tcpdump permissions problem

Am having trouble running tcpdump. I must run tcpdump with non-root user. Searched the web for my problem and figured out I should:

sudo setcap cap_net_admin=eip /usr/sbin/tcpdump

That enabled me to run tcpdump with my user but then I got:

you don't have permission to capture on that device

on any device I tried capturing.

Also went a little brute-force and did:

sudo chmod +s /usr/sbin/tcpdump

That didn't do it either.

2 Answers

It's a little late, but I just had the same problem. You need to give tcpdump the permission and capability to allow raw packet captures and network interface manipulation.

Add a capture group and add yourself to it:

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions:

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!

Found it here: Configure tcpdump to work as non-root

Perhaps this might work. Similar to what was posted already. It has not been tested on ubuntu.

(use a group of which your user is a member) chgrp wireshark /usr/sbin/tcpdump

setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/sbin/tcpdump

using getcap /usr/sbin/tcpdump you should see /usr/sbin/tcpdump = cap_net_admin,cap_net_raw+eip