What is the purpose of a capture vs display filter, and when would you use each?

• A. Capture filters discard packets on capture; display filters refine the view after capture; Use capture filters to reduce data volume, display filters for analysis.
• B. Capture filters alter the captured data; display filters block certain ports.
• C. Both filters discard packets; they only operate on different protocols.
• D. Display filters discard packets; capture filters refine the view after capture.

Answer: (D)

The key idea is when filters take effect and what they do to the data. Capture filters act at capture time: they determine which packets are saved to the capture file by evaluating each packet as it arrives. If a packet doesn’t match the filter, it’s discarded right away, reducing data volume and resource use, and you must plan what to capture before you start. Display filters, by contrast, are applied after capture to the already saved data. They don’t change or remove anything from the capture itself; they simply hide packets that don’t match so you can focus on what you’re analyzing. You can change display filters on the fly to explore different conversations and protocols without affecting the underlying data. A good way to remember it is: capture filters trim what gets captured; display filters trim what you see in the UI.

So, you use capture filters to limit data at capture time to save space and effort, and you use display filters to refine your analysis after the capture is complete.