Key components
Snort 3 has gone through an extended incubation period. Based on the Snort 3 project’s design goals, the system was built and finally released to be generally available in January 2021. The main components of Snort 3 are as follows:
- Packet acquisition module (DAQ).
- Codecs (decoding) module.
- Inspectors (preprocessors).
- Detection module (rules engine, Shared Object (SO) rules).
- Alert and logging module.
- Configuration module.
Let us look closely at each of these modules, starting with the Data Acquisition (DAQ) module.
DAQ module
The DAQ module, also known as the Data Acquisition (DAQ) module, is responsible for acquiring the network traffic and providing it to the rest of Snort for analysis. It was first released as part of the Snort 2.9 release. The packet acquisition functionality was fulfilled by the libpcap library for a long time and was later abstracted out into the DAQ layer.
The DAQ module boasts a versatile library...
