prepare for pcap - tar output
activate via pcap_dump_tar = yes