[Snort-users] ERROR: Can't start DAQ
danroberts2604 at ...11827...
Tue Mar 31 11:22:29 EDT 2015
My snort configuration works pretty well as long as I run it as root during
But for some obvious reason, I want now put it in prod and run it as user
"snort", using the options " -u snort -g snort ".
This is where I get
--= Initializing Snort =--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
ERROR: Can't start DAQ (-1) - socket: Operation not permitted!
Fatal Error, Quitting...
I've googled around a bit, without success.
It has surely something to do with some missing rights.....
Do you have any idea ? Does user "snort" have some specific rights ?
Your help would be highly appreciated ;-)
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users