Maltrail is a production-grade malicious traffic detection system that monitors network traffic in real-time, matching against a dynamic set of threat indicators (trails) and applying behavioral heuristics. It consists of two main components: a high-performance Rust sensor for packet capture and analysis, and a Python server for event intake, web dashboard, and API. The sensor uses libpcap for live capture or offline pcap replay, parses protocols (DNS, HTTP, TLS, QUIC), and performs trail matching and heuristic detection (port scanning, beaconing, DNS tunneling/exhaustion). Events are sent to the server via UDP or stored locally. The server provides a web UI for visualization, search, and management, supports remote logging to SIEMs (syslog, CEF, Logstash), and exposes a REST API for integration. The architecture is modular: the sensor is a multi-threaded Rust binary with lock-free metrics, memory-mapped trail stores, and fuzz-tested protocol parsers. The Python server handles configuration, trail updates from 40+ threat feeds, event logging, and the web interface. The system is designed for scalability with multi-worker capture, bounded memory heuristics, and efficient data structures (LRU caches, interned strings, hash tables). External dependencies include libpcap, SQLite, and various threat feed sources. The codebase demonstrates high craftsmanship with extensive testing (unit, integration, fuzz, parity tests between Rust and Python), CI/CD pipelines, and Docker/systemd deployment support.
This is the Adafruit GPS Library, an Arduino library for reading NMEA sentences from GPS/GNSS modules via UART, I2C, or SPI. It provides a high-level API (`Adafruit_GPS`) that exposes parsed position, time, speed, and other navigation data as simple member variables. The library also includes a newer, hardware-independent NMEA framing and decoding layer (`Adafruit_NMEA` and `Adafruit_GNSS`) that can be reused outside the Arduino context. Example sketches demonstrate wiring, parsing, LOCUS logging, and SD card data logging. The codebase is well-structured with clear separation between transport, framing, and position decoding. Extensive regression tests run on Linux using a mocking layer, with AddressSanitizer and UndefinedBehaviorSanitizer enabled. The architecture is a traditional Arduino library: users instantiate an `Adafruit_GPS` object with a `Stream` (hardware serial, software serial, I2C, or SPI), call `read()` frequently to consume bytes, then check `newNMEAreceived()` and call `parse()` to update fields. A newer `lastPosition()` getter provides exact coordinate components without modifying legacy state. The low-level `Adafruit_NMEA` class handles byte-by-byte framing with bounded buffers, checksum validation, and field iteration. `Adafruit_GNSS` adds static coordinate, time, and date parsing functions plus sentence validation for GGA, RMC, and GLL. Both classes are free of heap allocation and floating-point arithmetic where possible. The library is actively maintained with recent commits, a CI pipeline, and a single open issue. Technical drift is low: dependencies are limited to the Arduino core and standard libraries. The code demonstrates strong software engineering practices, including test-driven development, bounded buffers to prevent overflow, and a clean public API. The newer GNSS/NMEA components are reusable in other embedded or host projects with minimal adaptation.
This repository is a comprehensive IoT device driver library for .NET nanoFramework. It provides bindings for hundreds of sensors, actuators, displays, and communication modules (e.g., BME280, SSD1306, NFC, Modbus, cellular modems, GPS). The architecture is a collection of independent driver projects, each with its own samples, tests, and documentation. Shared utility libraries (e.g., System.Device.Model, NumberHelper, SpanByte compatibility shims) support cross-cutting concerns. The codebase is actively maintained with frequent commits, but the sheer number of drivers (300+) leads to varying quality, some code duplication (e.g., SpanByte classes in multiple locations), and partially auto-generated code. Networking components like DHCP server, DNS server, and Home Assistant MQTT integration extend the library beyond raw sensor access. The primary use case is building embedded IoT applications on microcontrollers (ESP32, STM32) running nanoFramework.