tshark: The file to which the capture would be saved ("xxxx.pcap") could not be opened: Permission denied.

tshark: The file to which the capture would be saved ("xxxx.pcap") could not be opened: Permission denied.

This tutorial describes how to fix tshark: The file to which the capture would be saved ("xxxx.pcap") could not be opened: Permission denied. I doing some research with tshark on Linux. While starting my research i get stuck with error Permission denied unable to redirect the wireshark output into file.

I was running tshark in root. It is the most privileged account in Linux even though i got the same error message  tshark: The file to which the capture would be saved ("xxxx.pcap") could not be opened: Permission denied.

Error:-

  tshark: The file to which the capture would be saved ("xxxx.pcap") could not be opened: Permission denied.

Solution:-

Redirect the output other than / root. What i did, I just create a folder called capture on /home/.

[root@syslog ~]# mkdir -p /home/capture

Run the capture again capture the packet on different path.

[root@syslog ~]# sudo tshark -i ens192 -w /home/capture/mycapt.pcap  Running as user "root" and group "root". This could be dangerous.
Capturing on 'ens192'
96 ^C
[root@syslog ~]# ls -alFh /home/capture/
total 16K
drwxr-xr-x. 2 root root  25 Nov 12 12:58 ./
drwxr-xr-x. 5 root root  53 Nov 12 12:58 ../
-rw-------. 1 root root 13K Nov 12 12:59 mycapt.pcap