It might be worth it to reduce the number of write_to_file() by putting stuff in a buffer before writing to file.
write_to_file() calls fwrite(), which puts stuff in a buffer before writing to the file in the sense of "calling write() or WriteFile()). Would adding another layer of buffering atop the standard I/O library buffering make a significant difference here? (libpcap, as used by, for example, tcpdump, makes multiple fwrite() calls per packet written.)
I'm not sure but from the picture there seems to be a bit of overhead
per write so if we reduce
the fwrites() to 3, hdr-pkdata-footer with hdr and footer being a local
buffer[x] it might make some difference.