hayeon-lee/ids

How hayeon-lee/ids works

This is a multithreaded, file-based intrusion detection system. Its workflow is: load configuration and rules, read offline PCAP/CAP files, distribute packets to detector threads, parse and match packets (including optional ICMP flood detection), then queue and persist alerts in SQLite. The graph also shows queueing and the status-printing thread. Some thread wiring and flood behavior are documented in the README; unsampled details are not inferred beyond those statements.

Main entry points: IDS.c Startup and threads · detectpacket.c Packet parser · queue.c Alert queue · readpacket.c Packet reader

Components 18

Configuration

Runtime config conf/config
Flood config conf/flood_conf
Detection rules conf/rule.txt

Packet ingestion

Packet reader readpacket.c
Overflow alerts readpacket.c

Detection

Packet parser detectpacket.c
Rule matching detectpacket.c
ICMP flood check hashtable.c
Source IP state hashtable.c

Queues and runtime

Startup and threads IDS.c
Packet queues queue.c
Alert queue queue.c
Queue status IDS.c

Alert logging

Log worker logpacket.c
Log buffer logpacket.c
SQLite logs

Other components

Operator
PCAP/CAP files

Connections 25

Operator → Startup and threads: starts README.md
Startup and threads → Runtime config: reads IDS.c
Startup and threads → Flood config: reads optionally IDS.c
Startup and threads → Detection rules: loads IDS.c
Operator → PCAP/CAP files: provides README.md
Startup and threads → Packet reader: starts thread README.md
Packet reader → PCAP/CAP files: reads readpacket.c
Packet reader → Packet queues: enqueues packets readpacket.c
Packet reader → Overflow alerts: creates on overflow readpacket.c
Overflow alerts → Alert queue: enqueues alert readpacket.c
Startup and threads → Packet queues: initializes README.md
Startup and threads → Alert queue: initializes README.md
Startup and threads → Packet parser: starts detector threads IDS.c
Packet queues → Packet parser: provides packets detectpacket.c
Packet parser → Rule matching: checks rules detectpacket.c
Packet parser → ICMP flood check: checks ICMP detectpacket.c
ICMP flood check → Source IP state: updates counts hashtable.c
Packet parser → Alert queue: enqueues detections detectpacket.c
Startup and threads → Log worker: starts thread README.md
Log worker → Alert queue: dequeues alerts logpacket.c
Log worker → Log buffer: buffers alerts logpacket.c
Log worker → SQLite logs: writes logs logpacket.c
Startup and threads → Queue status: starts thread IDS.c
Queue status → Packet queues: reads counters README.md
Queue status → Alert queue: reads counters README.md

Drawn by GitDiagram on November 11, 2026 from the repository's file tree, README and source files. Read as Markdown ·