Pcap file parsing requires the entire byte stream to be materialized. There should also be a version that works on a stream of bytes.