I wouldn't go and mimic tcpdump in Perl. It's not going to be a trivial task.

But I would just fork (using a pipe-open), exec tcpdump in the child, read in the parent. The parent can count the number of lines seen - if it has seen 6, you have an IP coming else, otherwise, not. A standard alarm/die/eval trick will get you the 5 second time out. Still need the tcpdump that way, but no external ps, grep, awk, kill, or wc. And won't wait 5 seconds even if you saw the ip address after 2.