$snoop in the parent is the child pid. Unfortunately, system() performs a further fork, (and I think tcpdump would be still another child of that) -- and killing the parent doesn't kill the child.
HOWEVER, if you use exec() instead of system(), there are no additional children spawned, so you can stop the process by killing the fork. Just beware, there should not be any calls after exec(), because it doesn't return.
my $pid = fork();
if (!$pid) {
exec("tcpdump ...");
# no more code here!!!
}
sleep(11);
kill 9, $pid;
Should work. qv. exec
