Packets should be delivered to the raw socket and visible in tcpdump immediately as they arrive on the wire, consistent with standard Linux networking behaviour and with how NAT mode behaves. Actual ...