Currently it's cumbersome to detect if there was an error when writing to a dump file. You need to use pcap_dump_fopen(stream) and then check ferror(stream) after each call to pcap_dump. A better solution would be to return -1 from pcap_dump on any error. Given the C ABI on x32 and x64 it's safe to modify this call to return an int, maybe not on all platforms? Safest solution would be to add a int pcap_dump2(...). What do you think?