I was about to dismiss this as a silly idea, but the voice in the back of my head went "You know, the obvious answer might not be quite as daft as it first seems".

Although, due to what I'm trapping, I can't really pull the packets into perl and use it to work it out - they do happen to be, currently, all on different ports - which, of course, tcpdump clearly shows. I don't even need to mess with Net::Pcap and it's screwing with SIGALRM - I can simply use my existing implementation with a few extra nuts and bolts. I think.

Thank you for the probably obvious, but nevertheless gratefully received, suggestion.