Eazow

这是系列第 2 篇。上一篇跟着 main() 走完了启动的五个阶段：RunModeDispatch() 把线程一个个创建出来，SuricataPostInit() 等它们就位后统一放行。但线程里面具体装了什么、放行之后怎么干活，上一篇没有展开。这一篇就拆开一个线程看：TmModule 怎么变成线程里真正在跑的代码？一个包在同一个线程里怎么连续闯过好几道工位？single、autofp、workers 这三种排班方式，差别到底落在哪一行代码上？

先看全貌。下面这张图把本篇要讲的东西都画在了一起，读完再回来看会更清楚：

这是系列第 1 篇。先不急着钻进协议解析器，也不急着看规则怎么匹配，而是跟着 Suricata 启动一遍：从命令行参数和配置文件出发，一路走到真正开始收包。后面每一篇，都会回到这张地图上的某个位置继续往下挖。

先给答案：从 main() 到第一个包被处理，Suricata 要走五个阶段。

1. 读懂命令：解析命令行，确认这次以什么模式运行，读入 suricata.yaml。
2. 备料：按配置把各个子系统初始化好——注册模块、加载规则、放弃多余的权限。
3. 搭产线：按运行模式把处理模块串成流水线，创建工作线程和管理线程。
4. 放行：等所有线程都准备好，统一发令开工。
5. 值守与收工：主线程退到一边响应信号，收到停止信号后再把线程逐个关掉。

这五个阶段里藏着一条最值得抓住的线：前两个阶段只有主线程一个人在干活；第 3 阶段开始一个个新线程被创建出来，但都原地待命；直到第 4 阶段放行那一刻，进程才真正变成多线程并发运行。

入口在 src/main.c:20。main() 的主体就是十来个函数调用，正好能和这五个阶段对上(省略了错误检查和 Windows 相关代码)：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

int main(int argc, char **argv)
{
    /* 阶段 1：读懂命令 */
    SuricataPreInit(argv[0]);                  // 早期初始化，注册所有运行模式
    SCParseCommandLine(argc, argv);            // 解析命令行参数到 SCInstance
    SCFinalizeRunMode();                       // 校验运行模式
    SCStartInternalRunMode(argc, argv);        // --list-* 之类"跑完就退出"的模式
    SCLoadYamlConfig();                        // 加载 suricata.yaml
    SCEnableDefaultSignalHandlers();           // 标记：稍后安装默认信号处理函数

    /* 阶段 2 + 3：备料、搭产线，都在 SuricataInit() 里 */
    SuricataInit();

    /* 阶段 4：放行 */
    SuricataPostInit();                        // 等待所有线程 init 完成，再放行

    /* 阶段 5：值守与收工 */
    SuricataMainLoop();                        // 主线程的事件循环
    SuricataShutdown();
    GlobalsDestroy();
}

把这五个阶段画出来，就是下面这张图。后面每一节对应图里的一段，读的时候可以随时回来看看自己走到了哪里：

在一个有 Suricata 盯着的网络里，执行一次：

1

curl http://example.com/

几毫秒后，Suricata 的 eve.json 里多出这样一行(为了好读，这里做了换行和缩进；字段顺序与 8.0.7 的实际输出一致)：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

{
  "timestamp": "2026-09-24T14:03:21.482913+0800",
  "flow_id": 1712362980541209,
  "in_iface": "eth0",
  "event_type": "http",
  "src_ip": "10.0.0.23",
  "src_port": 51724,
  "dest_ip": "93.184.215.14",
  "dest_port": 80,
  "proto": "TCP",
  "ip_v": 4,
  "pkt_src": "wire/pcap",
  "tx_id": 0,
  "http": {
    "hostname": "example.com",
    "url": "/",
    "http_user_agent": "curl/8.7.1",
    "http_content_type": "text/html",
    "http_method": "GET",
    "protocol": "HTTP/1.1",
    "status": 200,
    "length": 1256
  }
}

从网线上的一串字节，到这行结构清楚的 JSON，中间发生了什么？这个系列想回答的就是这个问题。

“逻辑是思维的语法。”

你一定有过这样的时刻：和人争了半天，面红耳赤，最后谁也说服不了谁；或者听完一段话，句句都像有道理，心里却总有根刺，说不出扎在哪儿。

逻辑学要做的，就是把那根刺拔出来，放到灯下看清楚。

I’m a happiness scientist, and I’ve been a happiness scientist for 36 years. For my entire professional career, I’ve been obsessed with learning the secrets to being a happy person – with trying to answer the question: Can anyone become happier?

Now how do we even study something like that? Well, in 1998, my lab pioneered what we call happiness interventions. Happiness interventions are experiments with human participants. Over the years, we’ve done dozens of these experiments, testing whether practices like expressing gratitude or doing acts of kindness or simply acting like an extrovert make people happier. And they do. Under the right conditions.

