In short, raw sockets are limited by the root, because otherwise it will violate other rules for networks that are in place.
The long rule is that you cannot bind to a port below 1024 without a root blessing. With raw sockets, you can simulate a server on any port. (Naturally, the ability to receive on this port is another story that you would also need to sniff on the network, but perhaps this can be done using another machine.)
source share