wiretap/dnstap: handle EOF