Summary

Data acquisition is one of the primary and critical functionalities in the Snort architecture. This functionality also contributes directly to the performance of the entire system. We discussed the essential functionality of the DAQ layer and the module’s performance aspects. We looked at how this functionality was implemented in Snort before the DAQ module was incorporated (in Snort 2.9), and we also looked briefly at the Snort 2.9 implementation of DAQ. Finally, we delved into DAQ functionality within Snort 3, and we discussed both the API side of DAQ and the various modules of DAQ that are currently supported.

In the next chapter, we will discuss the Codec module and its role in Snort IDS/IPS.