switch from pcap_open_live to pcap_create & pcap_activate for more control