pcap example from file or inteface or watchdir