It sounds like your card might have chimney offloading enabled. On systems with this feature, established TCP connections are handed off to the NIC for processing and the traffic bypasses any NDIS intermediate drivers (including WinPcap). More in-depth discussions can be found on winpcap.org and KB 912222. You can disable it using netsh int ip set chimney disabled
.
This problem pops up occasionally on the Wireshark and WinPcap mailing lists. I'd imagine it will happen more often as the feature makes its way through various product lines and people upgrade to newer versions of Windows. Chimney, VM environments, and cloud computing are creating "new" and "interesting" challenges for packet capture.