The kernel then passes the packets straight to the process. However, this wouldn't work too well on a busy network or a slow machine. The user process has to read the packets as fast as they appear on the network. That's where buffering and packet filtering come in. The kernel will buffer up to X bytes of packet data, and pass the packets one by one at the user's request.
Packet filters allow a process to dictate which packets it's interested in.
The usual way is to have a set of opcodes for routines to perform on the packet, reading values off it, and deciding whether or not it's wanted. These opcodes usually perform very simple operations, allowing powerful filters to be constructed. It's hoped that the filter cuts down the amount of packets buffered to stop overflowing the buffer, which leads to packet loss. Your mileage may vary with other packet capturing facilities. If you're experiencing a lot of packet loss, you may want to limit the scope of the packets read by using filters.