Wireshark reads more packets than libtins

[Jacobsin Pyth]

I have a pcap with just over 500,000 packets and when I run a simple pcap packet counter I am missing 3 packets. I am just curious if there is something expected here. Or if I need to upload my pcap and code to verify I am not an idiot?

[Matias Fontanini]

libtins automatically drops packets that are malformed. I think wireshark has a "malformed" keyword on its filter syntax. If you apply that one in your pcap, do you see 3 malformed packets show up?