All attempts to get the PID using ps, pidof, or simular tools may suffer from race conditions and false positives. (Imagine someone else starting tcpdump with the same arguments, perhaps even using the same account.) Short: they are unreliable.

Corion's way reliably writes the PID. But even that suffers from race conditions, because tcpdump may exit and its PID may be reused before the written PID is read by some other process.

This is a general problem of stored PIDs. They may be outdated before they are read. The only safe way to work with stored PIDs is to catch SIGCHLD in the parent process and delete the stored PID when the child process exits.

There are several tools working exactly this way, supervise from daemontools is one of them. supervise can reliably run a "background" process, and it can send signals to the "background" processes, all without having to write PID files. (The tool to send commands to supervise is svc.)

Alexander