Suricata in socket mode: determining if a PCAP is done processing