1

Here is what I'm trying to do (CentOS 7):

root@serv02 # /usr/sbin/tcpdump -nn -i eno16780032 -s 0 udp port 53 -w /var/opt/A.pcap -C 100 -W 30
tcpdump: /var/opt/A.pcap00: Permission denied

I'm running this as root and the file system is not full. I just don't understand why tcpdump does not create the file.

The command worked fine without -C and looked like -C caused tcpdump to drop privileges, but why?

1
  • This SF Q&A nails your issue - serverfault.com/questions/478636/…. It's what Siva shows in his A'er but shows how to triage this issue with strace and explains why it's happening.
    – slm
    Commented Aug 1, 2018 at 9:30

1 Answer 1

2

From man page :

-Z Drops privileges (if root) and changes user ID to user and the group ID to the primary group of user.

This behavior is enabled by default (-Z tcpdump), and can be disabled by -Z root.

By default, tcpdump is dropping privileges to the 'tcpdump' user. So mention the root user in command and try:

 $ tcpdump -nn -i eno16780032 -s 0 udp port 53 -w /var/opt/A.pcap -C 100 -W 30 -Z root
2
  • 1
    Hmm, I've never heard of this, good catch.
    – slm
    Commented Aug 1, 2018 at 9:30
  • @SivaPrasath man page on CentOS 7 is different to yours. -z is postrotate command. Did not say anything of dropping privileges. Commented Aug 1, 2018 at 23:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .