Wireshark-dev: [Wireshark-dev] Are Capture Filters Implemented in Software or the Network Card?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: X Q <xq1xq1xq1@xxxxxxxxx>
Date: Thu, 18 Nov 2021 12:53:24 -0600
This is a question fairly deep in the guts of Wireshark that I could not find an answer to.

When a capture filter is implemented are ALL packets sent to Wireshark/Dumpcap/TShark at the software level for filtering 

or 

are the packets not matching the filter shedded/ignored by the Network Interface card itself thus reducing strain on the CPU/Network Fabric?

I look forward to hearing from you!