That highly depends on audit but I think the problem is that if the syscall (connect in this case) doesn’t have the local port as a parameter/argument, then it won’t display