# hayeon-lee/ids architecture

> Architecture diagram of the GitHub repository hayeon-lee/ids, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/hayeon-lee/ids
- Repository: https://github.com/hayeon-lee/ids

## Overview

This is a multithreaded, file-based intrusion detection system. Its workflow is: load configuration and rules, read offline PCAP/CAP files, distribute packets to detector threads, parse and match packets (including optional ICMP flood detection), then queue and persist alerts in SQLite. The graph also shows queueing and the status-printing thread. Some thread wiring and flood behavior are documented in the README; unsampled details are not inferred beyond those statements.

Main entry points: [`IDS.c`](https://github.com/hayeon-lee/ids/blob/main/IDS.c) (Startup and threads), [`detectpacket.c`](https://github.com/hayeon-lee/ids/blob/main/detectpacket.c) (Packet parser), [`queue.c`](https://github.com/hayeon-lee/ids/blob/main/queue.c) (Alert queue), [`readpacket.c`](https://github.com/hayeon-lee/ids/blob/main/readpacket.c) (Packet reader)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_setup["Configuration"]
  node_config["Runtime config"]
  node_flood_config["Flood config"]
  node_rules["Detection rules<br/>[rule.txt]"]
end

subgraph group_ingest["Packet ingestion"]
  node_reader["Packet reader<br/>[readpacket.c]"]
  node_overflow_alert["Overflow alerts<br/>[readpacket.c]"]
end

subgraph group_detect["Detection"]
  node_parser["Packet parser<br/>[detectpacket.c]"]
  node_rule_match["Rule matching<br/>[detectpacket.c]"]
  node_flood_check["ICMP flood check<br/>[hashtable.c]"]
  node_hash_state[("Source IP state<br/>[hashtable.c]")]
end

subgraph group_runtime["Queues and runtime"]
  node_main["Startup and threads<br/>[IDS.c]"]
  node_packet_queue["Packet queues<br/>[queue.c]"]
  node_alert_queue["Alert queue<br/>[queue.c]"]
  node_status["Queue status<br/>[IDS.c]"]
end

subgraph group_logging["Alert logging"]
  node_log_worker["Log worker<br/>[logpacket.c]"]
  node_log_queue["Log buffer<br/>[logpacket.c]"]
  node_sqlite[("SQLite logs")]
end

node_operator(("Operator"))
node_pcap_files["PCAP/CAP files"]

node_operator -->|"starts"| node_main
node_main -->|"reads"| node_config
node_main -.->|"reads optionally"| node_flood_config
node_main -->|"loads"| node_rules
node_operator -->|"provides"| node_pcap_files
node_main -->|"starts thread"| node_reader
node_reader -->|"reads"| node_pcap_files
node_reader -->|"enqueues packets"| node_packet_queue
node_reader -->|"creates on overflow"| node_overflow_alert
node_overflow_alert -->|"enqueues alert"| node_alert_queue
node_main -->|"initializes"| node_packet_queue
node_main -->|"initializes"| node_alert_queue
node_main -->|"starts detector threads"| node_parser
node_packet_queue -->|"provides packets"| node_parser
node_parser -->|"checks rules"| node_rule_match
node_parser -->|"checks ICMP"| node_flood_check
node_flood_check -->|"updates counts"| node_hash_state
node_parser -->|"enqueues detections"| node_alert_queue
node_main -->|"starts thread"| node_log_worker
node_log_worker -->|"dequeues alerts"| node_alert_queue
node_log_worker -->|"buffers alerts"| node_log_queue
node_log_worker -->|"writes logs"| node_sqlite
node_main -->|"starts thread"| node_status
node_status -->|"reads counters"| node_packet_queue
node_status -->|"reads counters"| node_alert_queue

