Snort 2.9 Essentials: The DAQ
Summary: The Snort 2.9 Beta introduces the Data AcQuisition library (DAQ), an abstraction layer that replaces direct calls into packet capture libraries like PCAP with pluggable modules selected at run-time. DAQ 0.1 supports PCAP, AFPACKET, NFQ, IPQ, IPFW, and DUMP, and by default Snort is built with static DAQ modules including PCAP, AFPACKET, and DUMP.
Why it matters: The DAQ lets an operator switch Snort from passive to inline mode without recompiling the core, and AFPACKET support lets you stand up an inline sensor without working through iptables and queue setup - so the barrier to running inline detection drops to a command-line change.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026