Words can't show my gratitude Colin, it IS NAT acceleration affecting packet capture!
After disabling it I can capture the full TLS handshake now.
Now I'm going to look into how Broadcom implement their hardware acceleration because it looks kinda like a magic to me that packets can just slip...
Really appreciate for your knowledge!
Yes there is a ppp0 interface and if I understand correctly vlan500 is there because of selected ISP profile. The ISP requires vlan500 for internet connection.
About hardware acceleration, do you know where I can check to see if it's enabled?
I have an ASUS RT AC-66U Wi-Fi router with stock firmware which works in router mode with ppp connection to ISP.
Recently when I was trying to capture network traffics on the router with tcpdump, I realized that most outbound traffic can only be captured on eth0 and most inbound traffic can...