# kerroldj/suricata architecture

> Architecture diagram of the GitHub repository kerroldj/suricata, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kerroldj/suricata
- Repository: https://github.com/kerroldj/suricata

## Overview

Suricata is a network IDS, IPS, and network security monitoring engine. Its principal workflow is to acquire network traffic, decode packets, track flows and application protocols, inspect traffic against configured detection rules, then report findings. The tree also shows rule parsing and matching internals, multiple capture integrations, protocol parsers, and event/file outputs. The README establishes the product purpose but not detailed runtime wiring; several workflow links below are therefore marked as unverified rather than presented as inspected calls.

Main entry points: [`src/detect-engine.c`](https://github.com/kerroldj/suricata/blob/main/src/detect-engine.c) (Detection Engine), [`src/app-layer-parser.h`](https://github.com/kerroldj/suricata/blob/main/src/app-layer-parser.h) (Application Parsing), [`src/decode.h`](https://github.com/kerroldj/suricata/blob/main/src/decode.h) (Packet Decode), [`src/flow.h`](https://github.com/kerroldj/suricata/blob/main/src/flow.h) (Flow Tracking)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_capture["Traffic Capture"]
  node_capture_modes["Capture Modes<br/>[decode.h]"]
  node_pfring["PF_RING Input<br/>[source-pfring.c]"]
  node_napatech["Napatech Input<br/>[source-napatech.c]"]
end

subgraph group_analysis["Traffic Analysis"]
  node_packet_decode["Packet Decode<br/>[decode.h]"]
  node_flow_tracking[("Flow Tracking<br/>[flow.h]")]
  node_app_detection["Protocol Detection<br/>[app-layer-protos.h]"]
  node_app_parsing["Application Parsing<br/>[app-layer-parser.h]"]
  node_http_parsing["HTTP Parsing"]
  node_protocol_parsers["Protocol Parsers<br/>[lib.rs]"]
end

subgraph group_detection["Rule Detection"]
  node_rule_input["Rule Parsing<br/>[detect-parse.h]"]
  node_address_rules["Address Matching"]
  node_engine_build["Engine Build"]
  node_pattern_match["Pattern Matching"]
  node_detection_engine["Detection Engine<br/>[detect-engine.c]"]
end

subgraph group_outputs["Event Outputs"]
  node_eve_output["EVE Output<br/>[output-eve.c]"]
  node_file_output["File Output<br/>[output-file.c]"]
end

subgraph group_integrations["Extensions"]
  node_ndpi["nDPI Plugin<br/>[ndpi.c]"]
  node_ebpf_filter["eBPF Filtering<br/>[xdp_filter.c]"]
end

node_traffic(("Network Traffic"))

node_traffic -.->|"enters"| node_capture_modes
node_traffic -.->|"enters"| node_pfring
node_traffic -.->|"enters"| node_napatech
node_capture_modes -.->|"supplies packets"| node_packet_decode
node_pfring -.->|"supplies packets"| node_packet_decode
node_napatech -.->|"supplies packets"| node_packet_decode
node_packet_decode -.->|"updates flows"| node_flow_tracking
node_flow_tracking -.->|"provides flow"| node_app_detection
node_app_detection -.->|"selects parser"| node_app_parsing
node_app_parsing -.->|"uses HTTP parser"| node_http_parsing
node_app_parsing -.->|"dispatches parsers"| node_protocol_parsers
node_rule_input -.->|"configures rules"| node_detection_engine
node_address_rules -->|"supplies addresses"| node_engine_build
node_engine_build -->|"configures matching"| node_pattern_match
node_detection_engine -->|"uses matcher"| node_pattern_match
node_app_parsing -.->|"supplies parsed data"| node_detection_engine
node_detection_engine -.->|"emits events"| node_eve_output
node_detection_engine -.->|"emits files"| node_file_output
node_ndpi -->|"uses flow state"| node_flow_tracking
node_ebpf_filter -.->|"filters packets"| node_traffic

