Checkmk should listen on 0.0.0.0:514 which you can check with ‘netstat -plun |grep 514’.
The fact, that you receive the packages in your tcpdump tells me, that the network part works well und the error should be on the way from local interface to web UI.
Can you please control /omd/sites/$SITE/var/log/mkeventd.log and /ome/sites/$SITE/var/mkeventd/history/*.log