The Snort 3 implementation of the DAQ layer
The DAQ layer abstraction separates out the logic of packet acquisition and the related functions into the DAQ library – libdaq. This library is available as a separate package from Snort. The libdaq library essentially consists of two parts – namely, the libdaq API and libdaq modules. All the DAQ library API functions can be found in the api directory (for example, libdaq-3.0.5/api/), whereas all the code for various DAQ modules can be found in the modules directory (for example, libdaq-3.0.5/modules). In the subsequent sections, we will examine these two DAQ library parts.
The DAQ library API
The DAQ Library API is a set of functions that can be called by Snort (or similar programs) without knowing the internal details of how the DAQ module is implemented. These APIs are grouped by their purpose:
- Loading, unloading, and handling functions: This set of DAQ API functions deals with the loading, unloading, and handling...
