17

Am having trouble running tcpdump. I must run tcpdump with non-root user. Searched the web for my problem and figured out I should:

sudo setcap cap_net_admin=eip /usr/sbin/tcpdump

That enabled me to run tcpdump with my user but then I got:

you don't have permission to capture on that device

on any device I tried capturing.

Also went a little brute-force and did:

sudo chmod +s /usr/sbin/tcpdump

That didn't do it either.

4
  • Tcpdump requires root privileges,you’ll have to set specific Linux capabilities to the binary: $ sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
    – DreamCoder
    Oct 1, 2014 at 8:17
  • Did that too but i keep getting: tcpdump: eth0: You don't have permission to capture on that device (socket: Operation not permitted Oct 1, 2014 at 8:28
  • see here.askubuntu.com/questions/39281/…
    – g_p
    Oct 1, 2014 at 15:23
  • This is also problematic because don't want to change the source code which i'm running... Also, what DreamCoder suggested should work but strangely it don't. Anyone have another offer? Oct 2, 2014 at 7:38

2 Answers 2

41

It's a little late, but I just had the same problem. You need to give tcpdump the permission and capability to allow raw packet captures and network interface manipulation.

Add a capture group and add yourself to it:

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions:

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!

Found it here: Configure tcpdump to work as non-root

2
  • I was able to limit this a bit and just use cap_net_raw,cap_setpcap=ep. The removal of the i was because my program didn't need to fork. This is for a custom binary, so ymmv.
    – Dan
    Aug 15, 2016 at 23:27
  • This also worked for iftop a program that shows network utilization by IP address / DNS name Jul 13, 2019 at 22:53
0

Perhaps this might work. Similar to what was posted already. It has not been tested on ubuntu.

(use a group of which your user is a member) chgrp wireshark /usr/sbin/tcpdump

setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/sbin/tcpdump

using getcap /usr/sbin/tcpdump you should see /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip

Not the answer you're looking for? Browse other questions tagged or ask your own question.