If tehy are not being displayed due to a display filter, then they packets have to be dissected so that the display filter can be evaluated.
The same functions that decode the packets are also preparing the fields of the packets so that the filter can be evaluated.
Right, I was thinking about the ones that just aren't on the screen at the time, when you're not using a display filter. Even when you are, you don't have to decode quite as deep for most display filters, no?
BB
