By traffic, because The captured good needs to be put somewhere. And if not to the network, then to the disk, then disk activity will be noticeable. But if you capture not continuously, but once a minute (for example), then it is easier for the program not to sleep.