Documenting here for posterity, since I didn’t find much information about it on the ‘net:
Disclaimer: I’m not a network head, just an amateur who dabbles with it when he needs to fix a problem.
Given one Ninjabox (the nickname for packet capture boxes from Endace) with a DAG card (some kind of custom packet capture network card from the same company), you could get the following error when trying to use tcpdump on the dag interface:
tcpdump: dag_attach_stream: Permission denied
lsof | grep dag0
. In my case it was softflowd.
But even after killing the softflowd process, I was getting the same
error message. I had to reset the card using the following commands:
/etc/init.d/dag_drivers_load stop
/etc/init.d/dag_drivers_load start
Off topic minirant: why use custom hardware / software? In my experience they almost never deliver the performance they promise and are hard to troubleshoot because of lack of information.