[Guy Harris <gharris@xxxxxxxxx>]

GRL wrote:
> Will it be the possibility of the string match in the future?

Perhaps somebody will add a string matching instruction to the BPF
interpreter on some platform in the future (note that the BPF
interpreter is *NOT* part of Ethereal, so there's nothing Ethereal can
do about this); I don't know of anybody who has any plans to do that.

The only alternative would be to do the filtering in user mode code,
which would mean copying *all* packets from the OS kernel, even the ones
that wouldn't match, so you'd be more likely to drop packets.  You could
do that in Tethereal with a "read filter", i.e. a filter specified with
"-R", such as "frame contains CONNECT", when capturing.  Currently, 
there's no mechanism for doing that in Ethereal.