1

I faced a very weird error, I'm running tcpdump by the root and want to log the output, when I do 

tcpdump -i eth0 -w logs/local.dump

it works fine, but when I set the output path like bellow, I get permission error:

tcpdump -i eth0 -w /mnt/local.dump

The permissions of the 'logs' folder which is in /home/ubuntu is 755 and root:root, ad the same for /mnt the permission is 755 and root:root. But I don't get why I get the permission error when I set the output as /mnt/local.dump.

Alex
  • 159
  • 2
  • 9

3 Answers3

1

I ran into this same issue as well on Ubuntu. Seems that tcpdump drops permissions after executing based upon the accepted answer for this question:

tcpdump failed withi permission denied on centos when using with rotated file option

I didn't start running into the permission issue myself until I started playing around with the -C options to limit file sizes. Even deleting the origin file I had in -w did not bring the permissions back nor did changing the -w to a different file within the same directory.

What did work was changing directories to a spot that was owned by root and had loose restrictions for the target directory and parent paths.

I'm not sure what tcpdump is doing under the hood to cause this problem, might dig into a little bit more some other time. I think it might be caching something and once you try the rotating file option, if your permissions aren't setup correctly it will break the non-rotating file options as well.

Hazok
  • 113
  • 5
1

I have not been able to reproduce the symptoms you describe on Ubuntu 14.04. But I have seen those symptoms on earlier Ubuntu versions.

What I found to be the reason was that SELinux was configured to restrict where tcpdump was allowed to write.

The workaround I found at the time was to copy /usr/sbin/tcpdump to /root/bin/tcpdump and use that copy instead.

kasperd
  • 30,455
  • 17
  • 76
  • 124
0

chaning the .pcapng into .pcap also worked for me

...$ tcpdump -i enp43s0f1 -c 10 -w logs/temp.pcapng
tcpdump: logs/temp.pcapng: Permission denied
...$ tcpdump -i enp43s0f1 -c 10 -w logs/temp.pcap
tcpdump: listening on enp43s0f1, link-type EN10MB (Ethernet), capture size 262144 bytes
^C0 packets captured
0 packets received by filter
0 packets dropped by kernel
Dennis Bernaerts
  • 1