Red Hat Bugzilla – Bug 176010
file owner problem when using 'ring buffer mode
Last modified: 2007-11-30 17:11:19 EST
Description of problem, bug, incorrect information, or enhancement request:
When using tcpdump ring buffer mode e.g. running as root
tcpdump -n -i eth0 -W 10 -C 1 -w capture
Which creates a ring buffer of 10 capture files of 1 * 1.000.000 bytes.
The first file has root as owner
The second and folowing files have pcap as owners
(Issue number 1. This results in an access failure when capturing inside an root
Issue number 2. When the 10th file is processed tcpdump tries to open the first
file (which has root as the owner) using pcap as user. This also results in an
I have no idea what the default behavior of tcpdump on other
platforms/distribution is regarding ring buffer mode.
Version of release notes this bug refers to:
Fedora Core 4 final release
tcpdump version (rpm -qi tcpdump)
Name : tcpdump Relocations: /usr
Version : 3.8.2 Vendor: Red Hat, Inc.
Release : 13.FC4 Build Date: Wed 08 Jun 2005 10:01:26
Install Date: Fri 17 Jun 2005 08:12:41 PM CEST Build Host:
Group : Applications/Internet Source RPM: tcpdump-3.8.2-13.FC4.src.rpm
Size : 783083 License: BSD
Signature : DSA/SHA1, Mon 13 Jun 2005 04:46:37 PM CEST, Key ID b44269d04f2a6fd2
Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL : http://www.tcpdump.org
Summary : A network traffic monitoring tool.
Tcpdump is a command-line tool for monitoring network traffic.
Tcpdump can capture and display the packet headers on a particular
network interface or on all interfaces. Tcpdump can display all of the
packet headers, or just the ones that match particular criteria.
[root@prodigy ~]# tcpdump --version
tcpdump version 3.8
libpcap version 0.8.3
This is not a release notes flaw. I am reassigning this to the owner of the
You can use "-Z root" directive in FC3/FC4. Fix heads to FC5.
Created attachment 122445 [details]