The most common issue is that someone runs tcpdump with the -f option but fails to add the -s 0 option. So you don't have the full packets.
tcpdump
-f
-s 0