A missing packet in a view and a missing packet in a file require different explanations. Before widening a filter, write down whether you are reviewing an existing capture or deciding what a future capture should collect.

Use an existing, authorised practice capture whose contents you know. A sample containing two fictional conversations is enough. Record their endpoints and keep the original file unchanged; this exercise does not require collecting new traffic from a shared network.

Locate the filtering stage

Wireshark capture filters use libpcap syntax and restrict packets admitted during capture. Display filters select packets from the capture for presentation. Clearing a display filter can reveal stored packets; it cannot retrieve traffic excluded before it entered the file. The two filter languages are different, so do not paste one expression into the other control and assume equivalent meaning.

In the practice file, choose a known packet from each conversation. Apply a display filter that selects only the first conversation, then clear it. Locate both known packets again. Their reappearance establishes that the filter changed your view of those stored records.

Describe the evidence you actually have

For a second, hypothetical case, suppose a capture admitted only the first conversation. Looking for the second conversation in that saved file cannot establish whether it happened on the network. Record the collection restriction alongside any conclusion based on the file.

Keep a short capture note with its intended question, observed time window and filtering stage. This is especially useful when someone else receives the file without seeing the original setup. A statement such as “not present in this capture” is more precise than treating an absent record as proof that an event never occurred.

If the file cannot answer the question, arrange an appropriately scoped, authorised collection with the responsible person. Do not compensate by indiscriminately collecting private payloads. Acceptance for this exercise is identifying which missing records are recoverable by changing the view and which were never retained.

Sources: Wireshark official guide; Wireshark official guide.