Thanks Chris,

The Sniffer is monitoring the router interface closest to the FTP
server (sender). I totally agree about getting a capture at the other
end but unfortunately the receiver is another company and they are not
cooperating very well. The strange thing is this: the problem goes
away and I get a perfectly ordered packet capture when changing a
static route on the aformentioned router from the HSRP virtual address
to the physical address of WAN router 2. Note that WAN router 1&2 are
connected with a /30 ethernet segment running OSPF and all traffic is
designed to get routed over WAN router2. So when the virtual next-hop
is used, there is that extra hop... which is obviously causing the
problem... just can't figure out why. It doesn't that we dont have
access to the WAN routers (provider managed).

.3 (Primary)--------------WAN router 1
---------------->
My Router------.5 (virtual HSRP)
.4 (Secondary)--------------WAN router 2
----------------->