Michael Shriver Senior Computer Specialist - College of the Environment

How To Enable Users to Capture Packets

This is a two-step process: You need to give tcpdump permission and capability to allow raw packet captures and network interface manipulation.

Add a capture group and add yourself to it:

sudo groupadd pcap
sudo usermod -a -G pcap $USER

Next, change the group of tcpdump and set permissions:

sudo chgrp pcap /usr/sbin/tcpdump
sudo chmod 750 /usr/sbin/tcpdump

Finally, use setcap to give tcpdump the necessary permissions:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump

Be careful, that this will allow everybody from the group pcap to manipulate network interfaces and read raw packets!