Packet capture without root every time

tcpdump needs root because it opens a raw socket. Reaching for sudo every time is tedious, and chmod u+s is worse — any user could capture the whole box.

Capabilities are the middle ground:

setcap cap_net_raw,cap_net_admin=eip /usr/bin/tcpdump

Package upgrades may drop the attributes; reapply after upgrading.

The other option is dumpcap from Wireshark, which separates privileges: capture runs elevated, parsing and writing run as the user. On production, bound the capture with -C 100 -W 5 so it cannot fill the disk.