SentinelFlow
SentinelFlow is a real-time network intrusion detection system that captures live network traffic or processes pcap files, dissects protocol headers across multiple OSI layers, identifies known attack signatures and anomalies, and exports security alerts to console and CSV formats.
01 / Overview
- 01C++17
- 02libpcap
- 03CMake
- 04Google Test
- 05Snort-inspired Rules
- 06BPF Filters
Problem
Network intrusion detection requires deep packet inspection at wire speed. Commercial IDS solutions are opaque; building one from scratch reveals how protocol dissection, signature matching, and stateful analysis actually work.
Solution Overview
- Implemented layered protocol dissection covering Ethernet, IPv4, TCP, UDP, ICMP, DNS, and ARP
- Built a Snort-inspired configurable rule engine for flexible signature matching
- Added stateful threat detection for port scans, SYN floods, and DNS tunnelling
- Engineered for throughput: 500K+ packets/sec (single-thread parse, synthetic SYN)
02 / Evidence
Proof & Verification
- Throughput: 500K+ packets/sec (single-thread parse, synthetic SYN)
- Protocol coverage: 7 protocols across Layers 2-7
- All 27 unit and integration tests passed
- Supports both live capture and pcap file analysis
03 / Methods
Build
Tech Stack
- C++17
- libpcap
- CMake
- Google Test
- Snort-inspired Rules
- BPF Filters
- Live network capture via libpcap with configurable BPF filters
- Layered protocol dissection: Ethernet, IPv4, TCP, UDP, ICMP, DNS, ARP
- Snort-inspired configurable rule engine with signature matching
- Stateful threat detection (port scans, SYN floods, DNS tunnelling)
Secure
- Colour-coded severity-level alerting (LOW → CRITICAL)
- 27 unit/integration tests covering all protocol layers
- CSV export for forensic analysis and SIEM integration
- Configurable BPF filters for targeted capture