Skip to content

Module Dependency Graph: Aegis

This document illustrates the structural coupling and interface boundaries of the Aegis framework.

1. System Dependency Diagram

The pipeline flows sequentially. To keep interfaces clean, data layers are decoupled from thread management layers.

graph TD
    %% Main Components
    Reader[Ingestion / PcapReader] -->|Acquires & Writes| PacketPool[PacketBufferPool]
    Reader -->|Enqueues PacketView| LB[Load Balancer]
    LB -->|Consistent Hash Index| Worker0[Worker Core 0]
    LB -->|Consistent Hash Index| Worker1[Worker Core 1]

    Worker0 -->|Round-Robin Poll| Writer[Output Writer / IO]
    Worker1 -->|Round-Robin Poll| Writer

    %% Downstream Helper Modules
    Worker0 -->|Parses| PacketParser[Packet Parser]
    Worker0 -->|Tracks| ConnTracker[Connection Tracker]
    Worker0 -->|Evaluates| RuleEngine[Rule Engine]
    Worker0 -->|Increments| Metrics[Metrics System]

    PacketParser -->|Fills| PacketView[PacketView Abstraction]
    ConnTracker -->|Manages| FlowTable[Flat Flow Table]
    RuleEngine -->|Loads| ActiveRules[Active Rules Pointer]

2. Decoupling Principles

  • PacketView Abstraction: The Ingestion Reader/Parser constructs a lightweight PacketView pointing into raw buffer frames. Worker cores and rules engines operate on PacketView, isolating them from the underlying memory allocation details.
  • Flow Table Isolation: Each worker core owns a separate ConnectionTracker map. There are no shared data structures between worker threads, eliminating CPU cross-cache invalidation.
  • Metrics Invalidation: Worker threads increment thread-local metrics counters. The central metrics manager aggregates these counters asynchronously, keeping the worker threads completely independent.