ERROR: Can't start DAQ

[Dan Roberts <danroberts2604 () gmail com>]

Hi guys,

My snort configuration works pretty well as long as I run it as root during
my test.

But for some obvious reason, I want now put it in prod and run it as user
"snort", using the options " -u snort -g snort ".

This is where I get

--= Initializing Snort =--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
ERROR: Can't start DAQ (-1) - socket: Operation not permitted!
Fatal Error, Quitting...

I've googled around a bit, without success.

It has surely something to do with some missing rights.....

Do you have any idea ? Does user "snort" have some specific rights ?

Your help would be highly appreciated ;-)

Thanks

Dan

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!