My students and I spent decades doing these experiments. This work made my career, and yet I realized that I hadn’t really been listening to what the data were trying to tell me. And then it finally clicked. It dawned on me that almost all of the interventions that work to make us happier, they work precisely because they help us feel more connected to and loved by others. So writing a gratitude letter to my mom makes me feel more loved by her. And doing an act of kindness for my colleague makes me feel closer to him. In other words, what I learned is that to be a better happiness scientist, I had to become a love scientist. Because, as it turns out, the key to happiness is feeling connected and loved.

You’re probably going to quit your new years resolution.

And that’s okay. Most people do (studies show 80-90% failure rates) because most people don’t actually want to change on a deep, internal level. That is, they go about changing their life in the completely wrong way. They create a new years resolution because everyone else does – humans want to impress others more than they want to impress themselves… we create a superficial meaning out of status games – but they don’t meet the requirements for true change, which goes a lot deeper than convincing yourself you’re going to be more disciplined or productive this year.

I’m not here to talk down on you. I’ve quit 10 times more goals than I’ve set. I think that should be the case for most people. But the fact that people try to change their lives and utterly fail almost every time holds true. So much so that it’s a meme for the gym to be crowded during January and return back to normal in February.

However, as much as I think new years resolutions are stupid, it’s always wise to reflect on the life you hate so you can launch yourself toward something that much better, as we will discuss.

Human nature is a b*tch, and the worst feeling is when you make a promise to yourself and can’t help but break it. You start to feel helpless, and if you don’t know what you’re doing, you may continue the cycle for years on end: always wanting to change, but never being able to.

So whether you want to start the business, transform your body, or take the risk toward a more meaningful life without quitting after 2 weeks, I want to share 7 ideas you probably haven’t heard before on behavior change, psychology, and productivity so you can do just that in 2026.

This will be comprehensive.

Background

This speech was originally delivered by Ken Robinson at TED2006.

Speech Transcript

Good morning. How are you?

It’s been great, hasn’t it? I’ve been blown away by the whole thing. In fact, I’m leaving.

There have been three themes running through the conference which are relevant to what I want to talk about. One is the extraordinary evidence of human creativity in all of the presentations that we’ve had and in all of the people here. Just the variety of it and the range of it. The second is that it’s put us in a place where we have no idea what’s going to happen, in terms of the future. No idea how this may play out.

I have an interest in education. Actually, what I find is everybody has an interest in education. Don’t you? I find this very interesting. If you’re at a dinner party, and you say you work in education — Actually, you’re not often at dinner parties, frankly.

风急天高猿啸哀，渚清沙白鸟飞回。
无边落木萧萧下，不尽长江滚滚来。
万里悲秋常作客，百年多病独登台。
艰难苦恨繁霜鬓，潦倒新停浊酒杯。

明代胡应麟在《诗薮》里称这首诗”古今七言律第一”。短短 56 个字，前四句写秋景，后四句写自己。景写得极开阔，情写得极沉重，两者压在一起，就是杜甫晚年的全部处境。

📚 结构总览

豫章故郡，洪都新府。星分翼轸，地接衡庐。襟三江而带五湖，控蛮荆而引瓯越。物华天宝，龙光射牛斗之墟；人杰地灵，徐孺下陈蕃之榻。雄州雾列，俊采星驰。台隍枕夷夏之交，宾主尽东南之美。都督阎公之雅望，棨戟遥临；宇文新州之懿范，襜帷暂驻。十旬休假，胜友如云；千里逢迎，高朋满座。腾蛟起凤，孟学士之词宗；紫电青霜，王将军之武库。家君作宰，路出名区；童子何知，躬逢胜饯。

时维九月，序属三秋。潦水尽而寒潭清，烟光凝而暮山紫。俨骖騑于上路，访风景于崇阿。临帝子之长洲，得天人之旧馆。层峦耸翠，上出重霄；飞阁流丹，下临无地。鹤汀凫渚，穷岛屿之萦回；桂殿兰宫，即冈峦之体势。

披绣闼，俯雕甍，山原旷其盈视，川泽纡其骇瞩。闾阎扑地，钟鸣鼎食之家；舸舰迷津，青雀黄龙之舳。云销雨霁，彩彻区明。落霞与孤鹜齐飞，秋水共长天一色。渔舟唱晚，响穷彭蠡之滨，雁阵惊寒，声断衡阳之浦。

遥襟甫畅，逸兴遄飞。爽籁发而清风生，纤歌凝而白云遏。睢园绿竹，气凌彭泽之樽；邺水朱华，光照临川之笔。四美具，二难并。穷睇眄于中天，极娱游于暇日。天高地迥，觉宇宙之无穷；兴尽悲来，识盈虚之有数。望长安于日下，目吴会于云间。地势极而南溟深，天柱高而北辰远。关山难越，谁悲失路之人；萍水相逢，尽是他乡之客。怀帝阍而不见，奉宣室以何年？