https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html

run this line to disable NIC assemble packet before reach to pcap reader

for i in rx tx sg tso ufo gso gro lro; do ethtool -K wlan0 $i off; done

view setting

ethtool -k wlan0

windows :

https://docs.microsoft.com/en-us/windows-hardware/drivers/network/using-registry-values-to-enable-and-disable-task-offloading