Build a Network Intrusion Detection System Using Rust (2026)

cargo new rust-nids
cd rust-nids

# Ubuntu/Debian
sudo apt-get install libpcap-dev

# Fedora/RHEL
sudo dnf install libpcap-devel

brew install libpcap

[package]
name = "rust-nids"
version = "0.1.0"
edition = "2021"

[dependencies]
tokio = { version = "1.40", features = ["full"] }
clap = { version = "4.5", features = ["derive"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
chrono = { version = "0.4", features = ["serde"] }
anyhow = "1.0"
thiserror = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
pcap = "1.1"
etherparse = "0.14"
actix-web = "4.5"
actix-files = "0.6"

[dev-dependencies]
tokio-test = "0.4"

mkdir -p src/{capture,parser,detection,alert,dashboard}
touch src/capture/mod.rs src/parser/mod.rs src/detection/mod.rs src/alert/mod.rs src/dashboard/mod.rs

use anyhow::Result;
use pcap::{Device, Capture, Active};
use std::sync::Arc;
use tokio::sync::mpsc;
use tracing::{error, info, warn};

pub struct PacketCapturer {
    device: Device,
    buffer_size: i32,
}

#[derive(Debug, Clone)]
pub struct CapturedPacket {
    pub data: Vec<u8>,
    pub timestamp: u64,
    pub len: usize,
}

impl PacketCapturer {
    pub fn new(interface: Option<String>) -> Result<Self> {
        let device = if let Some(iface) = interface {
            Device::list()?
                .into_iter()
                .find(|d| d.name == iface)
                .ok_or_else(|| anyhow::anyhow!("Interface {} not found", iface))?
        } else {
            Device::list()?
                .into_iter()
                .next()
                .ok_or_else(|| anyhow::anyhow!("No network interface found"))?
        };

        info!("Using network interface: {}", device.name);

        Ok(PacketCapturer {
            device,
            buffer_size: 65535,
        })
    }

    pub fn start_capture(
        &self,
        tx: mpsc::Sender<CapturedPacket>,
    ) -> Result<tokio::task::JoinHandle<()>> {
        let device_name = self.device.name.clone();
        let buffer_size = self.buffer_size;

        let handle = tokio::task::spawn_blocking(move || {
            let mut cap = Capture::from_device(device_name.as_str())
                .expect("Failed to open device")
                .promisc(true)
                .buffer_size(buffer_size)
                .open()
                .expect("Failed to activate capture");

            info!("Starting packet capture on {}", device_name);

            loop {
                match cap.next_packet() {
                    Ok(packet) => {
                        let captured = CapturedPacket {
                            data: packet.data.to_vec(),
                            timestamp: packet.header.ts.tv_sec as u64 * 1_000_000
                                + packet.header.ts.tv_usec as u64,
                            len: packet.header.len as usize,
                        };

                        if tx.blocking_send(captured).is_err() {
                            warn!("Receiver dropped, stopping capture");
                            break;
                        }
                    }
                    Err(pcap::Error::TimeoutExpired) => {
                        // Timeout is normal, continue
                        continue;
                    }
                    Err(e) => {
                        error!("Packet capture error: {}", e);
                        break;
                    }
                }
            }
        });

        Ok(handle)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_capturer_creation() {
        // This will fail if no interface available, which is OK for CI
        let _capturer = PacketCapturer::new(None);
    }
}

use anyhow::Result;
use etherparse::{Ethernet2Header, Ipv4Header, TcpHeader, UdpHeader};
use std::net::Ipv4Addr;
use tracing::warn;

#[derive(Debug, Clone)]
pub struct ParsedPacket {
    pub src_ip: Option<Ipv4Addr>,
    pub dst_ip: Option<Ipv4Addr>,
    pub src_port: Option<u16>,
    pub dst_port: Option<u16>,
    pub protocol: Protocol,
    pub flags: Option<TcpFlags>,
    pub payload: Vec<u8>,
}

#[derive(Debug, Clone, Copy, PartialEq)]
pub enum Protocol {
    Tcp,
    Udp,
    Icmp,
    Other,
}

