Packets that are processed with hardware offloading enabled bridge will also not be visible (flooded packets like unknown unicast, broadcast, and multicast traffic might be visible).

Sniffer catches packets before they go into the firewall (direction=rx) or after they leave it (direction=tx).