Firewall ip-address rewriting and pcap library?

Tracing the "outside" of my firewall using pcaplib raises this question:

outgoing packets have the local source ip rewritten to the address of
the firewall - that´s ok.

incoming packets have already the local destination ip !??

I'm not tracing any wired protocol, just simple NTP.

Is this a side-effect from the pcap library, catching packets _after_
the rewrite of destination address (the local address).

If this assumption is true - can I trace in an other way to get the
"true" packet contents?

/Göran