Move tcpdump to /system/xbin (instead of /system/bin),
and configure it to shed privileges by default (if running as root)
after binding the socket needed to sniff with.
diff --git a/config.h b/config.h
index 76ba53b..6cc6d75 100644
--- a/config.h
+++ b/config.h
@@ -131,7 +131,7 @@
/* #undef HAVE_NETDNET_DNETDB_H_DNET_HTOA */
/* define if should drop privileges by default */
-/* #undef WITH_USER */
+#define WITH_USER "shell"
/* define if should chroot when dropping privileges */
/* #undef WITH_CHROOT */