Wireshark-users: Re: [Wireshark-users] dumpcap/tshark permissions on created pcap files
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: luke devon <luke_devon@xxxxxxxxx>
Date: Thu, 17 May 2018 05:48:09 +0000 (UTC)
Hi Guy , 

Yes, It works. Thank you so much for the help. 

Br
Luke.

On Thursday, 17 May 2018, 1:26:43 PM GMT+8, Guy Harris <guy@xxxxxxxxxxxx> wrote:


On May 16, 2018, at 7:51 PM, luke devon via Wireshark-users <wireshark-users@xxxxxxxxxxxxx> wrote:

> How can I fix this ?

Run

    chmod o+r Test_00003_20180517095317.pcap

as root to give "other" read permission on the file.


> what is the root cause for it ?


You ran dumpcap as root (or you ran tshark as root, and *it* ran dumpcap, so dumpcap also ran as root), so the file it creates is owned by root, group root, and root probably has a umask of 0026 or 0027, so, by default, files are created with group write permission, and *all* other permissions, turned off.