:: krowemoh

Tuesday | 11 NOV 2025
Posts Links Other About Now

previous
next

2025-11-08
Using tcpdump

reverse-engineering, sysadmin

tcpdump is a command line tool to capture network traffic on an interface. To run it as a regular user requires enabling some extra capabilities.

sudo yum install tcpdump libcap

Then you grant the tcpdump binary the following caps:

sudo setcap cap_net_raw,cap_net_admin+ep /usr/sbin/tcpdump

Now a regular user can use tcpdump with:

tcpdump -i eno8303 -n -A "port 1234" -w ./Capture.pcap

This is a bit dangerous so to turn of the capabilities later:

sudo setcap -r /usr/sbin/tcpdump