To start, you need a capacity planning to know the "weight" of the that you think to write. What do you want to capture? Entire packet? Only header's?
Surely, flash drive is the whorse choice.
You need a large storage device, such a NAS/SAN, with a high speed access (e.g. FB channel with FB disk); after this, to capture and write the data, my suggestion is to balance the work on more process: for example you can start one process for each layer 3 protocol to write (in real time) data separately; after this, start one daemon to process each writted file, . Don't use a application queue to store packet in memory; if you don't know the volume of the data, you could lose the controll of the application. My suggestion is to planning more space then needed on storage, to have a kind of "lung" to write and to read data in separately time.