What does capture filter means in wireshark? Is it same as display filter?
closed as off-topic by AviD♦ Aug 27 at 13:09
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – AviD
There are two type of filter in wireshark:
Display filter is filter introduced by wireshark. It's user friendly, powerful and many things to filter. It has modular form. For example,filter to display HTTP Post is:
Wireshark loads packet first, and then apply display filter. So it is applied in user mode.
Capture filter is filter introduced by Libpcap/Winpcap (a driver to capture packets independent of operating system). It's very restricted and hard to read and write! No modularity. But instead, it is applied to Libpcap/Winpcap;it means kernel mode. So it it fast and prevent memory or storage usage,because of no unwanted packet is captured.
Capture filters work when the capture is taking place. It tells Wireshark which packets to capture and save to a pcap file.
Display filters works on already captured network traffic. It's simply a filter to that tells Wireshark which packets to display.