guyharris
commented
11 years ago That's a configuration option at build time, set with --with-chroot=DIRECTORY, and is off by default.
Perhaps we need a preprocessor of some sort for tcpdump.1.in, fancier than what we're using now (sed), to let us conditionally include, for example, a description of the behavior when tcpdump is run as root.
/me wondering where the feature is mentioned that the parameter "-w" writes to /var/lib/tcpdump rather than to the current dir/specified full file name (FWIW I'm not the only one who might overlooked this, a Gentoo users had to strace'ed this : http://forums.gentoo.org/viewtopic-p-7278188.html#7278188 )