Tcpdump capture redirected to a file doesn't work

Question

Hi to all, 
 First, I don't know where I have got to post this... If the administrator wants to move this post, feel free to move it.... 
 I need to do a packet capture with the tcpdump and analyze it with wireshark, when I try to run this command in the Advance Shell: 
 <tcpdump -w /tmp/data/tcpdump.pcap -ni ipsec0 host X.X.X.X> 
 the console return to me "Operation not allowed"... 
 Anybody know why??? 
 I have red some post and kb in the community and ever the console returns the same... The appliance is an XG210 with the SFOS 16.5.MR1. 
 Thanks to all in advance 
 Regards, 
 David

HuberChristian · Answer

After a quick discussion with Sophos support, they gave me the following hint how it works even on XG Firewall: 
 # tcpdump -i Port4 -n host 8.8.8.8 -X -w /tmp/log.pcap -b 
 The -b at the end is important and seems to be a Sophos-proprietary Parameter. -b in Manpage means "Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN notation." what definitely has nothing to do with our -b in Sophos's world...

LuCar Toni · Answer

Hi, 
 
 you need first to check your interface name convention. 
 ifconfig 
 Maybe your Port is called PortA or Port4 or PortA4 ? 
 (we are talking about the Advanced Shell - 5 - 3, not console!) 
 
 So you use: 
 tcpdump -ni Port4 host 8.8.8.8 -b -s0 -w /tmp/log/pcap 
 
 After you have done you work, you can copy your files via SCP: 
 https://community.sophos.com/kb/en-us/127647 
 
 Cheers

lferrara · Answer

Try with the classic linux output: 
 tcpdump -n -i Port2 host x.x.x.x >> /tmp/file.pcap 
 I confirm the same behaviour with classic "-w" 
 It should be a bug. 
 sachingurung can you confirm it that is a bug and redirect the info to developers? 
 Thanks

sachingurung · Answer

Hi David, 
 This worked in v15 but, I can confirm that -w does not work in v16. I am not sure if that is a backend glitch or a new change. A hassle free way to capture tcpdump is to execute the command: tcpdump filedump 'host xx -s0" in the Console. 
 Thanks