#[derive(Debug, Clone, Copy)]
pub struct TcpFlags {
    pub syn: bool,
    pub ack: bool,
    pub fin: bool,
    pub rst: bool,
    pub psh: bool,
    pub urg: bool,
}

pub struct PacketParser;

impl PacketParser {
    pub fn parse(data: &[u8]) -> Result<Option<ParsedPacket>> {
        // Parse Ethernet header
        let (_, payload) = match Ethernet2Header::from_slice(data) {
            Ok((header, remaining)) => {
                // Only process IPv4 packets
                if header.ether_type.value() != 0x0800 {
                    return Ok(None);
                }
                (header, remaining)
            }
            Err(_) => return Ok(None),
        };

        // Parse IP header
        let (ip_header, ip_payload) = match Ipv4Header::from_slice(payload) {
            Ok((h, p)) => (h, p),
            Err(_) => return Ok(None),
        };

        let src_ip = ip_header.source_addr();
        let dst_ip = ip_header.destination_addr();
        let protocol = ip_header.protocol();

        // Parse transport layer
        match protocol {
            6 => {
                // TCP
                match TcpHeader::from_slice(ip_payload) {
                    Ok((tcp_header, tcp_payload)) => {
                        Ok(Some(ParsedPacket {
                            src_ip: Some(src_ip),
                            dst_ip: Some(dst_ip),
                            src_port: Some(tcp_header.source_port),
                            dst_port: Some(tcp_header.destination_port),
                            protocol: Protocol::Tcp,
                            flags: Some(TcpFlags {
                                syn: tcp_header.syn,
                                ack: tcp_header.ack,
                                fin: tcp_header.fin,
                                rst: tcp_header.rst,
                                psh: tcp_header.psh,
                                urg: tcp_header.urg,
                            }),
                            payload: tcp_payload.to_vec(),
                        }))
                    }
                    Err(_) => Ok(None),
                }
            }
            17 => {
                // UDP
                match UdpHeader::from_slice(ip_payload) {
                    Ok((udp_header, udp_payload)) => {
                        Ok(Some(ParsedPacket {
                            src_ip: Some(src_ip),
                            dst_ip: Some(dst_ip),
                            src_port: Some(udp_header.source_port),
                            dst_port: Some(udp_header.destination_port),
                            protocol: Protocol::Udp,
                            flags: None,
                            payload: udp_payload.to_vec(),
                        }))
                    }
                    Err(_) => Ok(None),
                }
            }
            1 => {
                // ICMP
                Ok(Some(ParsedPacket {
                    src_ip: Some(src_ip),
                    dst_ip: Some(dst_ip),
                    src_port: None,
                    dst_port: None,
                    protocol: Protocol::Icmp,
                    flags: None,
                    payload: ip_payload.to_vec(),
                }))
            }
            _ => Ok(Some(ParsedPacket {
                src_ip: Some(src_ip),
                dst_ip: Some(dst_ip),
                src_port: None,
                dst_port: None,
                protocol: Protocol::Other,
                flags: None,
                payload: ip_payload.to_vec(),
            })),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_parser_with_empty_data() {
        let result = PacketParser::parse(&[]);
        assert!(result.is_ok());
    }
}

use crate::parser::{ParsedPacket, Protocol, TcpFlags};
use anyhow::Result;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use std::collections::{HashMap, HashSet};
use std::net::Ipv4Addr;
use std::time::{Duration, SystemTime};
use tracing::{info, warn};

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PortScanAlert {
    pub src_ip: Ipv4Addr,
    pub dst_ip: Ipv4Addr,
    pub scan_type: ScanType,
    pub ports_scanned: Vec<u16>,
    pub timestamp: DateTime<Utc>,
    pub severity: AlertSeverity,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum ScanType {
    SynScan,
    ConnectScan,
    StealthScan,
    FinScan,
    XmasScan,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AlertSeverity {
    Low,
    Medium,
    High,
    Critical,
}

pub struct PortScanDetector {
    // Track connection attempts per source IP
    connection_attempts: HashMap<Ipv4Addr, Vec<(u16, SystemTime)>>,
    // Time window for detection (seconds)
    time_window: u64,
    // Threshold for port scan detection
    port_threshold: usize,
    // Port range for single host
    port_range_threshold: usize,
}

impl PortScanDetector {
    pub fn new(time_window: u64, port_threshold: usize) -> Self {
        PortScanDetector {
            connection_attempts: HashMap::new(),
            time_window,
            port_threshold,
            port_range_threshold: 10,
        }
    }

    pub fn analyze(&mut self, packet: &ParsedPacket) -> Vec<PortScanAlert> {
        let mut alerts = Vec::new();

