tcpdump inside vsever, recommendation

Hello everyone,

I know I can ssh in the host and run tcpdump but I do not want to. So I
need it from the vserver instance.

From

http://linux-vserver.org/Capabilities_and_Flags

I think I can do

echo "NET_RAW" >> /etc/vservers/myserver/bcapabilities

I could not see anything more serious security problems when adding this
(not like NET_ADMIN)  but I am not expert at all. Any comment, suggestions,
idea please?

kind regards,

-- 
Steve Kieu