facebook/osquery — pull request #561 by theopolis (2014-12-23 08:40:47+00:00)
Title: libpcap event publisher and DNS queries subscriber

This implements libpcap as an event publisher with BASIC subscriptions. There is much to be desired from the publisher. (1) You can only start one publisher with an amalgamation of BPF strings. This will lead to errors in the subscribers where you'll need to "refilter" according to the individual subscription context. (2) There are NO performance guarantees. (3) When creating pseudo interfaces on OSX (pktap) there is no device removal/cleanup.