# Use packetbeat without root

**URL:** https://discuss.elastic.co/t/use-packetbeat-without-root/97679
**Category:** Beats
**Tags:** packetbeat
**Created:** [August 20, 2017, 8:29am UTC](https://discuss.elastic.co/t/use-packetbeat-without-root/97679 "2017-08-20T08:29:43Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![twitoomer](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@twitoomer](https://discuss.elastic.co/u/twitoomer)
#### Post date: [August 20, 2017, 8:29am UTC](https://discuss.elastic.co/t/use-packetbeat-without-root/97679/1 "2017-08-20T08:29:43Z")

</div>

Hi,  
In my company, the Linux based servers are restricted and we don't have root privileges, therefore, I cannot start Packetbeat. The error I get is: Error creating sniffer: any: You don't have permission to capture on that device (socket: Operation not permitted)

My questions are:  
(1) Is there a way to run Packetbeat without root account?  
(2) What access do I need to request in order to be able to run Packetbeat? I will not get a root account, but I can submit a request to authorize my application account to get permissions to a specific location / file.

Thanks in advance,  
Omer.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [August 20, 2017, 6:58pm UTC](https://discuss.elastic.co/t/use-packetbeat-without-root/97679/2 "2017-08-20T18:58:08Z")

</div>

In order to capture traffic, packetbeat requires root or at least the CAP\_NET\_RAW capability (maybe CAP\_NET\_ADMIN as well). Capabilities can be added using `setcap`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 17, 2017, 6:59pm UTC](https://discuss.elastic.co/t/use-packetbeat-without-root/97679/3 "2017-09-17T18:59:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
