Activating and deactivating filters
Typically, an active (activated) filter narrows the scope of your packet captures according to that filters’ rules. For example, a filter that filters LDAP traffic—if active—causes only LDAP packets to be captured to the capture buffer. Furthermore, this effect is additive, meaning if you activate an additional filter, both filters’ rules apply to future captures using a logical OR expression.
Tip! While enabling filters narrows the scope of your future packet captures, you can broaden that scope by enabling more filters. Alternatively, consider creating a “negative” filter to ignore packets you do not want to capture, and use that instead.
Note: By activating more than one filter (if desired), all activated filters are linked together with a logical OR statement.
Also, if you apply a rule that is not relevant to your pre-filter or post-filter scenario, that rule is ignored.
1. On the Home tab, in the Probe group, click Filters > Configure Software Filter.
2. Browse the list of filters, and activate any filter by enabling it.
3. Edit any filter by selecting it and clicking Edit Filter.
4. If you want to deactivate all filters, activate the “Empty Filter” filter.
5. Click OK to save your changes.
 
All future packet captures now adhere to the rules of all active filters. When necessary, you can deactivate filters by disabling them during step 2. To deactivate all active filters simultaneously, activate the Empty Filter filter.