parse pcap file directly