1. For test, send output to a file (plink.exe ..... > test.pcap) then open the file with Wireshark.
2. Has this syntax working in the past without -w - option for tcpdump?