[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Nov 05, 2002 at 06:31:54PM +1100, Ronnie Sahlberg wrote:
> But that only applies if you do not use any capture filters, right?

It applies if you do not use any *read* filters.

> If you use capture filters (display filter form) in order to minimize the
> amount
> of captured data, [t]ethereal will do a complete dissection of every packet
> and thus state information will
> build up?

It will do that if you use read filters (which are supported, for packet
capture, only by Tethereal at present, not by Ethereal); I use "capture
filters" only to refer to tcpdump-style capture filters, which are
stateless.