core: add tcpdump by default