Display filters are applied after the capture is completed and they only hide the packets from view. The filtered packets are still present in the capture file and can be enabled for view later by changing or removing the display filter. This is an advantage over capture-time filters, which discard the packets that do not match the filter criteria and cannot be recovered later34 References:
CWAP-403 Study Guide, Chapter 2: Protocol Analysis, page 37
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit