I'd try to go with established tools first, before writing my own networking interface monitoring code.
Chances are that if you're trying to protect a server, you'll be helpless against a sufficiently large DDoS anyway (someone further up the routing chain will have to take action to null-route attacks), so the main argument in favor of writing your own C code, efficient detection, isn't very strong).
(The above paragraph doesn't apply if you're trying to detect a DDoS flowing through specialized hardware, like large routers - in such a case, you'd be part of the effort to stop a DDoS before it reached it's target, and efficiency would be your prime concern - but I'd be disappointed if high-capacity routers didn't already have such capabilities built-in)
Besides tcpdump, you could also use netstat (to get a quick idea about the number of connections or connections in a zombie state), iptables (both to log packets and then act on the log, and to drop suspicious packets immediately) and fail2ban (you can configure it to count, say, HTTP GET requests or SSH connection attempts etc, and then automatically ban the IPs in question, and of course also produce log messages that an additional DDoS detection script can the pick up and use to notify you).
One problem with basing detection code for a DDoS on the server that's being DDoSed is that if you're counting on the server to notify you of the attack over the network, you might get disappointed because the server might not have the CPU resources or the bandwith available to send out a notification any more. So you'd need to have a secondary means of communication, say a GSM modem over which to notify you (and that's assuming that the server still has the CPU resources available to run your notification code).
There's another, very easy and much more promising way to create a DDoS monitor: Set up a small script on another server that periodically tries to connect to your server. If it fails to connect, you can assume that either your server is down, the network between your server and your monitor is down, or that there is a DDoS in progress. Going this route, you don't even have to write any software at all; just subscribe to an online service that checks service uptimes. There's a lot of them available, some of them even for free.