You might try using an arp ping instead of your more complicated setup. The arping utility does this. arping sends pings over ethernet asking "which mac address owns this ip address". This would eliminate the complicated step of running tcpdump.

Edit: arping would only work if your VMs are on the local network. This might be a silly assumption for me to make what with cloud computing and all. If your VMs aren't on the local network I would suggest using a piped open and select and maybe using Net::Ping instead of the ping command.

Here is a test I created for my own curiosity. The summary of my findings are:

• SIGALRM handlers inside threads are adorably useless. Put the SIGALRM handler in the main thread.
• The parent thread's SIGALRM handler overrides the child thread SIGALRM handler... thankfully.
• join-ing the thread delays the SIGALRM handler until the joined thread is finished. Not helpful.
• If you detach the thread the SIGALRM is triggered with the proper delay.
• If you set the delay with 'alarm' inside the thread, it will override the parent thread's 'alarm'.

Rather confusing. So basically, if you insist on using threads detach the thread after you set the alarm handler and alarm delay in the parent thread. This is kind of silly because you could detach the thread and just sleep, then kill the thread or whatever.

Lose the threads, lose tcpdump and ping, and use: `arping -c 1 $host`. Easy.

#!/usr/bin/perl

use warnings;
use strict;
use threads;

sub set_alarm
{
    $SIG{'ALRM'} = sub {
        printf "Alarm went off in thread #%d\n", threads->tid();
        print qq{"Get up, get up!", says the clock.\n};
        exit 1;
    };

    alarm shift;
}

# If you set the SIGALRM handler HERE and ...
#     If you join the thread,   the alarm handler goes off after 10 se
+conds
#     ( The 'sleep' delay set inside the child thread. ) 
#     If you detach the thread, the alarm handler goes off after 3 sec
+onds
#     ( The 'alarm' delay set inside the thread )
#         Or If you don't set 'alarm' inside the thread, the outer 'al
+arm'
#         delay is used.

set_alarm( 5 );

my $sleepy = threads->create ( sub {
                                   # If the SIGALRM handler is used in
+ this thread
                                   # (comment out the set_alarm above)
                                   # it simply prints "Alarm clock" ! 
+hahahaha
                                   set_alarm( 3 );
                                   sleep 10;
                                   print "Well, well, are you joining 
+me in bed?\n";
                               } );

printf "Main thread  # is %d.\nChild thread # is %d.\n",
    threads->tid(), $sleepy->tid();

# Try commenting out detach/sleep and uncommenting join
# $sleepy->join;

$sleepy->detach;
sleep 15; # you only need to sleep when detach-ing

print "*Fart*\n"; # Luckily this never gets reached...
print "Oh crap I'm late for work!\n";
[download]

Edit: To be clearer, SIGALRM handlers inside the child thread are apparently never reached. I also only ran this on Mac OS X, who knows you could get different results on different machines (Joy!).