Move raw wireshark pcap handling into core