Re: Capturing without having superuser rights

[Jesse Kempf <kempf () rpi edu>]

Guy Harris wrote:
> On Oct 14, 2008, at 9:30 AM, Max Laier wrote:
>
> > Depends on the platform you are on.  On FreeBSD all you need is read 
> > write
> > permission to the /dev/bpf* devices.
>
> Also true in NetBSD, OpenBSD, DragonFly BSD, Mac OS X, and, I think, 
> AIX.  (And, at least with some versions of libpcap, all you need is 
> read access if you're just capturing.)
For what it's worth, I have systems that are set up with devfs rules 
(this is on FreeBSD) that grant the group read rights, and assign 
/dev/bpf* to a group called "bpfreaders". This setup has been running in 
production for most of the year.

Cheers,
-Jesse
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.