[Bro] What am I doing wrong here?

[Robin Sommer]

On Wed, Nov 29, 2006 at 11:12 -0600, David Caldwell wrote:

> bro.rc: Running as non-root user bro
[...]
> /usr/local/bro/bin/bro: problem with interface eth1 - pcap_open_live:  
> socket: Operation not permitted

On Linux you need to be root to capture packets[1]

Robin

[1] Hack the kernel: http://www.icir.org/robin/patches/capture_group.html

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org