[Snort-users] ERROR: Can't start DAQ

Dan Roberts danroberts2604 at ...11827...
Tue Mar 31 11:22:29 EDT 2015

Hi guys,

My snort configuration works pretty well as long as I run it as root during
my test.

But for some obvious reason, I want now put it in prod and run it as user
"snort", using the options " -u snort -g snort ".

This is where I get

--= Initializing Snort =--
Initializing Output Plugins!
pcap DAQ configured to passive.
Acquiring network traffic from "eth0".
ERROR: Can't start DAQ (-1) - socket: Operation not permitted!
Fatal Error, Quitting...

I've googled around a bit, without success.

It has surely something to do with some missing rights.....

Do you have any idea ? Does user "snort" have some specific rights ?

Your help would be highly appreciated ;-)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150331/2df13c04/attachment.html>

More information about the Snort-users mailing list