Corrected BPF filter using tcpdump subprocess