add pcap dumper based on cached open / close / write