I'm struggling to see where I am going wrong on trying to run a shell script with the -z flag for tcpdump. There does not seem to be a lot of/any examples of this flag being used. In the man page they highlight using gzip as a command and this works fine for me. Here is the man page for -z of tcpdump:

-z postrotate-command
Used in conjunction with the -C or -G options, this will make tcpdump run " postrotate-command file " where file is the savefile being closed after each rotation. For example, specifying -z gzip or -z bzip2 will compress each savefile using gzip or bzip2.
Note that tcpdump will run the command in parallel to the capture, using the lowest priority so that this doesn't disturb the capture process.
And in case you would like to use a command that itself takes flags or different arguments, you can always write a shell script that will take the savefile name as the only argument, make the flags & arguments arrangements and execute the command that you want.

My shell script for now is very basic...just cause I'm trying to root out where I am going wrong:

test.sh - this file is 777 to make sure it's not a permissions issue


cp $1 $1.BAK

First attempt:

tcpdump port 53 -i any -U -G 60 -z test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap
compresss_savefile: execlp(test.sh, tcpdump_files/tcpdump_02.pcap) failed: No such file or directory.

Seems like I need to tell tcpdump to execute this file so:

tcpdump port 53 -i any -U -G 60 -z ./test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap
compresss_savefile: execlp(./test.sh, tcpdump_files/tcpdump_02.pcap) failed: Permission denied.

Maybe fully qualifying the script? Nope..

tcpdump port 53 -i any -U -G 60 -z /home/me/test.sh -Z root -w tcpdump_files/tcpdump_%M.pcap
compresss_savefile: execlp(/home/me/test.sh, tcpdump_files/tcpdump_02.pcap) failed: Permission denied.

I most likely am misunderstanding how the argument works for the -z flag and the execlp it is running in the background. I've also for the heck of it tried doing -z '/bin/sh, test.sh' But this gave the no such file or dir error.

  • Can I assume you're on a Linux box, then? (based on your answer using apt install...) – Jeff Schaller Mar 29 '19 at 19:17
  • @JeffSchaller yep. Ubuntu 16.04 to be more specific. – FzZB03KCa46QeaU Mar 29 '19 at 19:18

Found a solution per: tcpdump post script Permission denied

To summarize:

#if this says enforce then change it to complain
grep tcpdump /sys/kernel/security/apparmor/profiles
#change to complain
aa-complain /usr/sbin/tcpdump

in my case I did not have apparmor on my box. But doing a sudo apt install apparmor-utils and following the above steps fixed my permission denied issues.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.