这是系列第 1 篇。我们先不急着钻进某个协议解析器，也不急着看规则是怎么匹配的。先跟着 Suricata 启动一遍，看看它如何从命令行参数和配置文件，一路走到真正可以接收数据包的状态。后面每篇文章，都会回到这张地图上的某个位置继续往下挖。

1. 先看一眼:这个引擎准备怎么工作

把 Suricata 想象成一条工厂流水线:网卡或者 pcap 文件是原料入口，每一个包从这里进来，依次经过一道道工位——捕获 → 解码 → 流跟踪 → TCP 重组 → 应用层解析 → 规则检测 → 输出，最后变成一条告警从流水线尽头掉出来。每道工位是一个可插拔的模块，若干个工位串成一条线，挂在一个或多个线程(也就是”工人”)身上跑。

Suricata 得名于非洲草原上的猫鼬(学名 Suricata suricatta)——猫鼬群居，总有几只直立放哨，一有风吹草动就尖声报警。2009 年 OISF(Open Information Security Foundation)用这个名字做了一个开源、多线程的下一代 IDS/IPS 引擎，想在当时近乎单线程的 Snort 之外给出另一个选择。名字挑得很贴切:这个引擎干的也是同一件事——盯着每一个包，一有可疑动静就吼一声。

具体是怎么盯的？跟着一个包走一遍就知道了。它从网卡钻进 Suricata 的那一刻开始，会经过哪些地方，又是怎么一步步变成一条 EVE JSON 告警的？它会被谁接住，在哪一步变成 Packet，什么时候和别的包组成 Flow，TCP 重组又是谁负责的？规则看起来只是一行文本，为什么加载之后却能参与几万次匹配？这些问题，光看配置手册很难得到答案——手册告诉你怎么用这台机器，不告诉你机器里齿轮怎么咬合。真正的答案藏在 Suricata 的线程、队列、状态机和那些名字并不总是直观的 C 结构体里。

把 Suricata 想象成一条工厂流水线:包从网卡或 pcap 文件进来，依次经过捕获、解码、Flow、Stream、应用层解析、规则检测这几道工位，才走到终点。先给这条产线画一张图，后面每一篇都是在往图里的某一格添细节:

%%{init: {"flowchart": {"nodeSpacing": 25, "rankSpacing": 45, "padding": 5, "useMaxWidth": true}}}%%
flowchart LR
    A["网卡 / PCAP 文件"] --> B
    subgraph B["第3篇:捕获"]
        B1["AF_PACKET / PCAP / NFQ"]
    end
    subgraph C["第4篇:解码"]
        C1["Ether / IP / TCP"]
    end
    subgraph D["第5篇:Flow"]
        D1["查找 / 建立"]
    end
    B --> C --> D

%%{init: {"flowchart": {"nodeSpacing": 25, "rankSpacing": 45, "padding": 5, "useMaxWidth": true}}}%%
flowchart LR
    subgraph E["第6篇:Stream"]
        E1["TCP 重组"]
    end
    subgraph F["第7篇:应用层解析"]
        F1["HTTP / TLS ..."]
    end
    subgraph G["第8-9篇:规则检测"]
        G1["MPM + SGH"]
    end
    subgraph H["第10篇:输出/告警"]
        H1["EVE JSON"]
    end
    E --> F --> G --> H

第一部分：逻辑学入门

“逻辑是思维的语法。”

你有没有遇到过这种情况：和别人争论了半天，最后发现根本说不清谁对谁错？或者听一段话觉得很有道理，但总觉得哪里不对劲，又说不出问题出在哪。

这多半是缺乏逻辑训练。逻辑学做的事情，就是把这种”说不清楚的感觉”变成”能讲明白的判断”。

I’m a happiness scientist, and I’ve been a happiness scientist for 36 years. For my entire professional career, I’ve been obsessed with learning the secrets to being a happy person – with trying to answer the question: Can anyone become happier?

Now how do we even study something like that? Well, in 1998, my lab pioneered what we call happiness interventions. Happiness interventions are experiments with human participants. Over the years, we’ve done dozens of these experiments, testing whether practices like expressing gratitude or doing acts of kindness or simply acting like an extrovert make people happier. And they do. Under the right conditions.

My students and I spent decades doing these experiments. This work made my career, and yet I realized that I hadn’t really been listening to what the data were trying to tell me. And then it finally clicked. It dawned on me that almost all of the interventions that work to make us happier, they work precisely because they help us feel more connected to and loved by others. So writing a gratitude letter to my mom makes me feel more loved by her. And doing an act of kindness for my colleague makes me feel closer to him. In other words, what I learned is that to be a better happiness scientist, I had to become a love scientist. Because, as it turns out, the key to happiness is feeling connected and loved.

You’re probably going to quit your new years resolution.

And that’s okay. Most people do (studies show 80-90% failure rates) because most people don’t actually want to change on a deep, internal level. That is, they go about changing their life in the completely wrong way. They create a new years resolution because everyone else does – humans want to impress others more than they want to impress themselves… we create a superficial meaning out of status games – but they don’t meet the requirements for true change, which goes a lot deeper than convincing yourself you’re going to be more disciplined or productive this year.

I’m not here to talk down on you. I’ve quit 10 times more goals than I’ve set. I think that should be the case for most people. But the fact that people try to change their lives and utterly fail almost every time holds true. So much so that it’s a meme for the gym to be crowded during January and return back to normal in February.

However, as much as I think new years resolutions are stupid, it’s always wise to reflect on the life you hate so you can launch yourself toward something that much better, as we will discuss.

Human nature is a b*tch, and the worst feeling is when you make a promise to yourself and can’t help but break it. You start to feel helpless, and if you don’t know what you’re doing, you may continue the cycle for years on end: always wanting to change, but never being able to.

