# [solved] tcpdump doesn't produce a pcap file

## toralf

```
# tcpdump -w test.pcap -i ppp0 -c 2

tcpdump: listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes

2 packets captured

6 packets received by filter

0 packets dropped by kernel

# ls -l

total 0

# eix -I tcpdump

[I] net-analyzer/tcpdump

     Available versions:  3.9.8 3.9.8-r1 ~4.1.1 ~4.2.0 ~4.2.1 4.3.0 {(+)chroot ipv6 (-)samba smi ssl suid test}

     Installed versions:  4.3.0(07:39:32 PM 02/01/2013)(chroot ipv6 ssl test -samba -smi -suid)

     Homepage:            http://www.tcpdump.org/

     Description:         A Tool for network monitoring and data acquisition

```

What I'm missing ?Last edited by toralf on Thu Mar 28, 2013 8:54 pm; edited 1 time in total

----------

## papahuhn

chroot on? Look in /var/lib/tcpdump. Wasn't aware of this feature until now.

----------

## toralf

 *papahuhn wrote:*   

>  Look in /var/lib/tcpdump.

 gah - does the man page mentioned this location ?

----------

## papahuhn

No, I strace'd it.

----------

## toralf

 *papahuhn wrote:*   

> No, I strace'd it.

  :Very Happy:  thx

----------

