---
title: "Architecture"
slug: "application-security-architecture"
updated: 2025-06-10T09:14:14Z
published: 2025-06-10T09:14:14Z
canonical: "docs.fmad.io/application-security-architecture"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fmad.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

FMADIO Security Container is based on the Linux Container and FMADIO Ring buffer components. For more details

- [FMADIO Ring](https://docs.fmad.io/docs/fmadio-os-internal-fmadio-ring)
- [FMADIO Linux Containers](https://docs.fmad.io/docs/fmadio-os-lxc-getting-packet)
- [Suricata Opensource Project](https://suricata.io/)

---

## Dataflow

The data pipeline for processing packets is shown below

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/FMADIO_Security.drawio (1).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D)

Brief explanation of each component

### Network Switch Packet Broker

Typically FMADIO devices are listening from a network switch’s SPAN / Mirror port, or receiving copies of the data from a Network Packet Broker.

### FMADIO Interface

This is the physical capture interface, physically plugged into a network Switch or network Packet Broker. This is typically fiber on a n SFP+/SFP28/QSFP+/QSFP28 high speed network interface

### FMADIO Capture

Core capture function of the FMADIO system. It consists of Custom FPGA network cards and high performance software to achieve 10-200Gbps of loss less packet capture.

### FMADIO Storage

This provides the large storage for the capture system, see [FMADIO Storage](https://docs.fmad.io/docs/fmadio-os-capture-architecture#capture-storage-fifo1) for more details. This is 1TB - 1PB worth of high speed raw hardware storage

### FMADIO Push LXC

Provides an (optionally) filtered version of the raw data on the storage system. Sending that data downstream for processing. In this case its going to the Security container.

### Suricata

We use the opensource Suricata IDS for both protocol decode and as a high speed signature engine. This takes the packets sent from the Push LXC and directly ingests them into Suricata for processing. The output is a raw JSON log file.

### JSON Log

This is the [Suricata EVE JSON log](https://docs.suricata.io/en/latest/output/eve/eve-json-output.html) format. Its a rich protocol output in netsted JSON format.

### FMADIO Log Processor

Taking the raw EVE JSON log format, our custom log filter will extract appropriate fields and structures and insert them into the Clickhouse Database. This allows us to take unstructured EVE JSON data, and convert it into a structured SQL Schema.

### Clickhouse Database

The FMADIO Security container runs a native Clickhouse SQL database within the LXC. This allows fast retrieval and analysis of the processed data.

### Grafana Visualization

Finally we provide rich default dashboards for visualizing and monitoring the processed network traffic in the NOC or SOC operations centers.