# Install daemonlogger with Homebrew, apt, MacPorts

Network packet logger and soft tap daemon. Version 1.2.1 via Homebrew; verified from local package data. Also installable with debian: sudo apt install daemonlogger.

## Install

```sh
sudo av install brew:daemonlogger
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install daemonlogger
```

  Evidence: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install daemonlogger
```

  Evidence: MacPorts ports tree: net/daemonlogger/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- Debian apt (92%):

```sh
sudo apt install daemonlogger
```

  Evidence: Debian stable package indexes: daemonlogger from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

## Package facts

- **Package key:** brew:daemonlogger
- **Package manager:** Homebrew
- **Version:** 1.2.1
- **Source summary:** Network packet logger and soft tap daemon
- **Homepage:** <https://sourceforge.net/projects/daemonlogger/>
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- daemonlogger (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 1.2.1
## Project history and usage

Daemonlogger is a small libpcap-based packet logging and soft-tap daemon. Its package-manager appeal is straightforward: it gives Unix users a dedicated command-line tool for capturing packets to rolling pcap files or forwarding captured traffic out another interface without adopting a larger IDS stack.

### Project history

The official README credits Martin Roesch as author and records Sourcefire copyright from 2006-2013, followed by Cisco copyright from 2013-2021. The current official GitHub repository describes itself as the official repository and was created under Cisco-Talos in 2015, after Cisco's Sourcefire acquisition era had folded the tool into Cisco's security tooling orbit.

### Adoption history

Daemonlogger's adoption has been strongest in packet-capture and security-operations environments where pcap output, BPF filters, daemon mode, and ring-buffer behavior are enough. Its official README still points users to the daemonlogger-users mailing list, reflecting an older SourceForge-era open-source support pattern.

### How it is used

Users run daemonlogger with switches for interface selection, daemonization, BPF filter files, packet-count limits, output paths, ring-buffer pruning, rollover size or time, and soft-tap output. The README explicitly frames its BPF filter syntax as familiar to tcpdump or Snort users.

### Why package nerds care

Daemonlogger matters to package nerds because it is a narrow, old-school Unix networking utility: one executable, libpcap/libdnet dependencies, pcap files as the interchange format, and behavior that fits service managers and shell scripts.

### Timeline

- 2006: Sourcefire copyright period for Daemonlogger begins.
- 2013: Cisco copyright period begins.
- 2015: Official Cisco-Talos GitHub repository is created.
- 2021: README lists version 1.2.1 and Cisco copyright through 2021.

### Related projects

- Daemonlogger sits near tcpdump, Snort, libpcap, and libdnet in the Unix packet-capture ecosystem.

### Sources

- <https://github.com/Cisco-Talos/Daemonlogger>
- <https://api.github.com/repos/Cisco-Talos/Daemonlogger>
- <https://raw.githubusercontent.com/Cisco-Talos/Daemonlogger/master/README>


## Security Notes

broad file, network, media, or database tool signal.

- **Geiger risk:** blue / medium
- broad file, network, media, or database tool signal

## Other Package-Manager Records

- Debian apt - daemonlogger - 1.2.2-1: normalized package name match | Debian stable package indexes: daemonlogger from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple network packet logger and soft tap daemon | https://github.com/Cisco-Talos/Daemonlogger
- Ubuntu apt - daemonlogger - 1.2.1-8build3: normalized package name match | Ubuntu 24.04 LTS package indexes: daemonlogger from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple network packet logger and soft tap daemon | http://www.snort.org/users/roesch/Site/Daemonlogger/Daemonlogger.html
- MacPorts - daemonlogger: normalized package name match | MacPorts ports tree: net/daemonlogger/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/daemonlogger.yml](https://github.com/mxcl/pkgdb/blob/main/combined/daemonlogger.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph