[CentOS] tcpdump

I have an issue with only a few domains sending mail to a company's exchange server.
Topology is as follows:
Internet -> PIX -> logical interface / vlan -> HP switch (interface tagged into applicable vlan) -> ESXi server -> vm (ASSP/CentOS Postfix MTA) -> HP switch (out of vlan) -> physical HP server with E2003.

Mail comes in, ASSP logs it, postfix logs it, queues it, attempts delivery to my exchange server and somewhere com gets mangled. I can't tell what's wrong at the postfix side, but the exchange server doesn't even log it despite the mail getting queued and released?

How can I dump this interaction and more specifically sort it to see only that transaction. Server is busy, there would be a lot of data on a continuous dump. Given the topology there is room for much issues and I don't doubt the issue being from ESX forward (seen silly network issues on ESX before).

Thanks for any input!
jlc