Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
[root@localhost ~]# cat /etc/issue
Fedora release 17 (Beefy Miracle)
Kernel \r on an \m (\l)
[root@localhost ~]# uname -a
Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC 2012 i686 i686 i386 GNU/Linux
[root@localhost ~]# tcpdump -i p3p1 -n -w out.pcap -C 16
tcpdump: out.pcap: Permission denied

Why I get error??

What should I do?

share|improve this question
up vote 10 down vote accepted

i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. so just specify the -Z user

# strace tcpdump -i eth0 -n -w out.pcap -C 1
fstat(4, {st_mode=S_IFREG|0644, st_size=903, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aea31934000
lseek(4, 0, SEEK_CUR)                   = 0
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 903
read(4, "", 4096)                       = 0
close(4)                                = 0
munmap(0x2aea31934000, 4096)            = 0
setgroups(1, [77])                      = 0
setgid(77)                              = 0
setuid(77)                              = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\0\0\0\0\0\0\310\357k\0\0\0\0\0", 16) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0

recvfrom(3, 0x7fff9563d35f, 1, 32, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)
fcntl(3, F_SETFL, O_RDWR)               = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\17\0\0\0\0\0P\327\233\7\0\0\0\0", 16) = 0
open("out.pcap", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
write(2, "tcpdump: ", 9tcpdump: )                = 9
write(2, "out.pcap: Permission denied", 27out.pcap: Permission denied) = 27
write(2, "\n", 1
)                       = 1
exit_group(1)                           = ?

you can see the strace result above, tcpdump dropped the privileges into user and group pcap (77).

# grep 77 /etc/group
# grep 77 /etc/passwd

From tcpdump man page, -C

# man tcpdump
       -C     Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so,
              close the current savefile and open a new one.  Savefiles after the first savefile will have the name  specified
              with  the -w flag, with a number after it, starting at 1 and continuing upward.  The units of file_size are mil-
              lions of bytes (1,000,000 bytes, not 1,048,576 bytes).

              **Note that when used with -Z option (enabled by default), privileges are dropped before opening first savefile.**

# tcpdump --help
tcpdump version 3.9.4
libpcap version 0.9.4
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                [ expression ]

Specify specific user with -Z user

# tcpdump -i eth0 -n -w out.pcap -C 1 -Z root
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
35 packets captured
35 packets received by filter
0 packets dropped by kernel     
share|improve this answer
Thank you! '-Z' option is very good~! – chobo Feb 16 '13 at 12:27

Your tcpdump is dropping privileges to the 'tcpdump' user, check the man page ("-Z tcpdump" is the default, and the tcpdump user doesn't have permissions to write in root's homedir). As Daniel T. told you, run your capture in a world-writable directory like /tmp, or at least a directory where you've given either the user or group 'tcpdump' write permissions.

share|improve this answer

Try to run the command from /tmp or any other world writable directory. I remember having issues with tcpdump in directories which are not world writable, I have no clue why -:)

         cd /tmp
         tcpdump -i p3p1 -n -w out.pcap -C 16 
share|improve this answer

Is SELinux running? Check by typing is terminal:


If it says Enforcing, you can try disabling SELinux and trying the tcpdump again, to see if SE was stopping it.

share|improve this answer
@Hauke Laging From his bash output, it seems he is running the command from root's home dir. – mako_reactor Feb 14 '13 at 2:48

When I ran into this Permission denied issue it turned out to be that I was putting a .cap extension on the file instead of .pcap. I'm not sure why that broke things, but strace confirms that it came from the OS.

  # uname -a ; lsb_release -a
  Linux bidder-lb4 3.2.0-76-virtual #111-Ubuntu SMP Tue Jan 13 22:33:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 12.04.5 LTS
  Release:        12.04
  Codename:       precise
share|improve this answer
It turns out the AppArmor profile for Ubuntu (/etc/apparmor.d/usr.sbin.tcpdump) only allows the tcpdump binary to write to files with a .pcap extension. AppArmor is on by default in Ubuntu, which caught me out. – Rich L Dec 3 '15 at 16:05

The error message doesn't make much sense to me. SELinux is a possible explanation, though. You may have a closer look at what's happening by starting tcpdump through strace:

strace tcpdump -i p3p1 -n -w out.pcap -C 16
share|improve this answer

you should change the mode of directory under which you are running tcpdump .

chmod 777

Now run the command tcpdump -vv -i any -s0 -w file_name.pcap

It should work ...!!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.