SIGTERM would be better. The child's handler should pass along the signal to its children. How about doing it this way, instead?

my $pid = open TRAFFIC, "-|",  "/usr/sbin/tcpdump", "-i", "eth0" or di
+e $!;
[download]

That gives you the child pid directly if you need it. You can handle the sampling interval with localtime or, on some systems:

my ($rin,$rout);
vec( $rin, fileno( TRAFFIC), 1) = 1;
while( ($num,$sleep) = select($rout=$rin,undef,undef,$sleep)) {
    last if $sleep <= 0;
 # read TRAFFIC and process
}
[download]

Or use IO::Select.

When you're done, just close TRAFFIC to kill off the real child. Doing it this way avoids the temporary file, removes an unnecessary process, gives you record-at-a-time memory usage, and lets you use cycles where both parent and child are sleeping in the present design.

After Compline,
Zaxo