flowscope 0.20.0

[package]
name = "flowscope"
version = "0.20.0"
edition = "2024"
rust-version = "1.88"
license = "MIT OR Apache-2.0"
repository = "https://github.com/p13marc/flowscope"
homepage = "https://github.com/p13marc/flowscope"
authors = ["Marc Pardo <p13marc@gmail.com>"]
description = "Passive flow & session tracking for packet capture (runtime-free, cross-platform)"
keywords = ["flow", "session", "tcp", "packet", "passive"]
categories = ["network-programming", "parser-implementations"]
readme = "README.md"
documentation = "https://docs.rs/flowscope"
# Internal-only files — useful in-repo, not on crates.io.
# `target/` is auto-excluded.
exclude = ["plans/", "CLAUDE.md", "fuzz/"]

[dependencies]
bitflags = "2"

# Always-on. Backs the lock-free MPMC queue under every
# `SlotHandle<M, K>` (plan 122). Sync-only, no async deps,
# transitively pulls only `crossbeam-utils`.
crossbeam-queue = "0.3"

# `extractors` feature
etherparse = { version = "0.16", optional = true }

# `tracker` feature
ahash = { version = "0.8", default-features = false, optional = true }
smallvec = { version = "1", optional = true }
arrayvec = { version = "0.7", optional = true }
lru = { version = "0.16", optional = true }

# `http` feature
httparse = { version = "1.10", optional = true }
bytes = { version = "1", optional = true }

# `smtp` feature — base64 for AUTH PLAIN/LOGIN credential decode.
# Also used by the `community-id` feature (base64 of the SHA-1 digest).
base64 = { version = "0.22", optional = true, default-features = false, features = ["alloc"] }

# `community-id` feature — SHA-1 for the Corelight Community ID v1
# flow hash (the spec mandates SHA-1). RustCrypto, MIT/Apache.
sha1 = { version = "0.10", optional = true }

# `ja4plus` JA4X — x509 cert parsing. Gated behind the
# combination of `tls-fingerprints` + `ja4plus`. MIT-licensed
# rusticata crate; small surface, no transport / no async.
x509-parser = { version = "0.18", optional = true }

# `snmp` feature — rusticata SNMPv1/v2c ASN.1 BER parser.
snmp-parser = { version = "0.11", optional = true }

# `radius` feature — rusticata RADIUS parser.
radius-parser = { version = "0.5", optional = true }

# `kerberos` feature — rusticata kerberos-parser. ASN.1
# BER/DER decoded AS-REQ/AS-REP/TGS-REQ/TGS-REP +
# KRB-ERROR. Issue #13.
kerberos-parser = { version = "0.9", optional = true }

# `quic` feature — QUIC Initial-packet decoder + AEAD
# decrypt + CRYPTO frame reassembly. Pulls `ring` /
# `aes` (via quic-parser default features). Issue #3.
quic-parser = { version = "0.1", optional = true }

# `ldap` feature — rusticata ldap-parser. RFC 4511 LDAP
# operation decode for Bind / Search / SearchResultDone.
# Issue #13.
ldap-parser = { version = "0.5", optional = true }

# `tls` feature
tls-parser = { version = "0.12", optional = true }

# `tls-fingerprints` sub-feature deps (JA3 + JA4 client TLS
# fingerprints. Plan 131 collapsed the former `ja3` + `ja4`
# split into a single feature flag — see CHANGELOG 0.12.0.)
md-5 = { version = "0.10", optional = true }
hex = { version = "0.4", optional = true }
sha2 = { version = "0.10", optional = true }

# `dns` feature
simple-dns = { version = "0.10", optional = true }

# `pcap` feature
pcap-file = { version = "2", optional = true }

# `metrics` feature
metrics = { version = "0.24", optional = true }

# `tracing` feature
tracing = { version = "0.1", default-features = false, features = ["std", "attributes"], optional = true }

# `serde` feature
serde = { version = "1", features = ["derive"], optional = true }

# `emit-ndjson` sub-feature
serde_json = { version = "1", optional = true }

# `aggregate` feature — t-digest streaming quantile estimator
tdigest = { version = "0.2", optional = true }

# `chrono` feature — interop between `Timestamp` and chrono's
# `DateTime<Utc>`. We need `alloc` for the `to_rfc3339_opts`
# cross-check tests; the runtime path (`From` / `TryFrom`) is
# alloc-free regardless.
chrono = { version = "0.4", default-features = false, features = ["alloc"], optional = true }

[dev-dependencies]
proptest = "1"
pcap-file = "2"
metrics-util = "0.20"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
criterion = { version = "0.5", features = ["html_reports"] }
serde_json = "1"
static_assertions = "1"

[features]
default = ["extractors", "tracker", "reassembler", "session"]

# Core layers — start small or take the lot.
extractors = ["dep:etherparse", "dep:smallvec"]
tracker = ["dep:ahash", "dep:smallvec", "dep:arrayvec", "dep:lru"]
reassembler = ["tracker"]
session = ["tracker"]

# `test-helpers` exposes `extract::parse::test_frames` for proptest,
# fuzz harnesses, and fixture generation. Not for production use.
test-helpers = ["extractors"]

# Protocol parsers. Each is a self-contained module gated by its feature.
http = ["reassembler", "session", "dep:httparse", "dep:bytes"]
tls = ["reassembler", "session", "dep:tls-parser", "dep:bytes"]
# TLS fingerprint family (plan 131) — JA3 + JA4 TLS *client* fingerprints.
# Royalty-free / BSD-3-Clause-equivalent (JA3 = Salesforce, JA4 client =
# FoxIO BSD). JA4S is NOT here — it's FoxIO-licensed, see `ja4plus`.
tls-fingerprints = ["tls", "dep:md-5", "dep:sha2", "dep:hex"]
# JA4S server fingerprint (part of the JA4+ suite). Licensed under the
# **FoxIO License 1.1** (source-available, non-commercial; patent pending) —
# NOT MIT/Apache like the rest of flowscope. OFF BY DEFAULT and deliberately
# excluded from `l7` / `full` so the default build stays royalty-free.
# Commercial use requires a FoxIO OEM license. See LICENSE-FoxIO-1.1 + NOTICE.
ja4plus = ["tls-fingerprints", "dep:x509-parser", "dep:sha2"]
dns = ["extractors", "tracker", "session", "reassembler", "dep:simple-dns", "dep:bytes"]
icmp = ["extractors", "tracker", "session", "dep:bytes"]
# ARP visibility — datagram-style parser for EtherType 0x0806 (Issue #1, 0.17).
# `MacAddr` is unconditional at the crate root; `arp` adds the message types,
# parser, and the NeighborTable correlator. (`session` is not used by
# `ArpParser` — a stateless marker — but is kept in the dep set: dropping it
# is a `feature_no_longer_enables_feature` semver-major break for no real
# gain, so `arp` stays slightly heavier than its `ndp`/`lldp`/`cdp` siblings.)
arp = ["extractors", "tracker", "session", "dep:bytes"]
# NDP (IPv6 Neighbor Discovery) visibility — ICMPv6 types 135/136
# parser. The IPv6 sibling of `arp`; pairs with the always-on
# `NeighborTable<Ipv6Addr, MacAddr>` for binding tracking and
# SLAAC-poisoning / NDP-spoof detection. Issue #6 (0.18).
ndp = ["extractors", "tracker", "dep:bytes"]
# DHCP parser — UDP/67-68 BOOTP + DHCP options (RFC 2131 / 2132).
# DatagramParser over the unencrypted DHCP control plane. Surfaces
# the Fingerbank-style option-55 + option-60 fingerprint for asset
# / OS discovery. Issue #11 (0.18).
dhcp = ["extractors", "tracker", "session", "dep:bytes"]
# LLDP parser — IEEE 802.1AB-2016 / EtherType 0x88cc. L2 sibling
# of `arp`; gives switch / router / IP-phone / IPMI-BMC asset
# discovery and rogue-switch detection. Issue #23 (0.18).
lldp = ["extractors", "tracker", "dep:bytes"]
# CDP parser — Cisco Discovery Protocol. The Cisco-proprietary
# sibling of LLDP: SNAP-encapsulated 802.3 frames, dst MAC
# 01:00:0c:cc:cc:cc, OUI 00:00:0C, PID 0x2000. Stateless
# free-function parser. Issue #25 (0.18).
cdp = ["extractors", "tracker", "dep:bytes"]
# NTP parser — UDP/123 (RFC 5905). Stratum / mode / reference-
# ID surface for time-source asset discovery; mode 6/7
# predicate flags NTP-amplification (monlist) participants.
# Issue #14 (Tier-2 sub-piece).
ntp = ["extractors", "tracker", "session"]
# SSDP parser — UDP/1900 multicast. HTTP-like text-based
# UPnP / DLNA / IoT asset discovery (NOTIFY / M-SEARCH /
# response). Issue #14 (Tier-2 sub-piece).
ssdp = ["extractors", "tracker", "session"]
# TFTP parser — UDP/69 (RFC 1350). Read/Write requests +
# DATA / ACK / ERROR packets. Operationally useful for
# device-config-theft visibility on OT / network gear.
# Issue #14 (Tier-2 sub-piece, FTP/TFTP row).
tftp = ["extractors", "tracker", "session"]
# Asset-inventory composition module — `flowscope::asset` —
# unified `Asset` record + LRU-bounded `Inventory` over the
# events emitted by the L2 / L3 / L4 asset-discovery parsers.
# Pulls in its source parsers so `--features asset` is
# self-sufficient: the `from_*` adapters in `asset/core.rs` are
# each gated on their parser feature, so `asset` alone (pre-#87)
# compiled an empty inventory. `mdns` transitively enables `dns`.
# Issue #27 (0.18); self-sufficiency fix issue #87 (0.19).
asset = [
