TCPDUMP with SNAT and '-p' usage

You may wish to review SOL13637: Capturing internal TMM information with tcpdump which documents the interface modifiers, such as n,p, and h

Please note the warning about using the 'p' modifier:

Note: This modifier will continue to produce flow information for the life of the connection. Subsequent tcpdump captures will reveal flow information from previous tcpdump captures using the :p modifier if the connection is still active. To clear flow information from previous use, run the tcpdump command without the :p modifier using a filter that matches no information in the flow and ensure some traffic has been received by the BIG-IP system for the flow.