When I set a capture filter in Wireshark: 1. Are packets filtered at the application or at the interface? In other words, when the capture filter is set, is the application dropping the packets or is Wireshark telling the interface to send only certain packets? 2. Also, are packets sent to Wireshark as compressed data?
I want to perform packet capture on a remote device on my network, and I am trying to understand how this will affect traffic on my network. For question 1, if the filtering was done by the interface (or device), the amount of data sent over the network due to the remote capture would be smaller than if the filtering was done by the application. For question 2, I am trying to understand how much more traffic I am generating by starting a remote capture. Am I effectively doubling the traffic?