        // Only analyze TCP packets
        if packet.protocol != Protocol::Tcp {
            return alerts;
        }

        let (src_ip, dst_ip) = match (packet.src_ip, packet.dst_ip) {
            (Some(src), Some(dst)) => (src, dst),
            _ => return alerts,
        };

        let (src_port, dst_port) = match (packet.src_port, packet.dst_port) {
            (Some(sp), Some(dp)) => (sp, dp),
            _ => return alerts,
        };

        // Check for SYN scan (SYN flag without ACK)
        if let Some(flags) = packet.flags {
            if flags.syn && !flags.ack {
                // Track SYN attempts
                let now = SystemTime::now();
                let attempts = self.connection_attempts.entry(src_ip).or_insert_with(Vec::new);
                attempts.push((dst_port, now));

                // Clean old attempts outside time window
                let cutoff = now - Duration::from_secs(self.time_window);
                attempts.retain(|(_, time)| *time > cutoff);

                // Detect port scan
                if attempts.len() >= self.port_threshold {
                    let unique_ports: HashSet<u16> = attempts.iter().map(|(p, _)| *p).collect();
                    
                    if unique_ports.len() >= self.port_threshold {
                        info!("Port scan detected from {} to {}", src_ip, dst_ip);
                        
                        alerts.push(PortScanAlert {
                            src_ip,
                            dst_ip,
                            scan_type: ScanType::SynScan,
                            ports_scanned: unique_ports.into_iter().collect(),
                            timestamp: Utc::now(),
                            severity: AlertSeverity::High,
                        });

                        // Clear after alert to avoid spam
                        attempts.clear();
                    }
                }
            }

            // Detect FIN scan (FIN without ACK)
            if flags.fin && !flags.ack && !flags.syn {
                warn!("Potential FIN scan from {} to port {}", src_ip, dst_port);
                alerts.push(PortScanAlert {
                    src_ip,
                    dst_ip,
                    scan_type: ScanType::FinScan,
                    ports_scanned: vec![dst_port],
                    timestamp: Utc::now(),
                    severity: AlertSeverity::Medium,
                });
            }
        }

        alerts
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::parser::{ParsedPacket, Protocol};

    fn create_syn_packet(src_ip: Ipv4Addr, dst_port: u16) -> ParsedPacket {
        ParsedPacket {
            src_ip: Some(src_ip),
            dst_ip: Some(Ipv4Addr::new(192, 168, 1, 1)),
            src_port: Some(54321),
            dst_port: Some(dst_port),
            protocol: Protocol::Tcp,
            flags: Some(TcpFlags {
                syn: true,
                ack: false,
                fin: false,
                rst: false,
                psh: false,
                urg: false,
            }),
            payload: vec![],
        }
    }

    #[test]
    fn test_port_scan_detection() {
        let mut detector = PortScanDetector::new(60, 5);
        let src_ip = Ipv4Addr::new(10, 0, 0, 1);

        // Send multiple SYN packets to different ports
        for port in 1..=10 {
            let packet = create_syn_packet(src_ip, port);
            let alerts = detector.analyze(&packet);
            if port >= 5 {
                // Should detect scan after threshold
                assert!(!alerts.is_empty() || port < 5);
            }
        }
    }
}

use crate::parser::ParsedPacket;
use anyhow::Result;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::net::Ipv4Addr;
use tracing::warn;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AnomalyAlert {
    pub anomaly_type: AnomalyType,
    pub src_ip: Option<Ipv4Addr>,
    pub dst_ip: Option<Ipv4Addr>,
    pub description: String,
    pub timestamp: DateTime<Utc>,
    pub severity: AlertSeverity,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AnomalyType {
    UnusualTrafficVolume,
    UnusualPort,
    UnusualProtocol,
    UnusualTimePattern,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AlertSeverity {
    Low,
    Medium,
    High,
    Critical,
}

pub struct AnomalyDetector {
    // Baseline statistics
    baseline_ports: HashMap<u16, usize>,
    baseline_protocols: HashMap<String, usize>,
    packet_count: usize,
    window_size: usize,
}

impl AnomalyDetector {
    pub fn new(window_size: usize) -> Self {
        AnomalyDetector {
            baseline_ports: HashMap::new(),
            baseline_protocols: HashMap::new(),
            packet_count: 0,
            window_size,
        }
    }

    pub fn analyze(&mut self, packet: &ParsedPacket) -> Vec<AnomalyAlert> {
        let mut alerts = Vec::new();

        // Update baseline statistics
        if let Some(dst_port) = packet.dst_port {
            *self.baseline_ports.entry(dst_port).or_insert(0) += 1;
        }

        let protocol_str = format!("{:?}", packet.protocol);
        *self.baseline_protocols.entry(protocol_str.clone()).or_insert(0) += 1;

        self.packet_count += 1;

        // Detect anomalies after building baseline
        if self.packet_count > self.window_size {
            // Detect unusual ports
            if let Some(dst_port) = packet.dst_port {
                let port_count = self.baseline_ports.get(&dst_port).copied().unwrap_or(0);
                let port_ratio = port_count as f64 / self.packet_count as f64;

                // Flag if port usage is less than 0.1% (unusual)
                if port_ratio < 0.001 && port_count < 10 {
                    alerts.push(AnomalyAlert {
                        anomaly_type: AnomalyType::UnusualPort,
                        src_ip: packet.src_ip,
                        dst_ip: packet.dst_ip,
                        description: format!("Unusual port {} accessed", dst_port),
                        timestamp: Utc::now(),
                        severity: AlertSeverity::Low,
                    });
                }
            }

            // Detect unusual protocols
            let protocol_count = self.baseline_protocols.get(&protocol_str).copied().unwrap_or(0);
            let protocol_ratio = protocol_count as f64 / self.packet_count as f64;

            if protocol_ratio < 0.001 && protocol_count < 5 {
                alerts.push(AnomalyAlert {
                    anomaly_type: AnomalyType::UnusualProtocol,
                    src_ip: packet.src_ip,
                    dst_ip: packet.dst_ip,
                    description: format!("Unusual protocol: {:?}", packet.protocol),
                    timestamp: Utc::now(),
                    severity: AlertSeverity::Medium,
                });
            }
        }

        // Reset baseline periodically
        if self.packet_count >= self.window_size * 2 {
            self.baseline_ports.clear();
            self.baseline_protocols.clear();
            self.packet_count = 0;
        }

        alerts
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::parser::{ParsedPacket, Protocol};

    #[test]
    fn test_anomaly_detector() {
        let mut detector = AnomalyDetector::new(100);

        // Build baseline
        for _ in 0..150 {
            let packet = ParsedPacket {
                src_ip: Some(Ipv4Addr::new(192, 168, 1, 1)),
                dst_ip: Some(Ipv4Addr::new(192, 168, 1, 2)),
                src_port: Some(12345),
                dst_port: Some(80),
                protocol: Protocol::Tcp,
                flags: None,
                payload: vec![],
            };
            detector.analyze(&packet);
        }

        // Anomaly should be detected
        assert!(detector.packet_count > 100);
    }
}

pub mod port_scan;
pub mod anomaly;

pub use port_scan::{PortScanAlert, PortScanDetector, ScanType};
pub use anomaly::{AnomalyAlert, AnomalyDetector, AnomalyType};

use crate::parser::ParsedPacket;
use anyhow::Result;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use std::net::Ipv4Addr;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SignatureAlert {
    pub rule_id: String,
    pub rule_name: String,
    pub src_ip: Option<Ipv4Addr>,
    pub dst_ip: Option<Ipv4Addr>,
    pub description: String,
    pub timestamp: DateTime<Utc>,
    pub severity: AlertSeverity,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AlertSeverity {
    Low,
    Medium,
    High,
    Critical,
}

#[derive(Debug, Clone)]
pub struct SignatureRule {
    pub id: String,
    pub name: String,
    pub pattern: Vec<u8>,
    pub severity: AlertSeverity,
}

pub struct SignatureEngine {
    rules: Vec<SignatureRule>,
}

impl SignatureEngine {
    pub fn new() -> Self {
        let mut engine = SignatureEngine {
            rules: Vec::new(),
        };

        // Add example rules
        engine.add_rule(SignatureRule {
            id: "1001".to_string(),
            name: "SQL Injection Attempt".to_string(),
            pattern: b"UNION SELECT".to_vec(),
            severity: AlertSeverity::High,
        });

        engine.add_rule(SignatureRule {
            id: "1002".to_string(),
            name: "XSS Attempt".to_string(),
            pattern: b"<script>".to_vec(),
            severity: AlertSeverity::Medium,
        });

        engine.add_rule(SignatureRule {
            id: "1003".to_string(),
            name: "Directory Traversal".to_string(),
            pattern: b"../".to_vec(),
            severity: AlertSeverity::High,
        });

        engine
    }

    pub fn add_rule(&mut self, rule: SignatureRule) {
        self.rules.push(rule);
    }

    pub fn analyze(&self, packet: &ParsedPacket) -> Vec<SignatureAlert> {
        let mut alerts = Vec::new();

        // Check payload against all rules
        for rule in &self.rules {
            if self.contains_pattern(&packet.payload, &rule.pattern) {
                alerts.push(SignatureAlert {
                    rule_id: rule.id.clone(),
                    rule_name: rule.name.clone(),
                    src_ip: packet.src_ip,
                    dst_ip: packet.dst_ip,
                    description: format!("Signature match: {}", rule.name),
                    timestamp: Utc::now(),
                    severity: rule.severity.clone(),
                });
            }
        }

        alerts
    }

    fn contains_pattern(&self, data: &[u8], pattern: &[u8]) -> bool {
        if pattern.is_empty() || data.len() < pattern.len() {
            return false;
        }

        data.windows(pattern.len()).any(|window| window == pattern)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::parser::{ParsedPacket, Protocol};

    #[test]
    fn test_signature_matching() {
        let engine = SignatureEngine::new();
        
        let packet = ParsedPacket {
            src_ip: Some(Ipv4Addr::new(192, 168, 1, 1)),
            dst_ip: Some(Ipv4Addr::new(192, 168, 1, 2)),
            src_port: Some(12345),
            dst_port: Some(80),
            protocol: Protocol::Tcp,
            flags: None,
            payload: b"UNION SELECT * FROM users".to_vec(),
        };

        let alerts = engine.analyze(&packet);
        assert!(!alerts.is_empty());
    }
}

pub mod port_scan;
pub mod anomaly;
pub mod signature;

pub use port_scan::{PortScanAlert, PortScanDetector, ScanType};
pub use anomaly::{AnomalyAlert, AnomalyDetector, AnomalyType};
pub use signature::{SignatureAlert, SignatureEngine};

use crate::detection::{AnomalyAlert, PortScanAlert, SignatureAlert};
use anyhow::Result;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use std::fs::OpenOptions;
use std::io::Write;
use std::sync::Arc;
use tokio::sync::mpsc;
use tracing::{error, info, warn};

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type")]
pub enum Alert {
    PortScan(PortScanAlert),
    Anomaly(AnomalyAlert),
    Signature(SignatureAlert),
}

pub struct AlertSystem {
    log_file: Option<String>,
    alert_tx: Option<Arc<mpsc::Sender<Alert>>>,
}

impl AlertSystem {
    pub fn new(log_file: Option<String>, alert_tx: Option<Arc<mpsc::Sender<Alert>>>) -> Self {
        AlertSystem { log_file, alert_tx }
    }

    pub async fn send_alert(&self, alert: &Alert) -> Result<()> {
        // Send to dashboard if channel available
        if let Some(ref tx) = self.alert_tx {
            if tx.send(alert.clone()).await.is_err() {
                warn!("Alert channel closed, dropping alert");
            }
        }

        // Log to file
        if let Some(ref log_path) = self.log_file {
            let mut file = OpenOptions::new()
                .create(true)
                .append(true)
                .open(log_path)?;

            let json = serde_json::to_string(alert)?;
            writeln!(file, "{}", json)?;
        }

