Why do we get wireshark captures