in addition to anyone who may be looking at this. It appears that the net::pcap::dump function of the net::pcap module utilises pcap_dump_open() from the pcap library.

this is as oppose to using pcap_dump_fopen which appears to append to an existing pcap instead of opening one.. see http://www.manpagez.com/man/3/pcap_dump_fopen/. Unfortunatly net::pcap doesn't allow you to call this.. as far as I can tell!

oh well. perhaps this is as good a time as ever to look at XS :)