The engine — C
Packet handling on the interface, protocol classification, TLS, and the evaluation that turns everything known about a session into one decision. It runs inline on firewalls carrying production traffic, so correctness and cost per packet are the same conversation.