diff --git a/pkgs/by-name/li/libdaq/package.nix b/pkgs/by-name/li/libdaq/package.nix
new file mode 100644
index 000000000000..c182572de779
--- /dev/null
+++ b/pkgs/by-name/li/libdaq/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  libpcap,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libdaq";
+  version = "3.0.18";
+
+  src = fetchFromGitHub {
+    owner = "snort3";
+    repo = "libdaq";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PMb8q8QcfUXxEf0s2UdaZogmxzqUCw0wRdzfT1xio/E=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    libpcap
+    stdenv.cc.cc # libstdc++
+  ];
+
+  outputs = [
+    "lib"
+    "dev"
+    "out"
+  ];
+
+  autoreconfPhase = ''
+    ./bootstrap
+  '';
+
+  postInstall = ''
+    # remove build directory (/build/**, or /tmp/nix-build-**) from RPATHs
+    for f in "$out"/bin/*; do
+      local nrp="$(patchelf --print-rpath "$f" | sed -E 's@(:|^)'$NIX_BUILD_TOP'[^:]*:@\1@g')"
+      patchelf --set-rpath "$nrp" "$f"
+    done
+  '';
+
+  meta = {
+    description = "Data AcQuisition library (libDAQ), for snort packet I/O";
+    homepage = "https://www.snort.org";
+    maintainers = with lib.maintainers; [
+      aycanirican
+      brianmcgillion
+    ];
+    license = lib.licenses.gpl2;
+    outputsToInstall = [
+      "lib"
+      "dev"
+    ];
+    platforms = with lib.platforms; linux;
+  };
+})