I'm assuming that you're using rpcapd for remote capture.
- The capture filter is applied by the capturing library at the capture point, so for a remote capture it's applied on the remote device, and only packets that comply with the filter will be transmitted.
- The capture data isn't compressed, and is in fact larger than the original traffic as there is additional metadata, e.g. the per packet timestamp.
