kerroldj/suricata

How kerroldj/suricata works

Suricata is a network IDS, IPS, and network security monitoring engine. Its principal workflow is to acquire network traffic, decode packets, track flows and application protocols, inspect traffic against configured detection rules, then report findings. The tree also shows rule parsing and matching internals, multiple capture integrations, protocol parsers, and event/file outputs. The README establishes the product purpose but not detailed runtime wiring; several workflow links below are therefore marked as unverified rather than presented as inspected calls.

Main entry points: detect-engine.c Detection Engine · app-layer-parser.h Application Parsing · decode.h Packet Decode · flow.h Flow Tracking

Components 19

Traffic Capture

Capture Modes src/decode.h
PF_RING Input plugins/pfring/source-pfring.c
Napatech Input plugins/napatech/source-napatech.c

Traffic Analysis

Packet Decode src/decode.h
Flow Tracking src/flow.h
Protocol Detection src/app-layer-protos.h
Application Parsing src/app-layer-parser.h
HTTP Parsing rust/htp/src/connection_parser.rs
Protocol Parsers rust/src/lib.rs

Rule Detection

Rule Parsing src/detect-parse.h
Address Matching src/detect-engine-address.c
Engine Build src/detect-engine-build.c
Pattern Matching src/detect-engine-mpm.c
Detection Engine src/detect-engine.c

Event Outputs

EVE Output src/output-eve.c
File Output src/output-file.c

Extensions

nDPI Plugin plugins/ndpi/ndpi.c
eBPF Filtering ebpf/xdp_filter.c

Other components

Network Traffic

Connections 20

Network Traffic → Capture Modes: enters
Network Traffic → PF_RING Input: enters
Network Traffic → Napatech Input: enters
Capture Modes → Packet Decode: supplies packets src/decode.h
PF_RING Input → Packet Decode: supplies packets plugins/pfring/source-pfring.c
Napatech Input → Packet Decode: supplies packets
Packet Decode → Flow Tracking: updates flows src/flow.h
Flow Tracking → Protocol Detection: provides flow src/flow.h
Protocol Detection → Application Parsing: selects parser
Application Parsing → HTTP Parsing: uses HTTP parser
Application Parsing → Protocol Parsers: dispatches parsers
Rule Parsing → Detection Engine: configures rules src/detect-engine.c
Address Matching → Engine Build: supplies addresses src/detect-engine-build.c
Engine Build → Pattern Matching: configures matching src/detect-engine-build.c
Detection Engine → Pattern Matching: uses matcher src/detect-engine.c
Application Parsing → Detection Engine: supplies parsed data src/detect-engine.c
Detection Engine → EVE Output: emits events
Detection Engine → File Output: emits files
nDPI Plugin → Flow Tracking: uses flow state plugins/ndpi/ndpi.c
eBPF Filtering → Network Traffic: filters packets

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·