The problem was I didn't compile it with pcap support initially (it is not enabled by default). It needs: make USE_CAP=yes Then it showed "=ep" for every proc

The problem was I didn't compile it with pcap support initially (it is not enabled by default). It needs: make USE_CAP=yes Then it showed "=ep" for every process BUT your patch fixed it and now it correctly lists process capabilities. According to man, capgetp() is deprecated and cap_get_pid() should be used instead anyway. EDIT: I can see your patch merged upstream, good work! :)