On 08/14/2016 03:20 AM, Anand Buddhdev wrote: > The number 6882162 is exactly the number of DNS queries I am sending > from another server (the source). The filter is seeing them. However, > not all of them make it into the pcap file. Try specifying "ether host <src mac>" and compare the pcap files. How are you counting the number of packets in the pcap file?