fallback to tcpdump parsing