With macOS and iOS tcdump -P one may write PCAP-NG, and this will inclide a frame comment field including the name of the sending process. This is very helpful under iOS if you want to identify which app is sending some specific traffic.
When I run such a PCAP-NG through zeek it does not output this frame comment. How can I start zeek in a way that it does output the frame comment field? (it is called frame.comment in Wireshark)