    "tracker",
    "arp", "ndp", "dhcp", "lldp", "cdp", "ssdp", "mdns", "netbios-ns",
]
# analysis — the opt-in composition layer wiring parser output
# to the flow lifecycle: `FlowAnalyzer` accumulates a per-flow
# `L7Summary`, then `finalize` computes `FlowRisk` + screens an
# `IocSet`, returning an enriched `AnalyzedFlow` record. Pure
# composition over `detect` + the parsers; the `observe_*`
# adapters are individually gated by their parser feature
# (`tls` / `http` / `dns`). Issue #83.
analysis = ["tracker"]
# mDNS — RFC 6762 multicast DNS over UDP/5353. Wire format
# is identical to DNS so this is a thin wrapper around
# `dns` adding mDNS-specific service-discovery helpers and
# an asset-inventory adapter. Issue #14 (Tier-2 row 5
# sub-piece). Pairs with `asset` for full IoT discovery.
mdns = ["dns"]
# NetBIOS Name Service (NBNS / NBT-NS) — RFC 1002 §4.2 over
# UDP/137. Binary DNS-like protocol; the Windows-side sibling
# to mDNS / SSDP for the broadcast-name-service asset
# discovery trio. Pairs with `asset` for IoT/Windows
# inventory. Issue #14 (Tier-2 row 5 sub-piece).
netbios-ns = ["session", "dep:smallvec"]
# FTP — TCP/21 control channel. Text protocol (RFC 959 +
# RFC 2228 AUTH + RFC 2389 FEAT + RFC 2428 EPRT/EPSV).
# Surfaces cleartext credentials (USER+PASS), AUTH-TLS
# upgrade detection, server banner, transfer-direction
# commands (RETR/STOR/MKD/DELE). Useful for credential-leak
# detection (T1078) + data-transfer visibility (T1048).
# Issue #14 (Tier-2 row 2 sub-piece).
ftp = ["session", "dep:bytes"]
# SMTP — TCP/25 + submission (TCP/587) per RFC 5321 +
# RFC 4954 (AUTH). Cleartext-creds capture (AUTH
# PLAIN/LOGIN base64-decoded), named-exfil detection
# (MAIL FROM / RCPT TO addresses + envelope size),
# STARTTLS upgrade detection. Pre-STARTTLS attachment
# metadata is out of scope (DATA-body parsing requires
# MIME).  Issue #14 (Tier-2 row 1 sub-piece — the highest-
# value remaining parser).
smtp = ["session", "dep:bytes", "dep:base64"]
# WireGuard handshake metadata — UDP, no well-known port
# (51820 is the convention). 4 message types per the
# WireGuard whitepaper: Handshake Initiation (148B,
# type=1), Handshake Response (92B, type=2), Cookie Reply
# (64B, type=3), Transport Data (var, type=4). Passive
# detection of VPN tunneling. Issue #14 (rising 2025-26
# evasion signal).
wireguard = ["session"]
# Modbus/TCP — TCP/502, the OT/SCADA workhorse per
# RFC-style Open Modbus spec. MBAP header + function code
# + data. Surfaces function codes (read/write
# coils/registers/diagnostics), unit_id, exception
# responses. Passive observability — the ONLY safe
# observation mode for ICS networks. Issue #14 (Tier-2
# row 6 — ICS).
modbus = ["session", "dep:bytes"]
# DNP3 — TCP/20000 OT protocol per IEEE 1815-2012. Passive
# observation only: parses the data link layer header (start
# bytes / length / control / 16-bit src+dst addresses) and
# the application layer header (function code + Internal
# Indications + first object group/variation) when present
# in the first user-data block.
#
# **Link-layer reassembly is OUT OF SCOPE** — that's the
# part Suricata had CVE-2026-22259 in. We surface metadata
# from the first link frame and leave deeper decoding to
# specialised tools. MIT-clean (no stepfunc dep). Issue #29.
dnp3 = ["session", "dep:bytes"]
# SNMP v1/v2c — UDP/161 (queries) + UDP/162 (traps) per
# RFC 1157 (v1) / RFC 1905 (v2c). ASN.1 BER via the
# rusticata `snmp-parser` crate. Surfaces cleartext
# community string (T1078), version, PDU type,
# request_id, and the varbind OID list. SNMPv3 (USM auth +
# encryption) is out of scope for the initial ship.
# Issue #14 (Tier-2 row 3 — asset enum + DDoS amplification).
snmp = ["session", "dep:snmp-parser"]
# RADIUS — UDP/1812 (auth) + UDP/1813 (accounting) per
# RFC 2865 / 2866. Cleartext UserName, NAS-IP-Address,
# Called/Calling-Station-Id (MAC), Framed-IP-Address;
# the User-Password attribute is hashed with the shared
# secret + Authenticator so cleartext recovery requires
# the secret (out of scope). Useful for identity
# correlation, NAC / wireless-auth visibility, AAA flow
# topology. Issue #14 (Tier-2 row 4).
radius = ["session", "dep:radius-parser"]
