A quick note for anybody using libnids on a 64-bit machine (AMD64), you will need to compile with -fno-strict-aliasing
if you use optimisation at -O2
or above. Without it libnids will silently fail to provide you any data.
Much of the code I have written as part of my day job uses the rather excellent libnids. However, there are a few bugs in version 1.23 relating to packets with radiotap headers or code which tries to read from multiple pcap files in sequence.