[Bro] Nodes still crashing/Site specific files

[Siwek, Jonathan Luke]

On Jun 14, 2013, at 9:57 AM, "Richards, James L - DOA" <James.Richards at wisconsin.gov> wrote:

> I ran ./configure --prefix=/usr/local/bro --with-pcap=/usr/local/pfring
> Then make, make install, chown -R etc.
> 
> It is no longer giving me the libpcap in diag, but I am now getting:
> 
> fatal error: /usr/local/bro/bin/bro: problem with interface eth4 - pcap_open_live: eth4: You don't have permission to capture on that device (socket: Operation not permitted)


What user were you `chown`ing things to?  You'll have to do something extra for non-root users to be able to capture packets, see [1].

- Jon

[1] http://www.bro.org/documentation/faq.html#how-can-i-capture-packets-as-an-unprivileged-user