tcpdump 报socket: Operation not permitted

排查过程

~ # id
uid=0(root) gid=0(root) groups=0(root)
~ # which tcpdump
/usr/sbin/tcpdump
~ # ls -l $(which tcpdump)
-rwsr-xr-x 1 1001 1001 1265360 Nov 13 2025 /usr/sbin/tcpdump
~ # getcap $(which tcpdump) 2>/dev/null
~ #~ # chown root:root /usr/sbin/tcpdump

~ # chmod 755 /usr/sbin/tcpdump
~ # ls -l $(which tcpdump)
-rwxr-xr-x 1 root root 1265360 Nov 13 2025 /usr/sbin/tcpdump