macOS
Homebrewverified · 100%
brew install daqlocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install daqMacPorts ports tree · net/daq/Portfile · source: api.github.com
brew
Install daq with Homebrew, apk, dnf, MacPorts, apt
Network intrusion prevention and detection system. Version 3.0.27 via Homebrew; verified 2026-06-27.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add daqAlpine Linux edge package indexes · daq · source: dl-cdn.alpinelinux.org
Fedora dnfverified · 92%
sudo dnf install daqFedora Rawhide package metadata · daq · source: dl.fedoraproject.org
Ubuntu aptverified · 92%
sudo apt install libdaq-devUbuntu 24.04 LTS package indexes · libdaq-dev · source: archive.ubuntu.com
overview
Package summary
Network intrusion prevention and detection system
Project links
Commands and aliases
- daqtest
- daqtest-static
history
Project history and usage
LibDAQ is Snort's Data Acquisition library, the packet I/O abstraction layer that lets Snort and related packet-processing tools talk to pcap files, live interfaces, inline packet paths, and platform-specific capture back ends.
Project history
Snort documentation says Snort 2.9 introduced DAQ to replace direct libpcap calls with an abstraction layer. The Snort 3 LibDAQ repository continues that idea with base modules and wrapper modules that compose into DAQ instances.
Adoption history
LibDAQ is packaged separately because Snort users often need to build or install it before Snort itself, choose module directories, and line up the correct Snort 2 or Snort 3 DAQ version on machines where both generations coexist.
How it is used
In practice, users install LibDAQ, point Snort at the module directory when needed, list available modules with snort --daq-list, and then run Snort in passive, inline, or pcap-readback modes depending on the selected DAQ module.
Why package nerds care
LibDAQ is a package-manager boundary object: it is not the IDS itself, but versioning, module paths, kernel/network dependencies, and build options can decide whether Snort can capture packets at all.
Timeline
- 2010: Snort 2.9 documentation introduced DAQ as a replacement for direct libpcap calls.
- 2019: Early Snort 3 LibDAQ issue history shows separate packaging and configure/build questions.
- 2021: LibDAQ 3.0.x changelog entries document Snort 3-era module and API evolution.
Related projects
- LibDAQ is closely tied to Snort 2, Snort 3, libpcap, Linux AF_PACKET, netfilter queue, netmap, and other packet acquisition paths used by intrusion detection and prevention deployments.
Sources
security posture
Risk level: blue
broad file, network, media, or database tool signal.
Risk classifier
blue risk · medium confidence · tool
Why
- broad file, network, media, or database tool signal
Signals
- text:network
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Build metadata lists 4 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
daqtest | cli | global executable | |
daqtest-static | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version3.0.27
manager updated2026-06-27
local dataok
upstreamcurrent
latest detectedv3.0.27
https://github.com/snort3/libdaq
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:daq |
|---|---|
| Version | 3.0.27 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/daq |
| Homepage | https://www.snort.org/ |
| Repository | https://github.com/snort3/libdaq |
| Upstream docs | https://docs.snort.org/start/inspection |
| License | GPL-2.0-only |
| Source archive | https://github.com/snort3/libdaq/archive/refs/tags/v3.0.27.tar.gz |
| Last updated | 2026-06-27T20:02:12-04:00 |
| Pulse | updated |
| Build dependencies | autoconf, automake, libtool, pkgconf |
| Uses from macOS | libpcap |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | daq |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Ubuntu apt95%
libdaq-dev 2.0.7-5.1build3
Data Acquisition library for packet I/O - development files
https://www.snort.org/downloads/
sudo apt install libdaq-dev- Section: universe/libdevel
- Architecture: amd64
- Source Package: daq
- 4 dependencies
- normalized package name match
- Matched by: Daq
Ubuntu apt95%
libdaq2t64 2.0.7-5.1build3
Data Acquisition library for packet I/O - shared library
https://www.snort.org/downloads/
sudo apt install libdaq2t64- Section: universe/libs
- Architecture: amd64
- Source Package: daq
- 4 dependencies
- 1 provides
- normalized package name match
- Matched by: Daq
apk95%
daq 3.0.19-r0
Data Acquisition library - packet I/O library
sudo apk add daq- License: GPL-2.0-only
- Architecture: x86_64
- Source Package: daq
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Daq
apk95%
daq-dev 3.0.19-r0
Data Acquisition library - packet I/O library (development files)
sudo apk add daq-dev- License: GPL-2.0-only
- Architecture: x86_64
- Source Package: daq
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Daq
apk95%
daq-static 3.0.19-r0
Data Acquisition library - packet I/O library (static library)
sudo apk add daq-static- License: GPL-2.0-only
- Architecture: x86_64
- Source Package: daq
- normalized package name match
- Matched by: Daq
dnf95%
daq 2.0.7-11.fc44
Data Acquisition Library
sudo dnf install daq- License: GPL-2.0-only AND LicenseRef-Callaway-BSD
- Category: Unspecified
- Architecture: i686
- Source Package: daq
- 2 dependencies
- 3 provides
- normalized package name match
- Matched by: Daq
dnf95%
daq-devel 2.0.7-11.fc44
Development libraries and headers for daq
sudo dnf install daq-devel- License: GPL-2.0-only AND LicenseRef-Callaway-BSD
- Category: Unspecified
- Architecture: i686
- Source Package: daq
- 4 dependencies
- 1 provides
- normalized package name match
- Matched by: Daq
dnf95%
daq-modules 2.0.7-11.fc44
Dynamic DAQ modules
sudo dnf install daq-modules- License: GPL-2.0-only AND LicenseRef-Callaway-BSD
- Category: Unspecified
- Architecture: x86_64
- Source Package: daq
- 7 dependencies
- 1 provides
- normalized package name match
- Matched by: Daq
MacPorts95%
daq
sudo port install daq- normalized package name match
- Matched by: Daq
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment