[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Mar 12, 2004 at 07:36:56PM -0800, Justin Walker wrote:
> As the error message tells you, check to make sure you have sufficient 
> permissions.  Are you running as root?  In order to open the packet 
> filter devices (bpfn), you have to either be the owner, be root, or the 
> permissions have to be set so that "other" can read them (which is not 
> recommended).  Since these devices are generally owned by root (and 
> it's not recommended to change that),

Why not?  The first time I run Ethereal or tcpdump on OS X, I do

	sudo chown {my login name} /dev/bpf*

and if OS X had a devfs based on the new FreeBSD 5.x one, I'd recommend
configuring it to create the BPF devices owned by the main user of the
machine.  I've also chowned the BPF devices on my FreeBSD partitions
(neither of which are 5.x, so the chown persists).

That way, I don't have to run tcpdump or Ethereal/tethereal with root
privileges, and don't have to chown capture files once I'm finished
capturing to them.