diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 28e80962824..376edc53a19 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -117,10 +117,13 @@ if [[ "$1" == "stack" ]]; then
             if is_service_enabled br-ex-tcpdump ; then
                 # tcpdump monitor on br-ex for ARP, reverse ARP and ICMP v4 / v6 packets
                 sudo ip link set dev $PUBLIC_BRIDGE up
-                if [[ "$os_CODENAME" == "jammy" ]]; then
-                    TCPDUMP=/usr/bin/tcpdump
-                else
-                    TCPDUMP=/usr/sbin/tcpdump
+                TCPDUMP=$(which tcpdump)
+                if [[ ! $TCPDUMP ]]; then
+                    if [[ "$os_CODENAME" == "jammy" ]]; then
+                        TCPDUMP=/usr/bin/tcpdump
+                    else
+                        TCPDUMP=/usr/sbin/tcpdump
+                    fi
                 fi
                 run_process br-ex-tcpdump "$TCPDUMP -i $PUBLIC_BRIDGE arp or rarp or icmp or icmp6 -enlX" "$STACK_GROUP" root
             fi