# Kerberos parser (TCP/UDP/88) — AS-REQ / AS-REP / TGS-REQ /
# TGS-REP / KRB-ERROR. Surfaces principals, realm, etype list
# (Kerberoasting RC4-downgrade signal). Wraps the rusticata
# kerberos-parser. Issue #13 sub-piece.
kerberos = ["session", "reassembler", "dep:kerberos-parser", "dep:bytes"]
# LDAP parser (TCP/389) — BindRequest / SearchRequest /
# SearchResultDone. Surfaces auth method (simple-cleartext
# vs SASL), base DN, filter summary, attribute requests
# (SPN-query → GetUserSPNs / BloodHound enumeration signal).
# Wraps the rusticata ldap-parser. Issue #13 sub-piece.
ldap = ["session", "reassembler", "dep:ldap-parser", "dep:bytes"]
# SMB2/3 parser (TCP/445) — dialect detection + command
# decode + tree-connect target (highest lateral-movement
# visibility per MITRE T1021.002). Hand-rolled; no mature
# rusticata crate exists. M1 scope per issue #12 — dialect,
# command, message/tree/session IDs, encryption presence,
# tree-connect path (C$/ADMIN$/IPC$ signal).
smb = ["session", "reassembler", "dep:bytes"]
# QUIC Initial parser (UDP/443) — long-header decode +
# Initial-secret derivation + AEAD decrypt + ClientHello
# extraction → SNI / ALPN visibility on encrypted-by-
# default protocols (HTTP/3, DoH). Wraps the `quic-parser`
# crate (zero-copy decoder + ring-backed AEAD). Issue #3.
quic = ["session", "reassembler", "dep:quic-parser", "dep:tls-parser"]
# STUN — RFC 5389 over UDP (no IANA port; 3478 is the
# convention; TURN uses 3478/5349). Useful for WebRTC peer
# detection, NAT-type discovery, TURN identification. 20-
# byte header + TLV attributes. Issue #14 (Tier-2 sub-piece
# adjacent to WireGuard for VPN/overlay visibility).
stun = ["session"]
# RDP — TCP/3389 X.224 Connection Request/Confirm only,
# per MS-RDPBCGR §2.2.1. Metadata-only by design: we
# surface the `Cookie: mstshash=USERNAME` line + RDP
# negotiation flags (TLS/CredSSP/RDSTLS). Do NOT parse
# the RDP payload — FreeRDP codec history shows CVE
# minefield. Pairs with `tls` for the wrapper handshake.
# Issue #14 (Tier-2 row 8 — top interactive lateral-
# movement vector T1021.001).
rdp = ["session", "dep:bytes"]
# ml-features — `flowscope::ml_features` CICFlowMeter-style
# per-flow feature vector. The totals/throughput/per-direction
# subset of the ~80 CICFlowMeter features that's computable
# from `FlowRecord` alone (no per-packet IAT tracking). Plus
# Zeek `conn_state` + `history` already on every Ended event.
# Pulls `ipfix` by design (NOT incidental coupling): the feature
# vector is computed from `crate::ipfix::FlowRecord`, the canonical
# IPFIX-IE-keyed flow record, via `count_tcp_flags` /
# `CicFlowFeatures::from_flow_record`. `ipfix = []` carries zero
# transitive deps (pure IANA IE vocabulary), so the edge is free.
# Issue #15 scoped sub-piece; coupling documented per issue #87.
ml-features = ["ipfix", "tracker", "extractors"]
# ml-features-nprint — nPrint (CCS 2021) model-agnostic per-
# packet ternary header-bit matrix. Each packet becomes a
# fixed-width row of -1 / 0 / 1 per header bit; downstream ML
# learns directly from wire bits without feature engineering.
# Bounded per flow (default 100 packets). Separate from
# `ml-features` because the per-packet storage cost is
# non-trivial. Issue #30.
ml-features-nprint = ["extractors"]
# p0f-style passive TCP/IP fingerprint — extracts initial TTL,
# window size, MSS, window-scale, TCP option order, DF bit, and
# quirks from cleartext SYN / SYN-ACK packets. Operates over the
# per-packet `Layers` view; no per-flow state. Issue #9 (0.18).
tcp_fingerprint = ["extractors", "tracker"]
# IPFIX (RFC 7011/7012) Information Element vocabulary — IANA
# IE registry as constants + flowEndReason mapping +
# tcpControlBits encoder. Additive sub-piece of #16; the full
# FlowRecord re-key to IPFIX IEs stays open in #16. No new
# transitive deps.
ipfix = []
# IPFIX binary wire encoder (RFC 7011/7012). Pure-bytes
# encoder over the typed `FlowRecord` from `ipfix`. Produces
# Message records ready for UDP/SCTP transport — but the
# transport layer (sockets, template lifecycle, retransmit
# scheduling) is out of scope here and left to consumer
# crates. Issue #28.
ipfix-export = ["ipfix", "dep:bytes"]
# SSH parser — version banner + SSH_MSG_KEXINIT decode +
# HASSH / HASSHServer fingerprints (Salesforce spec, MIT-
# equivalent licensed). SessionParser over TCP/22.
# Issue #7 (0.18).
ssh = ["reassembler", "session", "dep:bytes", "dep:md-5", "dep:hex"]