click node_config "https://github.com/hayeon-lee/ids/blob/main/conf/config"
click node_flood_config "https://github.com/hayeon-lee/ids/blob/main/conf/flood_conf"
click node_rules "https://github.com/hayeon-lee/ids/blob/main/conf/rule.txt"
click node_main "https://github.com/hayeon-lee/ids/blob/main/IDS.c"
click node_reader "https://github.com/hayeon-lee/ids/blob/main/readpacket.c"
click node_packet_queue "https://github.com/hayeon-lee/ids/blob/main/queue.c"
click node_parser "https://github.com/hayeon-lee/ids/blob/main/detectpacket.c"
click node_rule_match "https://github.com/hayeon-lee/ids/blob/main/detectpacket.c"
click node_flood_check "https://github.com/hayeon-lee/ids/blob/main/hashtable.c"
click node_hash_state "https://github.com/hayeon-lee/ids/blob/main/hashtable.c"
click node_alert_queue "https://github.com/hayeon-lee/ids/blob/main/queue.c"
click node_overflow_alert "https://github.com/hayeon-lee/ids/blob/main/readpacket.c"
click node_log_worker "https://github.com/hayeon-lee/ids/blob/main/logpacket.c"
click node_log_queue "https://github.com/hayeon-lee/ids/blob/main/logpacket.c"
click node_status "https://github.com/hayeon-lee/ids/blob/main/IDS.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_config,node_flood_config,node_rules toneBlue
class node_reader,node_overflow_alert toneAmber
class node_parser,node_rule_match,node_flood_check,node_hash_state toneMint
class node_main,node_packet_queue,node_alert_queue,node_status toneRose
class node_log_worker,node_log_queue,node_sqlite,node_operator,node_pcap_files toneIndigo
```

## Components

### Configuration

- [Runtime config](https://github.com/hayeon-lee/ids/blob/main/conf/config): `conf/config`
- [Flood config](https://github.com/hayeon-lee/ids/blob/main/conf/flood_conf): `conf/flood_conf`
- [Detection rules](https://github.com/hayeon-lee/ids/blob/main/conf/rule.txt): `conf/rule.txt`

### Packet ingestion

- [Packet reader](https://github.com/hayeon-lee/ids/blob/main/readpacket.c): `readpacket.c`
- [Overflow alerts](https://github.com/hayeon-lee/ids/blob/main/readpacket.c): `readpacket.c`

### Detection

- [Packet parser](https://github.com/hayeon-lee/ids/blob/main/detectpacket.c): `detectpacket.c`
- [Rule matching](https://github.com/hayeon-lee/ids/blob/main/detectpacket.c): `detectpacket.c`
- [ICMP flood check](https://github.com/hayeon-lee/ids/blob/main/hashtable.c): `hashtable.c`
- [Source IP state](https://github.com/hayeon-lee/ids/blob/main/hashtable.c): `hashtable.c`

### Queues and runtime

- [Startup and threads](https://github.com/hayeon-lee/ids/blob/main/IDS.c): `IDS.c`
- [Packet queues](https://github.com/hayeon-lee/ids/blob/main/queue.c): `queue.c`
- [Alert queue](https://github.com/hayeon-lee/ids/blob/main/queue.c): `queue.c`
- [Queue status](https://github.com/hayeon-lee/ids/blob/main/IDS.c): `IDS.c`

### Alert logging

- [Log worker](https://github.com/hayeon-lee/ids/blob/main/logpacket.c): `logpacket.c`
- [Log buffer](https://github.com/hayeon-lee/ids/blob/main/logpacket.c): `logpacket.c`
- **SQLite logs**

### Other components

- **Operator**
- **PCAP/CAP files**

## Connections

- Operator → Startup and threads: starts (evidence: `README.md`)
- Startup and threads → Runtime config: reads (evidence: `IDS.c`)
- Startup and threads → Flood config: reads optionally (evidence: `IDS.c`)
- Startup and threads → Detection rules: loads (evidence: `IDS.c`)
- Operator → PCAP/CAP files: provides (evidence: `README.md`)
- Startup and threads → Packet reader: starts thread (evidence: `README.md`)
- Packet reader → PCAP/CAP files: reads (evidence: `readpacket.c`)
- Packet reader → Packet queues: enqueues packets (evidence: `readpacket.c`)
- Packet reader → Overflow alerts: creates on overflow (evidence: `readpacket.c`)
- Overflow alerts → Alert queue: enqueues alert (evidence: `readpacket.c`)
- Startup and threads → Packet queues: initializes (evidence: `README.md`)
- Startup and threads → Alert queue: initializes (evidence: `README.md`)
- Startup and threads → Packet parser: starts detector threads (evidence: `IDS.c`)
- Packet queues → Packet parser: provides packets (evidence: `detectpacket.c`)
- Packet parser → Rule matching: checks rules (evidence: `detectpacket.c`)
- Packet parser → ICMP flood check: checks ICMP (evidence: `detectpacket.c`)
- ICMP flood check → Source IP state: updates counts (evidence: `hashtable.c`)
- Packet parser → Alert queue: enqueues detections (evidence: `detectpacket.c`)
- Startup and threads → Log worker: starts thread (evidence: `README.md`)
- Log worker → Alert queue: dequeues alerts (evidence: `logpacket.c`)
- Log worker → Log buffer: buffers alerts (evidence: `logpacket.c`)
- Log worker → SQLite logs: writes logs (evidence: `logpacket.c`)
- Startup and threads → Queue status: starts thread (evidence: `IDS.c`)
- Queue status → Packet queues: reads counters (evidence: `README.md`)
- Queue status → Alert queue: reads counters (evidence: `README.md`)