If you created your profile with an earlier version of Wireshark, look inside the preferences file for the Filter Expressions area, as shown in the book.Why don't you use graphs instead? They are a powerful tool in a packet analyst's craft. If you created your profile with Wireshark v3 or later, look inside the dfilter_buttons file.

Wireshark now places the filter expression button settings into a file called dfilter_buttons. Step 4 and Step 5 of the book mention and depict the Filter Expressions area within the preferences file.

If you want to avoid this confusion completely, just use the tcp.port=x filter format for TCP-based applications. Now, Wireshark recognizes that when an object upload/download requires multiple packets, those packets can still be considered part of the HTTP communication and they are displayed with the http filter. This is why we would only see 85 packets with the http filter. Wireshark used to only show packets that contain an HTTP request or response code - it would ignore the data packets seen when an object is uploaded/downloaded. The second result is now outdated as changes have been made to the HTTP dissector. TCP reassembly enabled: 85 packets matche the http filter TCP reassembly disabled: 12 packets match the http filter In the book, I referred to the different number of packets that you would see in these cases: The http filter won't show you the TCP handshake, ACKs, teardown, etc. On page 155 of this second edition, I addressed the dangers of using the http filter rather than tcp.port=80. PAGE 155 (Thanks to Patrick for catching this one.) We are keeping that site running under HTTP and you'll get your 404 error message for Lab 10 on that site. LAB 10 - The /nothere.html page really isn't available as we've moved the site and are using HTTPS now.

Wireshark basics