# Encrypted-flow behavioural fingerprinting — first-N packet sizes
# and inter-arrival times accumulated per flow, finalised at flow
# end. Pure additive over the always-on detector primitives;
# zero-alloc per packet (fixed-size ArrayVec). Issue #4 (0.17).
fingerprint = ["dep:arrayvec"]

# ─── Coarse tiers (issue #87) ──────────────────────────────────────
# Correct, coarse umbrellas between "one parser" and `l7`/`full`, so
# consumers don't hand-assemble parser lists. Granular leaf flags stay
# available; these only group them. `l7` / `full` are recomposed from
# these tiers (single source of truth — the leaf list lives here, not
# duplicated). All memberships are mirrored by `compile_error!` drift
# guards in `src/feature_umbrellas.rs`.

# L7 application parsers shipped since 0.1 (the "core four").
parsers-core = ["http", "tls", "dns", "icmp"]
# L2 / L3 asset-discovery parsers (link- and network-layer).
parsers-l2l3 = ["arp", "ndp", "lldp", "cdp", "dhcp"]
# Tier-2 protocol completion (0.18) — everything else license-clean.
parsers-tier2 = [
    "ssh", "ntp", "ssdp", "tftp", "mdns", "netbios-ns", "ftp", "smtp",
    "wireguard", "modbus", "stun", "rdp", "snmp", "radius", "quic",
    "smb", "ldap", "kerberos", "dnp3",
]
# ML feature extraction (running-stats + per-packet nPrint matrix).
ml = ["ml-features", "ml-features-nprint"]
# IPFIX vocabulary + binary export + structured event emitters.
export = ["ipfix", "ipfix-export", "emit", "emit-ndjson", "emit-eve"]
# Network-security-monitoring composition: passive fingerprints +
# the risk / IOC analysis layer. (`detect` is always-on, not gated.)
nsm = ["fingerprint", "tls-fingerprints", "analysis"]

