Wireshark has two types of filters: display filters, and capture filters.
Display filters are more flexible than capture filters (there are some things that capture filters can't do) because display filters look at the data after it has already been copied over to wireshark's packet log.
Capture filters can be a huge benefit to performance if you have lots of separate flows of data going through your network interface, but you only want to capture a small amount of it. The data never gets copied to wireshark if it fails to match the capture filters.
You can actually try this and feel the performance difference in the UI (and observe the performance difference in CPU usage) by doing something like this:
- Start up a fast web server on localhost.
- Start an enormous HTTP file download (gigabytes of data).
- Capture on the localhost network interface with a capture filter that ignores the port where the huge download is taking place.
- Clear the capture filter completely, and compare the performance and CPU usage in Step 3 to setting the same sort of filter on the display filter side.
IIRC, Wireshark dumps its packet caps to disk (so it doesn't go OOM), so probably the bottleneck that occurs with "too wide" capture filters is with your disk subsystem having to log everything going on on your network interface.
This is why, if you're wiresharking a very busy server just to observe one specific flow or process, it is essential to set reasonable capture filters. Otherwise wireshark will introduce significant CPU load and I/O throughput.
On Windows anyway, the implementation of packet capturing occurs mostly on the kernel side. Wireshark uses a tool called WinPcap, a kernel module, which actually compiles your capture filters into native code at runtime to create an extremely optimized test for whether or not the capture filter is matching or not. If the filter doesn't match, the packet never gets copied to wireshark's process space.
The implementation of the pcap kernel side backend could vary across platforms, and thus, so could its performance and efficiency.