Which statement is true about capture filters in Wireshark?

• A. Capture filters decide which packets are saved during capture, reducing file size.
• B. Capture filters adjust OS timers during capture.
• C. Capture filters apply after capture to refine what is displayed.
• D. Capture filters change packet payloads during capture.

Answer: (A)

Capture filters determine which packets are saved during capture, reducing file size. They are applied at capture time, so only packets that match the filter are written to memory or disk as the traffic flows by. This means the captured file contains a subset of all observed traffic, which helps with storage and later analysis. They are different from display filters, which are used after capturing to show only certain packets in Wireshark. Capture filters do not modify payloads or timing; they simply drop non-matching packets before they’re stored. You set them before starting the capture, using syntax like a BPF expression (for example, capturing only traffic on a specific port).