mirror how tcpdump sets up pcap.