So, wireshark was hitting me with lots of failed IP header checksum failures and thelikes. Turns out OSX rx and tx checksum offloading really fraks it all up.

You can disable those at runtime as these are writeable kernel variables:

 sudo sysctl -w net.link.ether.inet.apple_hwcksum_tx=0
 sudo sysctl -w net.link.ether.inet.apple_hwcksum_rx=0

according to EFF: (Note that this may cause some local applications to work incorrectly!) -> https://www.eff.org/wp/detecting-packet-injection