write pcap (but linktype is wrong)