README.daq

Snort 2.9 introduces the DAQ, or Data Acquisition library, for packet I/O.  The
DAQ replaces direct calls to libpcap functions with an abstraction layer that
facilitates operation on a variety of hardware and software interfaces without
requiring changes to Snort.  It is possible to select the DAQ type and mode
when invoking Snort to perform pcap readback or inline operation, etc.

This README summarizes the important things you need to know to use the DAQ.

See the README in the DAQ tarball for information on building and installing
the DAQ and for information specific to DAQ modules.

See README.active and README.normalize for more information on the other packet
handling changes in 2.9.


Building Snort
==============

If you install the DAQ libraries in a non-standard place, you can configure
Snort accordingly with:

    ./configure --with-daq-includes=<inc dir>
                --with-daq-libraries=<lib dir>

By default, snort will be built with a few static DAQ modules including pcap,
afpacket, and dump.  If you don't want any static DAQ modules built into Snort,
you can use this configure option:

    ./configure --disable-static-daq

pcap is the default DAQ, but you can change that like this:

    ./configure "CPPFLAGS=-DDEFAULT_DAQ=<type>"

You can also do this:

    make "DEFAULT_DAQ=<type>"

If you used --with-libpcap-includes or --with-libpcap-libraries when building
the DAQ, you will also need --with-libpcap-includes and
--with-libpcap-libraries when building Snort.

Note that configure runs daq-modules-config which must be in your PATH.  If you
configured the DAQ with a non-standard prefix then you may need to put that in
your path like this before running configure:

    PATH=/daq/install/prefix:$PATH


Configuring Snort
=================

Assuming that you did not disable static modules or change the default DAQ
type, you can run Snort just as you always did for file readback or sniffing an
interface.  However, you can select and configure the DAQ when Snort is invoked
as follows:

    ./snort \
        [--daq <type>] \
        [--daq-mode <mode>] \
        [--daq-dir <dir>] \
        [--daq-var <var>]

    config daq: <type>
    config daq_dir: <dir>
    config daq_var: <var>
    config daq_mode: <mode>

    <type> ::= pcap | afpacket | dump | nfq | ipq | ipfw
    <mode> ::= read-file | passive | inline
    <var> ::= arbitrary <name>=<value> passed to DAQ
    <dir> ::= path where to look for DAQ module so's

The DAQ type, mode, variable, and directory may be specified either via the
command line or in the conf file.  You may include as many variables and
directories as needed by repeating the arg / config.  DAQ type may be specified
at most once in the conf and once on the command line; if configured in both
places, the command line overrides the conf.

If the mode is not set explicitly, -Q will force it to inline, and if that
hasn't been set, -r will force it to read-file, and if that hasn't been set,
the mode defaults to passive.  Also, -Q and --daq-mode inline are allowed,
since there is no conflict, but -Q and any other DAQ mode will cause a fatal
error at start-up.

Note that if Snort finds multiple versions of a given library, the most recent
version is selected.  This applies to static and dynamic versions of the same
library.

    ./snort --daq-list[=<dir>]
    ./snort --daq-dir=<dir> --daq-list

The above commands search the specified directories for DAQ modules and print
type, version, and attributes of each.  This feature is not available in the
conf.  Snort stops processing after parsing --daq-list so if you want to add
one or more directories add --daq-dir options before --daq-list on the command
line.  (Since the directory is optional to --daq-list, you must use an =
without spaces for this option.)