handle filter and offline sniffing