Whilest completely agreeing none of these are entirely satisfactory, here are some thoughts which might help, gleaned from doing various large-scale packet-capture analyses over the years.
Perhaps one of these ideas will help you:
- Is it possible to simplify this match conditions somehow, perhaps there's a pattern in the 35,000 ports. (ie something like address aggregation)
- Is it possible to do eg 10 smaller matches and join them up?
- Does tshark (or wireshark) have the same issues?
- Can you do the task textually? (Ie, get tcpdump to print the packets out, do matching with awk/php/whatever)
- Run a suitably large instance computer (eg at AWS) with monster amount of memory, for an hour
- Write a small C program to do the work, as PCAP files are pretty easy to work with
I've normally found myself writing a small C program for large analyses, especially if they are things I'd need to do frequently and it's as simple as selecting on a big list of port numbers. My understanding is that the main pcap filtering compiles a big expression, which can be memory-hungry. Normally my programs are running on pretty small computers.
I've always coded from scratch following the documentation of the file format at Wireshark, rather than use the pcap library.