[Bro] What am I doing wrong here?

Jean-Philippe Luiggi jp.luiggi at free.fr
Wed Nov 29 11:32:25 PST 2006


Hello David,

You've a problem with permissions, Robin responded about this problem in
August.
Here's the response :

=======
> at last,have a error message:problem with eth0 - pcap_open_live:socker:Operation not permitted

You don't have sufficient privileges to capture packets. I presume
this is Linux? Then you need to run Bro as root (or apply a kernel
patch: http://www.icir.org/robin/patches/capture_group.html)

Robin
======

Best regards.


On Wed, Nov 29, 2006 at 11:12:12AM -0600, David Caldwell wrote:
> Here is what I get when I try to start Bro from the command line:
> 
> jyd:/etc/rc3.d# /etc/init.d/bro.rc start
> bro.rc: Running as non-root user bro
> No directory, logging in with HOME=/
> bro.rc: Starting ..........bro.rc: Failed to start Bro
> /usr/local/bro/bin/bro: problem with interface eth1 - pcap_open_live:  
> socket: Operation not permitted
> . FAILED
> 
> here are the outputs in the logs files in /usr/local/bro/logs:
> 
> /usr/local/bro/bin/bro: problem with interface eth1 - pcap_open_live:  
> socket: Operation not permitted
> 
> Am I missing a permission issue here or what? Do I need to make some  
> changes in a config file that I missed?
> 
> TIA
> 
> David Caldwell
> Colsa-HMT
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



More information about the Bro mailing list