Revision history [back]

I'm assuming that you're using rpcapd for remote capture.

1. The capture filter is applied by the capturing library at the capture point, so for a remote capture it's applied on the remote device, and only packets that comply with the filter will be transmitted.
2. The capture data isn't compressed, and is in fact larger than the original traffic as there is additional metadata, e.g. the per packet timestamp.