Snort

External DAQ Modules

Have you ever wanted to maintain your own DAQ module outside of the official LibDAQ distribution? Concerned about the official release cycle in relation to your own development? Tired of keeping a source patch for the official distribution up-to-date?

External DAQ Module examples

These two tarballs are to demonstrate the suggested process for externalizing the DAQ module build process. Example-daq-module-0.1.tar.gz is a bare bones example DAQ module and the autotools to support it.

The basic steps involved in taking example-daq-module and making it your own are:

• 1. Unpack example-daq-module-0.1.tar.gz
• 2. Rename daq_example.c to daq_.c
• 3. Implement all of the function stubs in the C file
• 4. Update configure.ac and Makefile.am to reflect your name change (%s/example//g)
• 5. Add any additional autoconf-foo you want to configure.ac (arguments, header checks, library checks, etc)
• 6. Regenerate the autoconf files with 'autoreconf -ivf'
• 7. Configure, make, and make install!

The only caveat with this process is that you cannot include your DAQ module with the static DAQ modules when building externally. This should not be an issue for the majority of users.

PFRING External DAQ

Made popular by Luca Deri, Sourcefire's Michael Altizer ported Luca's PFRING DAQ Module to the above framework.

Napatech External DAQ

To build this requires the Napatech ntcommoninterface library, which is bundled with the purchase of each adapter. This is NOT a Sourcefire used or produced product, and support questions should be directed to Randy Caldejon. PCAP Express adapters are just branded Napatech OEM adapters sold by nPulse Technologies to end-users.

PCAPRR External DAQ

PCAPRR can be used to read from multiple network interfaces in cases where those interfaces can not be bonded together (e.g. when using Endace cards). To build this requires libpcap library. This is NOT a Sourcefire used or produced module, and support questions should be directed to Jeff Murphy.