# Umbrella: enable every shipped, license-clean protocol parser at once.
# Recomposed from the `parsers-*` tiers plus `tls-fingerprints` (a
# fingerprint, not a wire parser, but historically an `l7` member).
# Strict subset of `full` (no `pcap`, no observability). Excludes only
# the FoxIO-licensed `ja4plus` suite (off by default for licensing).
# Invariant guarded by `src/feature_umbrellas.rs`: every parser feature
# must be a member here, and `full` must be a superset of `l7`.
l7 = ["parsers-core", "parsers-l2l3", "parsers-tier2", "tls-fingerprints"]

# pcap source adapter (offline replay).
pcap = ["extractors", "tracker", "dep:pcap-file"]

# Observability hooks (zero-cost when off).
metrics = ["tracker", "dep:metrics"]

# Serde Serialize + Deserialize on every public event / message /
# accessor / config type. Locks the snake_case wire vocabulary from
# 0.8 forward — once shipped, dashboards depend on field / variant
# names. Renames require a CHANGELOG-documented breaking change.
serde = ["dep:serde", "bytes?/serde", "arrayvec?/serde", "smallvec?/serde"]
tracing = ["tracker", "dep:tracing"]
# `tracing-messages` (deleted in 0.12.0 plan 131): per-message
# `tracing::trace!` emission is now always-on under `tracing`.
# Filter at runtime via `tracing-subscriber::EnvFilter`, e.g.
# `EnvFilter::new("info,flowscope.message=warn")`. The
# `SessionParser::Message: Debug` bound was already always-on,
# so the dedicated feature was redundant clutter.

# Structured event sinks (plan 101). `emit` ships the CSV + Zeek
# `conn.log` writers (no extra deps). `emit-ndjson` adds the
# newline-delimited-JSON writer; pulls in `serde_json`.
emit = ["tracker", "extractors"]
emit-ndjson = ["emit", "serde", "dep:serde_json"]
# Suricata EVE JSON writer (plan 123). Schema-compatible with
# Suricata 7.x; pipes into Filebeat / Splunk / Tenzir / ECS
# downstream pipelines without translation.
emit-eve = ["emit", "dep:serde_json"]

# File-hash sinks (plan 146, 0.12.0) — streaming SHA-256 / MD5
# hashing for the reassembled payload stream plus MIME-class
# detection from the first ~64 bytes. Bridges flowscope into
# DFIR / IR pipelines (VirusTotal hash matching, Suricata
# file_md5 / file_sha256 ergonomics) without storing the file
# bytes themselves.
file-hash = ["reassembler", "dep:sha2", "dep:md-5", "dep:hex"]

# Distribution / quantile primitives (plan 102 sub-B). Ships
# `Histogram` (no deps) + `Percentile` (wraps the `tdigest` crate).
aggregate = ["dep:tdigest"]

# Corelight Community ID v1 flow hashing (cross-tool flow id for
# Zeek / Suricata / Security Onion pivots). Adds `community_id()` /
# `community_id_seeded()` to flow keys and emits `community_id` in the
# EVE / NDJSON writers. SHA-1 + base64 per the spec. `license: clean`.
# The seed-fixed `stable_hash()` / `shard_index()` helpers are
# always-on (no crypto) and do NOT require this feature.
community-id = ["dep:sha1", "dep:base64"]

# `chrono` interop on `Timestamp` (plan 127). Adds
# `From<DateTime<Utc>>` + `TryFrom<Timestamp>` for
# `chrono::DateTime<chrono::Utc>` so consumers already on
# chrono can interop without a manual conversion.
chrono = ["dep:chrono"]

