Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket".
I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...
Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities?
Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P
Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket".
I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...