What is the main difference between capture filters and display filters in Wireshark?

• A. Capture filters filter at capture time to decide which packets are saved.
• B. Display filters discard packets from the capture file on disk.
• C. Capture filters remove non-matching packets from the capture file after capture.
• D. Display filters apply to the live network interface.

Answer: (A)

Capture filters determine which packets are saved by the capture process itself, applying at the moment of capture. Only packets that match the filter are written to the capture file, which helps reduce disk usage and load on the system during collection. Display filters, by contrast, are applied after capture to the data already stored, controlling which packets are shown in Wireshark’s UI without changing the underlying capture file. This means you can capture everything (or a lot) and then use display filters to focus on what you want to analyze, or switch filters later without needing to recapture. Capture filters use BPF syntax, while display filters use Wireshark’s own display filter syntax. For example, capture a specific port to limit what’s recorded; later, apply a display filter to view only HTTP traffic within that captured data.