In the example you cite, the filters in question are written to capture the traffic from the SERVERS to the clients. Your note above describes the port situation from the CLIENT to the server. That is why the ports are reversed from what you expect.
↧