Following avc's when running tcpdump from ADB shell
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:11): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:12): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:13): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:14): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:15): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:16): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=packet_socket permissive=0
12-16 20:45:20.290 4269-4269/? W/tcpdump: type=1400 audit(0.0:17): avc: denied { create } for scontext=u:r:shell:s0 tcontext=u:r:shell:s0 tclass=netlink_socket permissive=0