Greetings
You're correct the /dev/bpf0,1,2, and 3 files controll access. the permissions on them are cr--r--r-- and ownership is root:system. The user belongs to system and bin groups. Seems to me they should be able to run the command successfully.
Thanks for your reply
Mike Schotten