If starting from the beginning is your problem when you run into one of these situations (which should be handled as suggested above) .. Why not divide things up into smaller groups and then join the final products? This way, you only have to merge a smaller set if you run into a problem. In many cases, 'capinfos -A' is enough to show a problem in a pcap. Another option would be to do something like a 'tcpdump -qnr' to just read through it. It will exit with an error code if a problem is detected...