perhaps you could provide a pared-down code sample for how you are getting the data into the hash (remember to use <code> tags). While the Net::pcap::pcap_dump function writes a single packet, it is similar to a print to an open file -- you can write as many packets as you want, just one at a time.

fnord