3 and have noticed that reloading a file with a filter active finds more packets than opening the capture and then running the filter. e.g. 1. open file SIP_capture.pcap 2. run a simple "sip" filter - e.g. 1000 packets are found to match the filter 3. use view/reload with the same active filter - now, e.g. 1100 packets match the filter 4. re-run the "sip" filter and it is back to 1000 packets 5. reload again and it is back to 1100 packets You can drag and drop the file into the Wireshark window, this works the same as the reload
