don't depend on sshark