title: Most efficient way for doing multiple PCAP filters
body: <p>I have an application that using <code>libpcap</code> as the mechanism for acquiring packets, and I need to filter out different protocols for different parts of the application. I need to consider optimization as the streams will have a high rate of traffic (100-400 Mbps).</p>
  
  <p>What I would really like to be able to do is set up a live capture (no filter), and then selectively filter packets after the capture is made. It doesn't seem like this is possible (the bpf is built into the capture mechanism from what I can tell).</p>
  
  <p>If this indeed is not possible, there are two  other ways of doing it (that I have thought of), and I am not sure what would be considered more efficient or 'better':</p>
  
  <ol>
  <li>Make multiple captures each with their own filter</li>
  <li>Make one capture (no filter) that dumps to fifos, and have other captures read from those fifo (with their own filters)</li>
  </ol>