So whether you want to start the business, transform your body, or take the risk toward a more meaningful life without quitting after 2 weeks, I want to share 7 ideas you probably haven’t heard before on behavior change, psychology, and productivity so you can do just that in 2026.

This will be comprehensive.

Background

This speech was originally delivered by Ken Robinson at TED2006.

Speech Transcript

Good morning. How are you?

It’s been great, hasn’t it? I’ve been blown away by the whole thing. In fact, I’m leaving.

There have been three themes running through the conference which are relevant to what I want to talk about. One is the extraordinary evidence of human creativity in all of the presentations that we’ve had and in all of the people here. Just the variety of it and the range of it. The second is that it’s put us in a place where we have no idea what’s going to happen, in terms of the future. No idea how this may play out.

I have an interest in education. Actually, what I find is everybody has an interest in education. Don’t you? I find this very interesting. If you’re at a dinner party, and you say you work in education — Actually, you’re not often at dinner parties, frankly.

📚 结构总览

豫章故郡，洪都新府。星分翼轸，地接衡庐。襟三江而带五湖，控蛮荆而引瓯越。物华天宝，龙光射牛斗之墟；人杰地灵，徐孺下陈蕃之榻。雄州雾列，俊采星驰。台隍枕夷夏之交，宾主尽东南之美。都督阎公之雅望，棨戟遥临；宇文新州之懿范，襜帷暂驻。十旬休假，胜友如云；千里逢迎，高朋满座。腾蛟起凤，孟学士之词宗；紫电青霜，王将军之武库。家君作宰，路出名区；童子何知，躬逢胜饯。

时维九月，序属三秋。潦水尽而寒潭清，烟光凝而暮山紫。俨骖騑于上路，访风景于崇阿。临帝子之长洲，得天人之旧馆。层峦耸翠，上出重霄；飞阁流丹，下临无地。鹤汀凫渚，穷岛屿之萦回；桂殿兰宫，即冈峦之体势。

披绣闼，俯雕甍，山原旷其盈视，川泽纡其骇瞩。闾阎扑地，钟鸣鼎食之家；舸舰迷津，青雀黄龙之舳。云销雨霁，彩彻区明。落霞与孤鹜齐飞，秋水共长天一色。渔舟唱晚，响穷彭蠡之滨，雁阵惊寒，声断衡阳之浦。

遥襟甫畅，逸兴遄飞。爽籁发而清风生，纤歌凝而白云遏。睢园绿竹，气凌彭泽之樽；邺水朱华，光照临川之笔。四美具，二难并。穷睇眄于中天，极娱游于暇日。天高地迥，觉宇宙之无穷；兴尽悲来，识盈虚之有数。望长安于日下，目吴会于云间。地势极而南溟深，天柱高而北辰远。关山难越，谁悲失路之人；萍水相逢，尽是他乡之客。怀帝阍而不见，奉宣室以何年？

　　庆历四年春，滕子京谪守巴陵郡。越明年，政通人和，百废具兴，乃重修岳阳楼，增其旧制，刻唐贤今人诗赋于其上，属予作文以记之。

　　予观夫巴陵胜状，在洞庭一湖。衔远山，吞长江，浩浩汤汤，横无际涯，朝晖夕阴，气象万千，此则岳阳楼之大观也，前人之述备矣。然则北通巫峡，南极潇湘，迁客骚人，多会于此，览物之情，得无异乎？

　　若夫淫雨霏霏，连月不开，阴风怒号，浊浪排空，日星隐曜，山岳潜形，商旅不行，樯倾楫摧，薄暮冥冥，虎啸猿啼。登斯楼也，则有去国怀乡，忧谗畏讥，满目萧然，感极而悲者矣。

　　至若春和景明，波澜不惊，上下天光，一碧万顷，沙鸥翔集，锦鳞游泳，岸芷汀兰，郁郁青青。而或长烟一空，皓月千里，浮光跃金，静影沉璧，渔歌互答，此乐何极！登斯楼也，则有心旷神怡，宠辱偕忘，把酒临风，其喜洋洋者矣。

　　嗟夫！予尝求古仁人之心，或异二者之为，何哉？不以物喜，不以己悲，居庙堂之高则忧其民，处江湖之远则忧其君。是进亦忧，退亦忧。然则何时而乐耶？其必曰“先天下之忧而忧，后天下之乐而乐”乎！噫！微斯人，吾谁与归？

　　时六年九月十五日。

一

道可道，非常道；名可名，非常名。无，名天地之始；有，名万物之母。故常无，欲以观其妙；常有，欲以观其徼。此两者，同出而异名，同谓之玄。玄之又玄，众妙之门。

这是老子对”道”的核心阐述：

道可道，非常道；名可名，非常名（道的本质）

• 能够说出来的”道”，就不是永恒不变的道
• 能够命名的”名”，就不是永恒不变的名
• 意思：真正的”道”超越语言文字，一旦说出来就变味了

无，名天地之始；有，名万物之母（有与无）

• “无”是天地的开端（混沌未分的状态）
• “有”是万物的根源（具体事物的来源）

故常无，欲以观其妙；常有，欲以观其徼

• 从”无”的角度，可以观察道的奥妙
• 从”有”的角度，可以观察道的边界（具体表现）

此两者同出而异名，同谓之玄，玄之又玄，众妙之门（玄妙之门）

• “有”和”无”本是一体，只是名称不同
• 都可称为”玄”（深奥难测）
• 玄之又玄，是一切奥妙的门户

总结

道理说不清，一说就错；真理无法用语言完全表达。宇宙从”无”开始，演化出”有”。要从”无形”中体会本质，从”有形”中观察现象。虚与实本是一体，深不可测，这就是理解万物的入口。