In order to run a raw capture with PF_RING, you need to run as privileged user or set the proper capabilities to the application.
PF_RING used to check the CAP_SYS_ADMIN capability, however since kernel 3.8 the CAP_SYS_RAW capability is required.
Example on latest kernels:
sudo setcap cap_net_raw+eip /usr/bin/pfcount
On kernel <3.8:
sudo setcap cap_net_admin+eip /usr/bin/pfcount
If you are using ZC drivers, CAP_IPC_LOCK and CAP_SYS_ADMIN are also required:
sudo setcap cap_net_raw,cap_ipc_lock,cap_sys_admin+eip /usr/bin/pfcount
Note: if your application is not capturing from a ZC interface directly (e.g. it is capturing from a ZC queue created by zbalance_ipc), the CAP_SYS_ADMIN capability is not required.
If you are running an application based on the PF_RING ZC API (e.g. zcount), hugepages permissions are also required. A common practice to create a group for hugepages users and set the GID when mounting the hugetlb mountpoint:
mount -t hugetlbfs -o gid=1002 nodev /dev/hugepages
Please note that you can set the GID in the pf_ring hugepages configuration file to automatically mount the hugetlb filesystem with the right permissions:
echo "node=0 hugepagenumber=1024 gid=1002" > /etc/pf_ring/hugepages.conf
Please also note that the a ZC application using hugepages, needs to translate virtual addresses to physical addresses. For this reason it needs to access /proc/self/pagemap, however on some kernel versions (e.g. 4.0 and 4.1) opening this file by unprivileged processes leads to failures with -EPERM for security reasons, while on other kernels the CAP_SYS_ADMIN capability is usually enough.