Wireshark · Ethereal-users: Re: [Ethereal-users] capture preferences

["Guy Harris" <gharris@xxxxxxxxx>]

LEGO said:
> If you're doing it as a non priviledged user, you probably have no
> read access to /dev/bpf*,

The error she got was from the DLPI libpcap code, not the BPF libpcap
code, so the permissions on the BPF devices wouldn't matter.  DLPI
probably also requires root privilege, but it might not.

It also gives the error code in hex, which means it's probably an old
version of libpcap.

She might want to install a newer version of libpcap - which will, by
default, use BPF rather than DLPI on AIX, as it appears to be more
reliable.  That won't fix the read access problem, though.

> BEWARE that it is better to change the permissions of /dev/bpf so that
> the group your capturte user belongs can read from /dev/bpf*.

Unfortunately, as the BPF devices are destroyed on a reboot and created
after the reboot, changing the permissions doesn't persist across a
reboot.  (And, with sufficiently recent versions of libpcap, libpcap will
create them, so the first time you run a program using libpcap, it has to
be run as root, so it has enough permission to create the files.)