What am I doing wrong here?

Zeek
1

Yeap, on Linux systems you have to be root to
open interfaces in promisc mode.

edit etc/bro.cfg like the following:

# User id to install and run Bro under
BRO_USER_ID="root"

regards.