A "find" operation sent as an OP_QUERY to MongoDB 3.2 or older packs the filter and the projection documents end-to-end. Starting in MongoDB 3.2, "find" is a command, and the projection document should be included as a "projection" field within the command document.

PyMongo does this correctly but it also packs the projection document end-to-end after the "find" command document. The server doesn't care, but PyMongo violates the protocol spec and it's a surprising thing to see on the wire. Wireshark screenshot attached.