I have almost no experience with tcpdump on a firewall, I prefer fw monitor, you should give it a try as well, because it is meant especially for firewall packet filtering and it is superior to...