My suggestion about it being NAT was a complete stab in the dark: it would explain why packets were being dropped before being logged. But I suspect it would also stop almost all outgoing connections, as you wouldn't be able to specify the IP address you wanted to target. Sooo broken.