Fix pcap handling for datalink type RAW

If the pcaps are of datalink type RAW, the tcpdump command fails:
    tcpdump: no VLAN support for data link type 12

This error is not caught by the 'catch' in the pipe open though,
so to detect this this patch just checks for the expected file to
exist. If it doesn't, it's assumed that tcpdump returned error and
it will retry without vlan in the bpf string.