All processing — from packet capture through AI inference — runs entirely on the LARK appliance. No network traffic or captured data leaves the appliance unless you explicitly configure a data export destination.
The Processing Pipeline
Data moves through several distinct stages from the moment traffic enters a monitored interface to the moment a structured record is written to storage.1
Passive Capture
The LARK listens passively on monitored network interfaces, copying traffic as it passes without injecting packets or disrupting the network. Raw packets are captured at line rate and buffered for processing. Full-fidelity PCAP data is written to onboard storage continuously as packets arrive.
2
Protocol Decoding
The capture buffer feeds a protocol decoding engine that reassembles TCP streams, identifies application-layer protocols, and extracts structured fields. Common protocols — including DNS, HTTP, TLS, SMB, FTP, and many others — are decoded automatically without additional configuration.
3
Telemetry Generation
Decoded protocol fields are serialized into structured telemetry records. Each record captures the relevant fields for a given protocol interaction: for DNS, that means the queried name, record type, and response code; for HTTP, it means the method, URI, status code, and relevant headers. Telemetry records are written to the telemetry storage path and are indexed for fast querying through the admin interface.
4
Flow and Session Tracking
Independently of protocol decoding, the LARK maintains a session table that tracks active network conversations. When a session ends (or times out), a flow record summarizing the conversation is finalized and written to the flow storage path. Flow records include endpoint addresses, ports, protocol, byte counts, packet counts, and duration.
5
Detection Rule Evaluation
As packets and decoded protocol data move through the pipeline, the LARK evaluates them against its loaded detection rules. Rules can match on packet content, protocol fields, flow characteristics, or combinations of these. Rule evaluation happens inline, in real time, with minimal added latency.
6
Alert Generation
When traffic matches a detection rule, the LARK generates an alert record. Each alert includes the rule identifier, severity level, a copy of the triggering context (packet data or protocol fields), associated flow metadata, and a precise timestamp. Alerts are written immediately to the alert storage path and surface in the admin interface without delay.
7
File Extraction
Where a monitored protocol carries file content — such as HTTP downloads, FTP transfers, or SMB file copies — the LARK reassembles the file from the network stream and writes it to the file extraction storage path, along with metadata linking it to the originating session. File extraction runs concurrently with other pipeline stages.
8
AI Inference
Flows, telemetry records, and alert context are fed to the on-appliance AI inference engine. The inference engine produces outputs such as anomaly scores, behavioral classification labels, and threat indicators. AI outputs are associated with their source events and written to the AI output storage path. Inference runs continuously as new data becomes available.
Continuous, Real-Time Operation
The entire pipeline runs continuously from the moment the LARK is powered on and actively monitoring traffic. There is no batch window, no scheduled scan, and no manual trigger required. Every stage in the pipeline operates on a stream of incoming data, and results are written to storage as soon as they are produced.What Is Written to Storage
Each pipeline stage writes its output to a dedicated storage path on the appliance. The table below summarizes the relationship between pipeline stage and stored data type.
All of these storage paths are subject to the same capacity and rollover behavior described in Data Storage. For guidance on exporting pipeline outputs to external systems, see Data Offloading.