13

Am having trouble running tcpdump. I must run tcpdump with non-root user. Searched the web for my problem and figured out I should:

sudo setcap cap_net_admin=eip /usr/sbin/tcpdump

That enabled me to run tcpdump with my user but then I got:

you don't have permission to capture on that device

on any device I tried capturing.

Also went a little brute-force and did:

sudo chmod +s /usr/sbin/tcpdump

That didn't do it either.

  • Tcpdump requires root privileges,you’ll have to set specific Linux capabilities to the binary: $ sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump – DreamCoder Oct 1 '14 at 8:17
  • Did that too but i keep getting: tcpdump: eth0: You don't have permission to capture on that device (socket: Operation not permitted – Sivan Sigal Oct 1 '14 at 8:28
  • see here.askubuntu.com/questions/39281/… – g_p Oct 1 '14 at 15:23
  • This is also problematic because don't want to change the source code which i'm running... Also, what DreamCoder suggested should work but strangely it don't. Anyone have another offer? – Sivan Sigal Oct 2 '14 at 7:38
26

It's a little late, but I just had the same problem. You need to give tcpdump the permission and capability to allow raw packet captures and network interface manipulation.

Add a capture group and add yourself to it:

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions:

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!

Found it here: Configure tcpdump to work as non-root

  • I was able to limit this a bit and just use cap_net_raw,cap_setpcap=ep. The removal of the i was because my program didn't need to fork. This is for a custom binary, so ymmv. – Dan Aug 15 '16 at 23:27
  • This also worked for iftop a program that shows network utilization by IP address / DNS name – HeatfanJohn Jul 13 at 22:53
0

Perhaps this might work. Similar to what was posted already. It has not been tested on ubuntu.

(use a group of which your user is a member) chgrp wireshark /usr/sbin/tcpdump

setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/sbin/tcpdump

using getcap /usr/sbin/tcpdump you should see /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.