Open Stack

I'm following the instructions at
http://docs.openstack.org/trunk/openstack-ops/content/network_troubleshooting.html

to set up patch-tun mirrors, but running tcpdump on the "snooper0"
produces inconsistent results- sometimes, I'm able to get a copy
of the packet (e.g., the syn packet for ssh below) but not others
(the tcpdump session did not show any more packets, for example).

Why is this? 

--Sowmini
--------------------tcpdump on snooper0-------------------------

root at sowmini-virtual-machine:~/devstack# tcpdump -i snooper0 -xenvv
tcpdump: WARNING: snooper0: no IPv4 address assigned
tcpdump: listening on snooper0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:15:04.106523 fa:16:3e:1d:eb:b8 > fa:16:3e:e2:be:81, ethertype 802.1Q (0x8100), length 78: vlan 1, p 0, ethertype IPv4, (tos 0x0, ttl 63, id 51325, offset 0, flags [DF], proto TCP (6), length 60)
    192.168.12.41.48975 > 10.0.0.4.22: Flags [S], cksum 0xabdb (correct), seq 3145500194, win 29200, options [mss 1460,sackOK,TS val 64704095 ecr 0,nop,wscale 7], length 0
        0x0000:  0001 0800 4500 003c c87d 4000 3f06 9c69
        0x0010:  c0a8 0c29 0a00 0004 bf4f 0016 bb7c 8622
        0x0020:  0000 0000 a002 7210 abdb 0000 0204 05b4
        0x0030:  0402 080a 03db 4e5f 0000 0000 0103 0307
12:15:04.109993 fa:16:3e:e2:be:81 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 1, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.0.0.1 tell 10.0.0.4, length 28
        0x0000:  0001 0806 0001 0800 0604 0001 fa16 3ee2
        0x0010:  be81 0a00 0004 0000 0000 0000 0a00 0001