monline

The referenced page describes that a potential reason for a "permission denied" message while trying to run tcpdump can come from Ubuntu's apparmor profiles. The syslog will contain something like this (if you run tcpdump with the "-r" switch to read from a packet capture dump):

You can check the apparmor profile here: /etc/apparmor.d/usr.sbin.tcpdump
The reason for the above error message was the filename ... the apparmor profile grants read permission only on files with the ".pcap" extension. Simply renaming the file solved my problem. However if you really have to work around something in the profile, you can add your own rules to /etc/apparmor.d/local/usr.sbin.tcpdump which is included in the main profile at the end (thus you can override everything that was set in the main profile).

P.S.: if you just want to disable the apparmor profile, check you this other post on the same blog.