Suricata, before the source.
Suricata turns network traffic into protocol state, detection, and alerts. This guide gives you the design-level orientation first.
Illustrative fixture · coverage limitedCoverage: illustrative repository slice
Repository shape
Select a region for its architecture chapter.
Architecture map
level 0 · system shapeillustrative · 8 regions placed · pipeline layout
wire input
consumers
entry effect
runtime spine
Detection is intentionally wider: protocol-aware rules, prefilters, and matchers meet the normalized stream here.