“tcpdump -w 1.pcap” works, but “tcpdump -C 100 -w 1.pcap” - permission denied

Question

I need to limit file size when I run \"tcpdump -w 1.pcap\". I try to do this with the key \"-C\", but when I add it I get error \"permission denied\". So:

&g         


        

Answer 1

I experienced similar problems when I tried to read from file, like

tcpdump -r example.cap 'icmp[icmptype] = icmp-echo'

For me AppArmor caused the problem I had to switch from 'enforcement' mode to 'complain' mode on 'tcpdump'. Run the following command as root:

aa-complain /usr/sbin/tcpdump