4

I want to capture UDP packages sent by an FPGA with ~10 Gbit/s bandwidth. I found that tcpdump combined with a fast SSD is perfectly capable of receiving a continuous 10 Gbit/s stream and storing it on disk without loss.

When I run sudo tcpdump, everything works as expected.

However, I need to be able to run tcpdump without sudo. Without sudo I get this error:

tcpdump: enp4s0f0: You don't have permission to capture on that device
(socket: Operation not permitted)

Here is what I found and tried so far to enable tcpdump without sudo:

sudo su
groupadd pcap
usermod -a -G pcap $USER
chgrp pcap /usr/sbin/tcpdump
chmod 750 /usr/sbin/tcpdump
setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Proposed solution from here

According to the various pages that list this solution, this should give my regular user account the possibility to run tcpdump, right?

However, when I switch to my regular user account and run tcpdump, I get this:

bash: /sbin/tcpdump: Permission denied

(note that this error message is different compared to the initial error message)

I've verified via getent group pcap that my account is part of the pcap group. I've also verified that /sbin/tcpdump is owned by the group pcap. What am I missing?

Christian Disch
  • 61
  • 4

1 Answers1

2

After some experimenting, here is what finally worked for me:

sudo visudo

at the very END* of the sudoers file, enter this:

your_username ALL = NOPASSWD: /usr/sbin/tcpdump

(replace your_username with your username, write the changes to disk close the editor)

open a new terminal and run sudo tcpdump. It no longer asks for a password.

*putting the new rule at the end avoids that it might be overwritten by other rules.

Christian Disch
  • 61
  • 4