Capture Filter

A capture filter is used to restrict the kind of packets that will be stored in a document when collecting network data. In contrast to a view filter all packets not passing the capture filter are lost. So if you not feel certain about which packets to filter, you should use a view filter instead.

A capture filter is always applied when a new document is created, though it will let pass all packets by default. To change the capture filter settings for an existing document use the Collect > Capture Filter menu command. In both cases the Settings dialog for the capture filter will open. In addition to the Settings dialog for the view filter you can choose the packet sources here. These are the network interface cards that shall be used to collect packets. On the same page it is possible to change the buffer size of the packet store. But this is only possible for new documents and the control will be read only when editing capture filters of existing documents.