On Tue, Nov 05, 2002 at 06:31:54PM +1100, Ronnie Sahlberg wrote: > But that only applies if you do not use any capture filters, right?
It applies if you do not use any *read* filters. > If you use capture filters (display filter form) in order to minimize the > amount > of captured data, [t]ethereal will do a complete dissection of every packet > and thus state information will > build up? It will do that if you use read filters (which are supported, for packet capture, only by Tethereal at present, not by Ethereal); I use "capture filters" only to refer to tcpdump-style capture filters, which are stateless.
