Thanks, that clarifies things. It turns out I've gone with capturing over a socket, not a device (which is on another machine), so again libpcap doesn't help. However, I just went byte by byte over the ERF header from the Wireshark gui and have constructed a Net::Format::Layer::ERF module that does the job.

I keep looking for an excuse to do more projects in C, but can't justify it because Perl does the job with acceptable performance, is faster to implement and easier to maintain!