I've seen people run into situations where they were using a command like this:
tcpdump -i eth0 -G 500 -w /root/%H%M%S.pcap
The first file would be created successfully but the second file would not
because their version of tcpdump was dropping privs. It was unclear to them
that this was going on and was causing confusion.
At least with this message in there it should become more evident that
privs are being altered and aid in debugging these kinds of problems.
pcap_strerror(errno));
exit(1);
}
+ else {
+ printf("dropped privs to %s\n", username);
+ }
#endif /* HAVE_CAP_NG_H */
}
else {