We do have this line of code hhttps://github.com/vyos/vyos-1x/commit/b76e4c808c954dcf498b510aaa9c8d6c91850991#diff-46dc2c4640d7f8d348bcfe20c38c5d49e8aab60060357c01b8a4f40d0d80cfebR138 which calls the tshark binary - which might be nice - but:

• tshark heavily bloads the image due to all its dependencies
• tshark is not present in every release - it seems

vyos-build [current] # git grep tshark
data/build-types/development.toml:  "tshark",
data/build-types/stream.toml:  "tshark",

As VyOS is still a router and not an “All-in-one-system-with-all-Debian-tools-like-kali-linux” we probably should drop all occurrances of tsharkto reduce the image size by ~25MB.