The functionality of the DAQ layer
The main functionality of the DAQ layer is to facilitate the delivery of network packets from the network to Snort, and facilitate the transmission of packets back to the network when appropriate. Let’s discuss each of these functionalities:
- Facilitate the delivery of packets from the network to Snort for analysis:
This functionality is the most basic feature required for any system that inspects network traffic and performs analysis. For example, it is necessary for programs such as tcpdump and basic intrusion detection systems.
The DAQ library provides a layer of abstraction for the packet capture-related function calls, which leads to the simplification of code at the Snort level. Snort code does not need to know about the details of any specific packet capture mechanism. The DAQ layer implements a set of necessary functions as an API, which is invoked at the Snort level.
DAQ is implemented as a library component and a module component...
