Snort Forums Archive

Archive Home » General Security Discussion » libipq vs libpcap

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

libipq vs libpcap

Posted by hiteshsharma on December 26, 2006 03:45:23

plz any one tell me waht is differense between libipq and libpcap?
when n where used which one?
thanks

Posted by raps on December 30, 2006 22:59:41

hi,
libpcap is interface for packet capture. The packets go through your device and you can capture them with using libpcap.

Libipq is packet queuing library for iptables.. When the packets come from iptables(netfilter), you can say "stop packet" or pass packets via libipq...

you should use libpcap when snort is ids mode and libipq when using snort ips mode.

Posted by hiteshsharma on January 01, 2007 19:26:25

thanks a lot raps...... :)
Hitesh sharma