Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I try to dump some traffic on my vserver's network interface, I get an error that I'm not allowed to do that:

# tcpdump -p -i eth0
tcpdump: eth0: You don't have permission to capture on that device
(socket: Operation not permitted)

I guess the problem is that my server provider seems to use a virtualization solution with shared Linux kernel (uname returns "" as version).

Any way that allows me to dump outgoing traffic from a single process?

share|improve this question
Any "real" hypervisor-powered VPS would allow this, so I'm guessing that you're on a pseudo VPS, probably running under OpenVZ or the like, which doesn't give users access to this type of device. – EEAA Feb 23 '12 at 0:13
@ErikA: Yes, that's what I meant. As I found out now, the provider uses Linux-VServer for virtualization. (Did I use the wrong term with "VPS"?) – AndiDog Feb 23 '12 at 10:21
up vote 2 down vote accepted

You could try using the strace command to trace the system calls your application is making. Something like this:

strace -o trace -e trace=read,write -s 8192 /path/to/my/command

This will launch /path/to/my/command under control of strace. It will log all read and write system calls (so not just network traffic, but any other i/o) to a file called trace. It will log up to 8192 characters for each read/write call.

This may or may not be helpful for your current situation.

share|improve this answer
That's a nice solution, and I can simply filter it with grep. As a hint: One may also want to add "send,sendto" to the tracing (for outgoing packets). – AndiDog Feb 23 '12 at 10:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.