internal/

Package api serves the alert feed, asset inventory, and live dashboard.

Package capture turns bytes off the wire (or off disk) into decoded model.Packet values.

Package detect hosts the detection engine and the built-in detectors.

Package fingerprint derives passive TLS client fingerprints (JA4 and JA3) from raw ClientHello bytes.

Package flow maintains the live table of bidirectional conversations assembled from the packet stream.

Package model defines the core domain types shared by every stage of the tracehound pipeline: capture, flow assembly, fingerprinting, and detection.

Package pcapgen writes a synthetic capture containing known, labelled attacker behaviour.

Package pipeline wires the sensor together: capture feeds flow assembly, flow assembly feeds fingerprinting and detection, detection emits alerts.

Package quic decrypts QUIC Initial packets far enough to recover the TLS ClientHello inside them.

Package rules loads the YAML rule pack that governs detection policy.

Package store persists findings so they survive a restart.