# Install daemonlogger with Homebrew, apt, MacPorts Network packet logger and soft tap daemon. Version 1.2.1 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:daemonlogger ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install daemonlogger ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install daemonlogger ``` Evidence: MacPorts ports tree: net/daemonlogger/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install daemonlogger ``` Evidence: Debian stable package indexes: daemonlogger from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz ## Package facts - **Package key:** brew:daemonlogger - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.2.1 - **Source summary:** Network packet logger and soft tap daemon - **Homepage:** - **Upstream docs:** - **License:** GPL-2.0-only - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - daemonlogger (cli) - daemonlogger (alias) ## Dependencies - libdnet ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.2.1 - Local data: ok - Upstream repository: https://sourceforge.net/projects/daemonlogger/ - info: No package-manager update timestamp was available. - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage Daemonlogger is a small libpcap-based packet logging and soft-tap daemon. Its package-manager appeal is straightforward: it gives Unix users a dedicated command-line tool for capturing packets to rolling pcap files or forwarding captured traffic out another interface without adopting a larger IDS stack. ### Project history The official README credits Martin Roesch as author and records Sourcefire copyright from 2006-2013, followed by Cisco copyright from 2013-2021. The current official GitHub repository describes itself as the official repository and was created under Cisco-Talos in 2015, after Cisco's Sourcefire acquisition era had folded the tool into Cisco's security tooling orbit. ### Adoption history Daemonlogger's adoption has been strongest in packet-capture and security-operations environments where pcap output, BPF filters, daemon mode, and ring-buffer behavior are enough. Its official README still points users to the daemonlogger-users mailing list, reflecting an older SourceForge-era open-source support pattern. ### How it is used Users run daemonlogger with switches for interface selection, daemonization, BPF filter files, packet-count limits, output paths, ring-buffer pruning, rollover size or time, and soft-tap output. The README explicitly frames its BPF filter syntax as familiar to tcpdump or Snort users. ### Why package nerds care Daemonlogger matters to package nerds because it is a narrow, old-school Unix networking utility: one executable, libpcap/libdnet dependencies, pcap files as the interchange format, and behavior that fits service managers and shell scripts. ### Timeline - 2006: Sourcefire copyright period for Daemonlogger begins. - 2013: Cisco copyright period begins. - 2015: Official Cisco-Talos GitHub repository is created. - 2021: README lists version 1.2.1 and Cisco copyright through 2021. ### Related projects - Daemonlogger sits near tcpdump, Snort, libpcap, and libdnet in the Unix packet-capture ecosystem. ### Sources - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** daemonlogger - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - daemonlogger - 1.2.2-1: normalized package name match | Debian stable package indexes: daemonlogger from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple network packet logger and soft tap daemon | https://github.com/Cisco-Talos/Daemonlogger - Ubuntu apt - daemonlogger - 1.2.1-8build3: normalized package name match | Ubuntu 24.04 LTS package indexes: daemonlogger from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple network packet logger and soft tap daemon | http://www.snort.org/users/roesch/Site/Daemonlogger/Daemonlogger.html - MacPorts - daemonlogger: normalized package name match | MacPorts ports tree: net/daemonlogger/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [libdnet](https://www.automicvault.com/pkg/brew/libdnet/) - Runtime dependency declared by Homebrew. - [bittwist](https://www.automicvault.com/pkg/brew/bittwist/) - Shares av.db curated category or tags: cli, networking, packet-capture, pcap. - [libpcap](https://www.automicvault.com/pkg/brew/libpcap/) - Shares av.db curated category or tags: cli, networking, packet-capture. - [sniffer](https://www.automicvault.com/pkg/brew/sniffer/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-capture, pcap. - [tcpdump](https://www.automicvault.com/pkg/brew/tcpdump/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-capture, pcap. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-capture, pcap. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, network-monitoring, networking, pcap. - [sngrep](https://www.automicvault.com/pkg/brew/sngrep/) - Shares av.db curated category or tags: cli, networking, packet-capture, pcap. - [yaf](https://www.automicvault.com/pkg/brew/yaf/) - Shares av.db curated category or tags: cli, network-monitoring, networking, packet-capture. - [yconalyzer](https://www.automicvault.com/pkg/brew/yconalyzer/) - Local metadata places this package in an adjacent workflow. Shared terms: cli, monitoring, network, network-monitoring, networking. ## Combined YAML source View the package source record on GitHub. [combined/daemonlogger.yml](https://github.com/automic-vault/db/blob/main/combined/daemonlogger.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph