One obvious item is that tcpdump normally puts the NIC into promiscuous mode. What happens if you use 'tcpdump -p' instead? Also, what does 'ifconfig' tell you about the interface before and after running tcpdump (without -p)?