Packet capture in Snort

Let’s take a brief look at how the packet capture functionality was implemented before DAQ was introduced (before Snort 2.9) and compare it to how this functionality is implemented in Snort 2.9.

Before DAQ

If we look at the Snort 2.8 code base, we can see that the packet capture functionality was ingrained within the Snort code, and it was not abstracted out as we have currently. This created unnecessary complexity and limitations in the Snort code. Let’s take a look at the following code snippet from the SnortMain() function:

int SnortMain(int argc, char *argv[])
{
..
#ifdef GIDS
    if (InlineMode())
    {
#ifndef IPFW
        IpqLoop();
#else
        IpfwLoop();
#endif
    }
    else
    {
#endif /* GIDS */
        DEBUG_WRAP...