The DNA code is run in a kernel thread8.2. Its role is to serialize the access to the network for the log messages. Each time a log message is generated by LIDS and must be sent through the network, it is placed in a message queue. And klids send one message at time through network, sending for example one UDP packet to a remote host, port 514 for a remote syslog daemon, or sending a whole set of packets, to establish a TCP connection, and to dialog with a mail relay, to finnaly send the message by mail. All these operation are done in kernel space, so that even with an unreliable user space, mail can be send.