[Bro] Nodes still crashing/Site specific files

Siwek, Jonathan Luke jsiwek at illinois.edu
Fri Jun 14 08:24:59 PDT 2013

On Jun 14, 2013, at 9:57 AM, "Richards, James L - DOA" <James.Richards at wisconsin.gov> wrote:

> I ran ./configure --prefix=/usr/local/bro --with-pcap=/usr/local/pfring
> Then make, make install, chown -R etc.
> It is no longer giving me the libpcap in diag, but I am now getting:
> fatal error: /usr/local/bro/bin/bro: problem with interface eth4 - pcap_open_live: eth4: You don't have permission to capture on that device (socket: Operation not permitted)

What user were you `chown`ing things to?  You'll have to do something extra for non-root users to be able to capture packets, see [1].

- Jon

[1] http://www.bro.org/documentation/faq.html#how-can-i-capture-packets-as-an-unprivileged-user

More information about the Bro mailing list