detect PCAP write errors

Without this check the code continues to write into output file even if the device is hopelessly ENOSPC, potentially wasting lots time and silently corrupting the output.

The magic constant 1 check per 10 000 output packets causes 0.4 % overhead in my tests where whole input is cached and write goes to /dev/null.

This is not perfect - errors from the underlying close() operation are not reported. Unfortunately this is a limitation in pcap interface and we cannot do anything about it.