click node_capture_modes "https://github.com/kerroldj/suricata/blob/main/src/decode.h"
click node_pfring "https://github.com/kerroldj/suricata/blob/main/plugins/pfring/source-pfring.c"
click node_napatech "https://github.com/kerroldj/suricata/blob/main/plugins/napatech/source-napatech.c"
click node_packet_decode "https://github.com/kerroldj/suricata/blob/main/src/decode.h"
click node_flow_tracking "https://github.com/kerroldj/suricata/blob/main/src/flow.h"
click node_app_detection "https://github.com/kerroldj/suricata/blob/main/src/app-layer-protos.h"
click node_app_parsing "https://github.com/kerroldj/suricata/blob/main/src/app-layer-parser.h"
click node_http_parsing "https://github.com/kerroldj/suricata/blob/main/rust/htp/src/connection_parser.rs"
click node_protocol_parsers "https://github.com/kerroldj/suricata/blob/main/rust/src/lib.rs"
click node_rule_input "https://github.com/kerroldj/suricata/blob/main/src/detect-parse.h"
click node_address_rules "https://github.com/kerroldj/suricata/blob/main/src/detect-engine-address.c"
click node_engine_build "https://github.com/kerroldj/suricata/blob/main/src/detect-engine-build.c"
click node_pattern_match "https://github.com/kerroldj/suricata/blob/main/src/detect-engine-mpm.c"
click node_detection_engine "https://github.com/kerroldj/suricata/blob/main/src/detect-engine.c"
click node_eve_output "https://github.com/kerroldj/suricata/blob/main/src/output-eve.c"
click node_file_output "https://github.com/kerroldj/suricata/blob/main/src/output-file.c"
click node_ndpi "https://github.com/kerroldj/suricata/blob/main/plugins/ndpi/ndpi.c"
click node_ebpf_filter "https://github.com/kerroldj/suricata/blob/main/ebpf/xdp_filter.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_capture_modes,node_pfring,node_napatech toneBlue
class node_packet_decode,node_flow_tracking,node_app_detection,node_app_parsing,node_http_parsing,node_protocol_parsers toneAmber
class node_rule_input,node_address_rules,node_engine_build,node_pattern_match,node_detection_engine toneMint
class node_eve_output,node_file_output toneRose
class node_ndpi,node_ebpf_filter,node_traffic toneIndigo
```

## Components

### Traffic Capture

- [Capture Modes](https://github.com/kerroldj/suricata/blob/main/src/decode.h): `src/decode.h`
- [PF_RING Input](https://github.com/kerroldj/suricata/blob/main/plugins/pfring/source-pfring.c): `plugins/pfring/source-pfring.c`
- [Napatech Input](https://github.com/kerroldj/suricata/blob/main/plugins/napatech/source-napatech.c): `plugins/napatech/source-napatech.c`

### Traffic Analysis

- [Packet Decode](https://github.com/kerroldj/suricata/blob/main/src/decode.h): `src/decode.h`
- [Flow Tracking](https://github.com/kerroldj/suricata/blob/main/src/flow.h): `src/flow.h`
- [Protocol Detection](https://github.com/kerroldj/suricata/blob/main/src/app-layer-protos.h): `src/app-layer-protos.h`
- [Application Parsing](https://github.com/kerroldj/suricata/blob/main/src/app-layer-parser.h): `src/app-layer-parser.h`
- [HTTP Parsing](https://github.com/kerroldj/suricata/blob/main/rust/htp/src/connection_parser.rs): `rust/htp/src/connection_parser.rs`
- [Protocol Parsers](https://github.com/kerroldj/suricata/blob/main/rust/src/lib.rs): `rust/src/lib.rs`

### Rule Detection

- [Rule Parsing](https://github.com/kerroldj/suricata/blob/main/src/detect-parse.h): `src/detect-parse.h`
- [Address Matching](https://github.com/kerroldj/suricata/blob/main/src/detect-engine-address.c): `src/detect-engine-address.c`
- [Engine Build](https://github.com/kerroldj/suricata/blob/main/src/detect-engine-build.c): `src/detect-engine-build.c`
- [Pattern Matching](https://github.com/kerroldj/suricata/blob/main/src/detect-engine-mpm.c): `src/detect-engine-mpm.c`
- [Detection Engine](https://github.com/kerroldj/suricata/blob/main/src/detect-engine.c): `src/detect-engine.c`

### Event Outputs

- [EVE Output](https://github.com/kerroldj/suricata/blob/main/src/output-eve.c): `src/output-eve.c`
- [File Output](https://github.com/kerroldj/suricata/blob/main/src/output-file.c): `src/output-file.c`

### Extensions

- [nDPI Plugin](https://github.com/kerroldj/suricata/blob/main/plugins/ndpi/ndpi.c): `plugins/ndpi/ndpi.c`
- [eBPF Filtering](https://github.com/kerroldj/suricata/blob/main/ebpf/xdp_filter.c): `ebpf/xdp_filter.c`

### Other components

- **Network Traffic**

## Connections

- Network Traffic → Capture Modes: enters
- Network Traffic → PF_RING Input: enters
- Network Traffic → Napatech Input: enters
- Capture Modes → Packet Decode: supplies packets (evidence: `src/decode.h`)
- PF_RING Input → Packet Decode: supplies packets (evidence: `plugins/pfring/source-pfring.c`)
- Napatech Input → Packet Decode: supplies packets
- Packet Decode → Flow Tracking: updates flows (evidence: `src/flow.h`)
- Flow Tracking → Protocol Detection: provides flow (evidence: `src/flow.h`)
- Protocol Detection → Application Parsing: selects parser
- Application Parsing → HTTP Parsing: uses HTTP parser
- Application Parsing → Protocol Parsers: dispatches parsers
- Rule Parsing → Detection Engine: configures rules (evidence: `src/detect-engine.c`)
- Address Matching → Engine Build: supplies addresses (evidence: `src/detect-engine-build.c`)
- Engine Build → Pattern Matching: configures matching (evidence: `src/detect-engine-build.c`)
- Detection Engine → Pattern Matching: uses matcher (evidence: `src/detect-engine.c`)
- Application Parsing → Detection Engine: supplies parsed data (evidence: `src/detect-engine.c`)
- Detection Engine → EVE Output: emits events
- Detection Engine → File Output: emits files
- nDPI Plugin → Flow Tracking: uses flow state (evidence: `plugins/ndpi/ndpi.c`)
- eBPF Filtering → Network Traffic: filters packets