When tcpdump and tcpdump

When tcpdump and tcpdump

To locate the problem, you need to use tcpdump on Linux and save it to the file. The following problems are encountered:

Tcpdump port 9001-w xx
Tcpdump: xx: Permission denied

Because it is already a root user, it is determined that it is not a file system permission problem.

After checking on the internet, find the solution: Change the tcpdump mode from enforce to complain mode.

The modification process is as follows:

First, check the mode in which it is located:

Grep tcpdump/sys/kernel/security/apparmor/profiles
/Usr/sbin/tcpdump (enforce)

It is not the complain mode.

Change to complain mode:

Aa-complain/usr/sbin/tcpdump
The program 'aa-complain 'is currently not installed. You can install it by typing:
Apt-get install apparmor-utils

If an error occurs, follow the prompts to install apparmor-utils. The process is omitted and then run the following command again:

Aa-complain/usr/sbin/tcpdump
Setting/usr/sbin/tcpdump to complain mode.

View:

Grep tcpdump/sys/kernel/security/apparmor/profiles
/Usr/sbin/tcpdump (complain)

 

Complete

 

Refer:

Tcpdump permission denied: https://ubuntuforums.org/showthread.php? T = 1501339

The page contains many key information:

This is probably caused by AppArmor. You need to switch from 'enabledement 'mode to 'complain 'mode on 'tcpdump '. Run the following command as root:

Code:

Aa-complain/usr/sbin/tcpdump

You can check by running the following command as root:

Code:

Grep tcpdump/sys/kernel/security/apparmor/profiles

You shoshould see (enforce) or (complain). You want it to say (complain ).

 

AppArmor Introduction: http://www.tuicool.com/articles/aeiIzq

 

Linux: Linux 10-6-13-14 3.2.0-85-generic # 122-Ubuntu SMP Tue May 26 16:14:57 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux