0

I was running tcpdump and then after some time I got this error:

tcpdump: (all BPF devices are busy)

I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, but it did not fix it.

Improve this question

1 Answer 1

Reset to default
0

This isn't realy an infosec question, but did you wait long after killing the processes? In most code this is for the reason it describes - there's not a handle ... honestly, sometimes at that point a reboot is quicker than debugging the 'why' if it's a machine where you can do so, did you do so?

can you ls /dev/bpf* on your host (if that's where they show up? ) For those, have you tried grepping lsof output for them ?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .