Suricata 得名于非洲草原上的猫鼬(学名 Suricata suricatta)——猫鼬群居,总有几只直立放哨,一有风吹草动就尖声报警。2009 年 OISF(Open Information Security Foundation)用这个名字做了一个开源、多线程的下一代 IDS/IPS 引擎,想在当时近乎单线程的 Snort 之外给出另一个选择。名字挑得很贴切:这个引擎干的也是同一件事——盯着每一个包,一有可疑动静就吼一声。

具体是怎么盯的?跟着一个包走一遍就知道了。它从网卡钻进 Suricata 的那一刻开始,会经过哪些地方,又是怎么一步步变成一条 EVE JSON 告警的?它会被谁接住,在哪一步变成 Packet,什么时候和别的包组成 Flow,TCP 重组又是谁负责的?规则看起来只是一行文本,为什么加载之后却能参与几万次匹配?这些问题,光看配置手册很难得到答案——手册告诉你怎么用这台机器,不告诉你机器里齿轮怎么咬合。真正的答案藏在 Suricata 的线程、队列、状态机和那些名字并不总是直观的 C 结构体里。

把 Suricata 想象成一条工厂流水线:包从网卡或 pcap 文件进来,依次经过捕获、解码、Flow、Stream、应用层解析、规则检测这几道工位,才走到终点。先给这条产线画一张图,后面每一篇都是在往图里的某一格添细节:

%%{init: {"flowchart": {"nodeSpacing": 25, "rankSpacing": 45, "padding": 5, "useMaxWidth": true}}}%%
flowchart LR
    A["网卡 / PCAP 文件"] --> B
    subgraph B["第3篇:捕获"]
        B1["AF_PACKET / PCAP / NFQ"]
    end
    subgraph C["第4篇:解码"]
        C1["Ether / IP / TCP"]
    end
    subgraph D["第5篇:Flow"]
        D1["查找 / 建立"]
    end
    B --> C --> D

%%{init: {"flowchart": {"nodeSpacing": 25, "rankSpacing": 45, "padding": 5, "useMaxWidth": true}}}%%
flowchart LR
    subgraph E["第6篇:Stream"]
        E1["TCP 重组"]
    end
    subgraph F["第7篇:应用层解析"]
        F1["HTTP / TLS ..."]
    end
    subgraph G["第8-9篇:规则检测"]
        G1["MPM + SGH"]
    end
    subgraph H["第10篇:输出/告警"]
        H1["EVE JSON"]
    end
    E --> F --> G --> H

第一部分：逻辑学入门

“逻辑是思维的语法。”

你有没有遇到过这种情况：和别人争论了半天，最后发现根本说不清谁对谁错？或者听一段话觉得很有道理，但总觉得哪里不对劲，又说不出问题出在哪。

这多半是缺乏逻辑训练。逻辑学做的事情，就是把这种”说不清楚的感觉”变成”能讲明白的判断”。

I’m a happiness scientist, and I’ve been a happiness scientist for 36 years. For my entire professional career, I’ve been obsessed with learning the secrets to being a happy person – with trying to answer the question: Can anyone become happier?

Now how do we even study something like that? Well, in 1998, my lab pioneered what we call happiness interventions. Happiness interventions are experiments with human participants. Over the years, we’ve done dozens of these experiments, testing whether practices like expressing gratitude or doing acts of kindness or simply acting like an extrovert make people happier. And they do. Under the right conditions.

My students and I spent decades doing these experiments. This work made my career, and yet I realized that I hadn’t really been listening to what the data were trying to tell me. And then it finally clicked. It dawned on me that almost all of the interventions that work to make us happier, they work precisely because they help us feel more connected to and loved by others. So writing a gratitude letter to my mom makes me feel more loved by her. And doing an act of kindness for my colleague makes me feel closer to him. In other words, what I learned is that to be a better happiness scientist, I had to become a love scientist. Because, as it turns out, the key to happiness is feeling connected and loved.

You’re probably going to quit your new years resolution.

And that’s okay. Most people do (studies show 80-90% failure rates) because most people don’t actually want to change on a deep, internal level. That is, they go about changing their life in the completely wrong way. They create a new years resolution because everyone else does – humans want to impress others more than they want to impress themselves… we create a superficial meaning out of status games – but they don’t meet the requirements for true change, which goes a lot deeper than convincing yourself you’re going to be more disciplined or productive this year.

I’m not here to talk down on you. I’ve quit 10 times more goals than I’ve set. I think that should be the case for most people. But the fact that people try to change their lives and utterly fail almost every time holds true. So much so that it’s a meme for the gym to be crowded during January and return back to normal in February.

However, as much as I think new years resolutions are stupid, it’s always wise to reflect on the life you hate so you can launch yourself toward something that much better, as we will discuss.

Human nature is a b*tch, and the worst feeling is when you make a promise to yourself and can’t help but break it. You start to feel helpless, and if you don’t know what you’re doing, you may continue the cycle for years on end: always wanting to change, but never being able to.

So whether you want to start the business, transform your body, or take the risk toward a more meaningful life without quitting after 2 weeks, I want to share 7 ideas you probably haven’t heard before on behavior change, psychology, and productivity so you can do just that in 2026.

This will be comprehensive.

Background

This speech was originally delivered by Ken Robinson at TED2006.

Speech Transcript

Good morning. How are you?

It’s been great, hasn’t it? I’ve been blown away by the whole thing. In fact, I’m leaving.

There have been three themes running through the conference which are relevant to what I want to talk about. One is the extraordinary evidence of human creativity in all of the presentations that we’ve had and in all of the people here. Just the variety of it and the range of it. The second is that it’s put us in a place where we have no idea what’s going to happen, in terms of the future. No idea how this may play out.

I have an interest in education. Actually, what I find is everybody has an interest in education. Don’t you? I find this very interesting. If you’re at a dinner party, and you say you work in education — Actually, you’re not often at dinner parties, frankly.

📚 结构总览

豫章故郡，洪都新府。星分翼轸，地接衡庐。襟三江而带五湖，控蛮荆而引瓯越。物华天宝，龙光射牛斗之墟；人杰地灵，徐孺下陈蕃之榻。雄州雾列，俊采星驰。台隍枕夷夏之交，宾主尽东南之美。都督阎公之雅望，棨戟遥临；宇文新州之懿范，襜帷暂驻。十旬休假，胜友如云；千里逢迎，高朋满座。腾蛟起凤，孟学士之词宗；紫电青霜，王将军之武库。家君作宰，路出名区；童子何知，躬逢胜饯。

时维九月，序属三秋。潦水尽而寒潭清，烟光凝而暮山紫。俨骖騑于上路，访风景于崇阿。临帝子之长洲，得天人之旧馆。层峦耸翠，上出重霄；飞阁流丹，下临无地。鹤汀凫渚，穷岛屿之萦回；桂殿兰宫，即冈峦之体势。

披绣闼，俯雕甍，山原旷其盈视，川泽纡其骇瞩。闾阎扑地，钟鸣鼎食之家；舸舰迷津，青雀黄龙之舳。云销雨霁，彩彻区明。落霞与孤鹜齐飞，秋水共长天一色。渔舟唱晚，响穷彭蠡之滨，雁阵惊寒，声断衡阳之浦。

遥襟甫畅，逸兴遄飞。爽籁发而清风生，纤歌凝而白云遏。睢园绿竹，气凌彭泽之樽；邺水朱华，光照临川之笔。四美具，二难并。穷睇眄于中天，极娱游于暇日。天高地迥，觉宇宙之无穷；兴尽悲来，识盈虚之有数。望长安于日下，目吴会于云间。地势极而南溟深，天柱高而北辰远。关山难越，谁悲失路之人；萍水相逢，尽是他乡之客。怀帝阍而不见，奉宣室以何年？

　　庆历四年春，滕子京谪守巴陵郡。越明年，政通人和，百废具兴，乃重修岳阳楼，增其旧制，刻唐贤今人诗赋于其上，属予作文以记之。

　　予观夫巴陵胜状，在洞庭一湖。衔远山，吞长江，浩浩汤汤，横无际涯，朝晖夕阴，气象万千，此则岳阳楼之大观也，前人之述备矣。然则北通巫峡，南极潇湘，迁客骚人，多会于此，览物之情，得无异乎？

　　若夫淫雨霏霏，连月不开，阴风怒号，浊浪排空，日星隐曜，山岳潜形，商旅不行，樯倾楫摧，薄暮冥冥，虎啸猿啼。登斯楼也，则有去国怀乡，忧谗畏讥，满目萧然，感极而悲者矣。

　　至若春和景明，波澜不惊，上下天光，一碧万顷，沙鸥翔集，锦鳞游泳，岸芷汀兰，郁郁青青。而或长烟一空，皓月千里，浮光跃金，静影沉璧，渔歌互答，此乐何极！登斯楼也，则有心旷神怡，宠辱偕忘，把酒临风，其喜洋洋者矣。

　　嗟夫！予尝求古仁人之心，或异二者之为，何哉？不以物喜，不以己悲，居庙堂之高则忧其民，处江湖之远则忧其君。是进亦忧，退亦忧。然则何时而乐耶？其必曰“先天下之忧而忧，后天下之乐而乐”乎！噫！微斯人，吾谁与归？

　　时六年九月十五日。

一

道可道，非常道；名可名，非常名。无，名天地之始；有，名万物之母。故常无，欲以观其妙；常有，欲以观其徼。此两者，同出而异名，同谓之玄。玄之又玄，众妙之门。

这是老子对”道”的核心阐述：

道可道，非常道；名可名，非常名（道的本质）

• 能够说出来的”道”，就不是永恒不变的道
• 能够命名的”名”，就不是永恒不变的名
• 意思：真正的”道”超越语言文字，一旦说出来就变味了

无，名天地之始；有，名万物之母（有与无）

• “无”是天地的开端（混沌未分的状态）
• “有”是万物的根源（具体事物的来源）

故常无，欲以观其妙；常有，欲以观其徼

• 从”无”的角度，可以观察道的奥妙
• 从”有”的角度，可以观察道的边界（具体表现）

此两者同出而异名，同谓之玄，玄之又玄，众妙之门（玄妙之门）

• “有”和”无”本是一体，只是名称不同
• 都可称为”玄”（深奥难测）
• 玄之又玄，是一切奥妙的门户

总结

道理说不清，一说就错；真理无法用语言完全表达。宇宙从”无”开始，演化出”有”。要从”无形”中体会本质，从”有形”中观察现象。虚与实本是一体，深不可测，这就是理解万物的入口。

我们将表的格式从未排序的行数组更改为 B 树。这是一个很大的改动，需要多篇文章来实现。在本文的结尾，我们将定义叶节点的布局，并支持将键/值对插入到单节点树中。但首先，让我们回顾一下切换到树结构的原因。

替代表格格式

使用当前格式，每个页面仅存储行（无元数据），因此非常节省空间。插入也很快速，因为我们只需追加到末尾即可。但是，只能通过扫描整个表来查找特定行。如果要删除一行，则必须通过移动其后的每一行来填补该空缺。

如果我们将表存储为数组，但按 id 对行进行排序，则可以使用二分查找来查找特定 id。但是，插入会很慢，因为我们必须移动很多行来腾出空间。

相反，我们采用树结构。树中的每个节点可以包含可变数量的行，因此我们必须在每个节点中存储一些信息以跟踪其包含的行数。此外，还有所有不存储任何行的内部节点的存储开销。作为交换，虽然数据库文件变大了，但我们获得了快速的插入、删除和查找功能。