Hi, see using the thread->kill() feature on linux where we end up talking about the finely tuned features of the new threads available. The reason I bring this up, is that the manpage for tcp says

Tcpdump will, if not run with the -c flag, continue capturing packets 
+until it is interrupted by a SIGINT signal (generated, for example, b
+y typing your interrupt character, typically control-C) or a SIGTERM 
+signal (typically generated with the kill(1) command); if run with th
+e -c flag, it will capture packets until it is interrupted by a SIGIN
+T or SIGTERM signal or the specified number of packets have been proc
+essed.
[download]

The newer threads probably now requires you to setup specific signal handlers in the thread running tcpdump, so that it can exit. Carefully read threads and the section on Signalling.... you probably need a

 $SIG{'FOO'} = sub { do_foo; };
[download]

in your sub codeblock.

Hopefully, whatever that tcpdumd is doing isn't considered IO of some sort. Because if it is, Signals will not work on threads stuck in IO, from what the perldoc says. Then you might have to fork tcpdump, so as to get it's pid, then kill it by $pid.

I am out of votes for today, but I would have ++'d you for the well written description of your problem :-)