[root@localhost ~]# cat /etc/issue
Fedora release 17 (Beefy Miracle)
Kernel \r on an \m (\l)
[root@localhost ~]# uname -a
Linux localhost.localdomain 3.6.10-2.fc17.i686 #1 SMP Tue Dec 11 18:33:15 UTC 2012 i686 i686 i386 GNU/Linux
[root@localhost ~]# tcpdump -i p3p1 -n -w out.pcap -C 16
tcpdump: out.pcap: Permission denied

Why I get error??

What should I do?

7 Answers 7


i tried on Centos 5, still the same even on tmp or root folder. from the tcpdump man page, privileges are dropped when used with -Z option (enabled by default) before opening first savefile. because you specified "-C 1", the permission denied occur because of the file size already reached 1, and when create new file it will raise an permission denied error. so just specify the -Z user

# strace tcpdump -i eth0 -n -w out.pcap -C 1
fstat(4, {st_mode=S_IFREG|0644, st_size=903, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aea31934000
lseek(4, 0, SEEK_CUR)                   = 0
read(4, "root:x:0:root\nbin:x:1:root,bin,d"..., 4096) = 903
read(4, "", 4096)                       = 0
close(4)                                = 0
munmap(0x2aea31934000, 4096)            = 0
setgroups(1, [77])                      = 0
setgid(77)                              = 0
setuid(77)                              = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\0\0\0\0\0\0\310\357k\0\0\0\0\0", 16) = 0
fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0

recvfrom(3, 0x7fff9563d35f, 1, 32, 0, 0) = -1 EAGAIN (Resource temporarily unavailable)
fcntl(3, F_SETFL, O_RDWR)               = 0
setsockopt(3, SOL_SOCKET, SO_ATTACH_FILTER, "\1\0\17\0\0\0\0\0P\327\233\7\0\0\0\0", 16) = 0
open("out.pcap", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
write(2, "tcpdump: ", 9tcpdump: )                = 9
write(2, "out.pcap: Permission denied", 27out.pcap: Permission denied) = 27
write(2, "\n", 1
)                       = 1
exit_group(1)                           = ?

you can see the strace result above, tcpdump dropped the privileges into user and group pcap (77).

# grep 77 /etc/group
# grep 77 /etc/passwd

From tcpdump man page, -C

# man tcpdump
       -C     Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so,
              close the current savefile and open a new one.  Savefiles after the first savefile will have the name  specified
              with  the -w flag, with a number after it, starting at 1 and continuing upward.  The units of file_size are mil-
              lions of bytes (1,000,000 bytes, not 1,048,576 bytes).

              **Note that when used with -Z option (enabled by default), privileges are dropped before opening first savefile.**

# tcpdump --help
tcpdump version 3.9.4
libpcap version 0.9.4
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
                [ -W filecount ] [ -y datalinktype ] [ -Z user ]
                [ expression ]

Specify specific user with -Z user

# tcpdump -i eth0 -n -w out.pcap -C 1 -Z root
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
35 packets captured
35 packets received by filter
0 packets dropped by kernel     

When I ran into this Permission denied issue it turned out to be that I was putting a .cap extension on the file instead of .pcap. As RichL pointed out in the comments, AppArmor profile on Ubuntu /etc/apparmor.d/usr.sbin.tcpdump causes this.

  # uname -a ; lsb_release -a
  Linux bidder-lb4 3.2.0-76-virtual #111-Ubuntu SMP Tue Jan 13 22:33:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 12.04.5 LTS
  Release:        12.04
  Codename:       precise
  • 7
    It turns out the AppArmor profile for Ubuntu (/etc/apparmor.d/usr.sbin.tcpdump) only allows the tcpdump binary to write to files with a .pcap extension. AppArmor is on by default in Ubuntu, which caught me out.
    – Rich L
    Dec 3, 2015 at 16:05
  • Thank you, kind man! I've had hard time trying to get why is changing extension of the output file gives a permission denied error. And when you move to the home directory, dependency on the extension suddenly disappears.
    – Trolzen
    Jul 27, 2021 at 12:01
  • 1
    @RichL For me, I was able to write to packet.dump on ubuntu 20.04, but I was not able to read from it until I changed the extension. 🤦‍♂️
    – weberc2
    Nov 11, 2021 at 0:58

Try to run the command from /tmp or any other world writable directory. I remember having issues with tcpdump in directories which are not world writable, I have no clue why -:)

         cd /tmp
         tcpdump -i p3p1 -n -w out.pcap -C 16 

Your tcpdump is dropping privileges to the 'tcpdump' user, check the man page ("-Z tcpdump" is the default, and the tcpdump user doesn't have permissions to write in root's homedir). As Daniel T. told you, run your capture in a world-writable directory like /tmp, or at least a directory where you've given either the user or group 'tcpdump' write permissions.


Is SELinux running? Check by typing is terminal:


If it says Enforcing, you can try disabling SELinux and trying the tcpdump again, to see if SE was stopping it.

  • @Hauke Laging From his bash output, it seems he is running the command from root's home dir. Feb 14, 2013 at 2:48

The error message doesn't make much sense to me. SELinux is a possible explanation, though. You may have a closer look at what's happening by starting tcpdump through strace:

strace tcpdump -i p3p1 -n -w out.pcap -C 16

you should change the mode of directory under which you are running tcpdump .

chmod 777

Now run the command tcpdump -vv -i any -s0 -w file_name.pcap

It should work ...!!

  • 1
    For certain values of 'work'. You now have a directory which includes the packet capture which may well contain exposed sensitive data within, readable by anyone with access to the host. "Hey doctor, I have a hangnail" should not be answered with amputation, no matter how completely that solves the hangnail problem.
    – DopeGhoti
    Feb 23, 2018 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.