Older versions of tcpdump truncate packets to 68 or 96 bytes. To solve this, use -s 65535 to capture full-sized packet:
$ tcpdump -i [interface] -s 65535 -w [file]
$ tcpdump -i [interface] -s 65535 -w [file]