On Aug 24, 2010, at 4:52 PM, Gregorio Tomas Focaccio wrote:
> The documentation I found for dumpcap did not say what happens if the -f filter argument is left off the dumpcap command. Do you know what happens?
It does no filtering - every packet that gets handed by the lower levels of the OS (device driver, maybe lower levels of the networking stack before, for example, IP) to the packet capture mechanism (and doesn't get dropped by the packet capture mechanism because its buffer fills up) gets passed on to libpcap/WinPcap, and gets written to a file by dumpcap.
(The same is true of tcpdump, BTW.)
