Turbine Softwork
Solutions

Vigil is a low-level network intrusion detection system written entirely in C, operating at the kernel boundary without abstractions. It captures raw Ethernet frames via SOCK_RAW sockets at the ETH_P_ALL protocol level, performing deterministic byte-level dissection of protocol headers across the full L2–L4 stack.

A stateful connection tracking engine maintains per-flow state across the packet stream, feeding a real-time threat detection pipeline capable of identifying port scan windows, SYN flood patterns, and malformed flag combinations with sub-millisecond latency. Detected events are persisted via structured alert_t records and streamed through a custom C server layer to a live web dashboard. Zero third-party dependencies at any layer of the stack.