optimize count traffic from tcpdump more accurate