diff -Nru tcpdump-4.9.3/debian/changelog tcpdump-4.9.3/debian/changelog
--- tcpdump-4.9.3/debian/changelog	2023-02-10 11:34:14.000000000 +0000
+++ tcpdump-4.9.3/debian/changelog	2024-02-08 13:08:41.000000000 +0000
@@ -1,3 +1,11 @@
+tcpdump (4.9.3-4ubuntu0.3) focal; urgency=medium
+
+  * debian/usr.sbin.tcpdump: allow read/write to .cap and .pcapng files
+    along with a permission to the .pcap, .pcapng, .cap files followed by
+    a numeric suffix required by the -W parameter (LP: #2052493)
+
+ -- Georgia Garcia <georgia.garcia@canonical.com>  Thu, 08 Feb 2024 10:08:41 -0300
+
 tcpdump (4.9.3-4ubuntu0.2) focal; urgency=medium
 
   * debian/usr.sbin.tcpdump: allow tcpdump printing to stdout/stderr when
diff -Nru tcpdump-4.9.3/debian/usr.sbin.tcpdump tcpdump-4.9.3/debian/usr.sbin.tcpdump
--- tcpdump-4.9.3/debian/usr.sbin.tcpdump	2023-02-10 11:34:14.000000000 +0000
+++ tcpdump-4.9.3/debian/usr.sbin.tcpdump	2024-02-08 13:08:41.000000000 +0000
@@ -54,6 +54,12 @@
 
   # for -r, -F and -w
   /**.[pP][cC][aA][pP] rw,
+  /**.[pP][cC][aA][pP][nN][gG] rw,
+  /**.[cC][aA][pP] rw,
+  # -W adds a numerical suffix
+  /**.[pP][cC][aA][pP][0-9]* rw,
+  /**.[pP][cC][aA][pP][nN][gG][0-9]* rw,
+  /**.[cC][aA][pP][0-9]* rw,
 
   # for convenience with -r (ie, read pcap files from other sources)
   /var/log/snort/*log* r,