same tshark fx, for audito