@NickGriffiths.
There was indeed a behavioral change of FW monitor in this take.
Up until R80.20 FW monitor was not monitoring accelerated traffic by PPAK. In R80.20 we introduced the ability to monitor this traffic, however it was not enabled by default (Due to high performance impact). One of the reasons for this high performance impact is the inability to use the "-e" filter which is not supported on PPAK.
Now, starting from take 73, we have made substantial changes to FW monitor. Together with performance optimizations we have also embedded new filtering abilities in FW monitor.
By using "-F" flag you can filter certain connection. For example, to filter a host with the IP “8.8.8.8” you should use: fw monitor -F "8.8.8.8,0,0,0,0" -F "0,0,8.8.8.8,0,0".
The syntax is simple. -F "{src IP}, {src port}, {dst IP},{dst port}, {protocol num}". “0” can be used as a wild card.
For more information about this check sk30583 ("what is FW monitor") or ask me.