        // Print to console
        match alert {
            Alert::PortScan(ps) => {
                info!(
                    "[PORT SCAN] {} -> {}: {:?} ({:?})",
                    ps.src_ip, ps.dst_ip, ps.scan_type, ps.severity
                );
            }
            Alert::Anomaly(an) => {
                warn!(
                    "[ANOMALY] {:?}: {} ({:?})",
                    an.anomaly_type, an.description, an.severity
                );
            }
            Alert::Signature(sig) => {
                error!(
                    "[SIGNATURE] {}: {} ({:?})",
                    sig.rule_id, sig.rule_name, sig.severity
                );
            }
        }

        Ok(())
    }
}

use anyhow::Result;
use clap::Parser;
use std::sync::Arc;
use tokio::sync::mpsc;
use tracing::{error, info};
use tracing_subscriber;

mod alert;
mod capture;
mod detection;
mod parser;

use alert::{Alert, AlertSystem};
use capture::{CapturedPacket, PacketCapturer};
use detection::{AnomalyDetector, PortScanDetector, SignatureEngine};
use parser::{PacketParser, ParsedPacket};

#[derive(Parser, Debug)]
#[command(author, version, about)]
struct Args {
    /// Network interface to monitor
    #[arg(short, long)]
    interface: Option<String>,

    /// Alert log file
    #[arg(short, long)]
    log_file: Option<String>,

    /// Port scan threshold
    #[arg(long, default_value_t = 10)]
    port_scan_threshold: usize,

    /// Port scan time window (seconds)
    #[arg(long, default_value_t = 60)]
    port_scan_window: u64,

    /// Enable verbose logging
    #[arg(short, long)]
    verbose: bool,
}

#[tokio::main]
async fn main() -> Result<()> {
    let args = Args::parse();

    // Initialize logging
    tracing_subscriber::fmt()
        .with_env_filter(if args.verbose {
            "debug"
        } else {
            "info"
        })
        .init();

    info!("Starting Rust NIDS");

    // Create alert channel for dashboard
    let (alert_tx, alert_rx) = mpsc::channel::<Alert>(1000);
    let alert_tx_arc = Arc::new(alert_tx);

    // Initialize components
    let capturer = PacketCapturer::new(args.interface)?;
    let mut port_scan_detector = PortScanDetector::new(
        args.port_scan_window,
        args.port_scan_threshold,
    );
    let mut anomaly_detector = AnomalyDetector::new(1000);
    let signature_engine = SignatureEngine::new();
    let alert_system = AlertSystem::new(
        args.log_file,
        Some(alert_tx_arc.clone()),
    );

    // Create packet processing channel
    let (packet_tx, mut packet_rx) = mpsc::channel::<CapturedPacket>(10000);

    // Start packet capture
    let capture_handle = capturer.start_capture(packet_tx)?;

    info!("NIDS monitoring started. Press Ctrl+C to stop.");

    // Process packets
    let processing_handle = tokio::spawn(async move {
        let mut packet_count = 0;

        while let Some(packet) = packet_rx.recv().await {
            packet_count += 1;

            // Parse packet
            let parsed = match PacketParser::parse(&packet.data) {
                Ok(Some(p)) => p,
                Ok(None) => continue, // Not a packet we care about
                Err(e) => {
                    error!("Packet parse error: {}", e);
                    continue;
                }
            };

            // Run detection engines
            // Port scan detection
            for alert in port_scan_detector.analyze(&parsed) {
                if let Err(e) = alert_system.send_alert(&Alert::PortScan(alert)).await {
                    error!("Failed to send alert: {}", e);
                }
            }

            // Anomaly detection
            for alert in anomaly_detector.analyze(&parsed) {
                if let Err(e) = alert_system.send_alert(&Alert::Anomaly(alert)).await {
                    error!("Failed to send alert: {}", e);
                }
            }

            // Signature detection
            for alert in signature_engine.analyze(&parsed) {
                if let Err(e) = alert_system.send_alert(&Alert::Signature(alert)).await {
                    error!("Failed to send alert: {}", e);
                }
            }

            if packet_count % 1000 == 0 {
                info!("Processed {} packets", packet_count);
            }
        }
    });

    // Wait for shutdown
    tokio::select! {
        _ = tokio::signal::ctrl_c() => {
            info!("Shutting down...");
        }
        _ = capture_handle => {
            error!("Packet capture stopped unexpectedly");
        }
        _ = processing_handle => {
            error!("Packet processing stopped unexpectedly");
        }
    }

    Ok(())
}