# Convenience: turn everything license-clean on. Recomposed from `l7`
# plus the capability tiers (`nsm` / `ml` / `export`), `asset`, and the
# remaining observability / source / misc features. Deliberately
# EXCLUDES the FoxIO-licensed `ja4plus` suite — `full` stays
# royalty-free-clean. `--all-features` (docs.rs / CI) is the only build
# that also pulls `ja4plus`. Invariant guarded by
# `src/feature_umbrellas.rs`.
#
# Note: `nsm` pulls `tls-fingerprints` (also in `l7`), `analysis`,
# `fingerprint`; `ml` pulls `ml-features` + `ml-features-nprint`;
# `export` pulls `ipfix` + `ipfix-export` + the `emit*` writers;
# `asset` pulls its discovery parsers (all already in `l7`).
full = [
    "l7",
    # capability tiers
    "nsm", "ml", "export",
    # asset inventory composition (pulls its discovery parsers)
    "asset",
    # non-l7 passive fingerprint
    "tcp_fingerprint",
    # pcap source
    "pcap",
    # observability
    "metrics", "tracing",
    # serde wire-format + everything else license-clean
    "serde", "aggregate", "chrono", "file-hash", "community-id",
]

[package.metadata.docs.rs]
all-features = true
rustdoc-args = ["--cfg", "docsrs"]

# `md-5` is published with package name `md-5` but exports the crate
# as `md5` (no hyphen). cargo-machete can't tell, so explicitly
# allow-list it.
[package.metadata.cargo-machete]
ignored = ["md-5"]

# ─── Examples (see examples/README.md for a catalog) ───

# ── 00 getting started ──────────────────────────────
[[example]]
name = "from_stdin"
path = "examples/00-getting-started/from_stdin.rs"
required-features = ["pcap", "http"]

[[example]]
name = "hello_pipeline"
path = "examples/00-getting-started/hello_pipeline.rs"
required-features = ["pcap", "extractors", "reassembler", "session"]

[[example]]
name = "inspect_packet"
path = "examples/09-low-level/inspect_packet.rs"
required-features = ["pcap", "extractors"]

[[example]]
name = "unified_driver_demo"
path = "examples/00-getting-started/unified_driver_demo.rs"
required-features = ["pcap", "http", "dns"]

# ── 01 L7 message logging ────────────────────────────
[[example]]
name = "http_log"
path = "examples/01-l7-logging/http_log.rs"
required-features = ["http", "pcap"]

[[example]]
name = "pcap_pulses"
path = "examples/01-l7-logging/pcap_pulses.rs"
required-features = ["tls", "pcap"]

[[example]]
name = "http_exchanges"
path = "examples/01-l7-logging/http_exchanges.rs"
required-features = ["http", "pcap"]

[[example]]
name = "tls_observer"
path = "examples/01-l7-logging/tls_observer.rs"
required-features = ["tls", "pcap"]

[[example]]
name = "quic_initial_observer"
path = "examples/01-l7-logging/quic_initial_observer.rs"
required-features = ["quic", "pcap"]

[[example]]
name = "dns_log"
path = "examples/01-l7-logging/dns_log.rs"
required-features = ["dns", "pcap"]

# ── 02 forensics / IoC extraction ────────────────────
[[example]]
name = "extract_iocs"
path = "examples/02-forensics/extract_iocs.rs"
required-features = [
  "pcap",
  "http",
  "tls",
  "tls-fingerprints",
  "dns",
  "extractors",
  "tracker",
  "smtp",
  "ftp",
  "smb",
  "kerberos",
  "ldap",
]

[[example]]
name = "tls_inventory"
path = "examples/02-forensics/tls_inventory.rs"
required-features = ["tls", "tls-fingerprints", "pcap"]

[[example]]
name = "client_fingerprint_catalog"
path = "examples/02-forensics/client_fingerprint_catalog.rs"
required-features = [
  "pcap",
  "extractors",
  "tracker",
  "tls",
  "tls-fingerprints",
  "http",
  "ssh",
]

[[example]]
name = "arp_spoof_detector"
path = "examples/02-forensics/arp_spoof_detector.rs"
required-features = ["arp", "pcap"]

[[example]]
name = "smtp_credentials"
path = "examples/02-forensics/smtp_credentials.rs"
required-features = ["smtp", "pcap"]

[[example]]
name = "smb_lateral_movement"
path = "examples/02-forensics/smb_lateral_movement.rs"
required-features = ["smb", "pcap"]

[[example]]
name = "kerberoast_hunter"
path = "examples/02-forensics/kerberoast_hunter.rs"
required-features = ["kerberos", "pcap"]

[[example]]
name = "ldap_recon_hunter"
path = "examples/02-forensics/ldap_recon_hunter.rs"
required-features = ["ldap", "pcap"]

[[example]]
name = "asset_inventory"
path = "examples/02-forensics/asset_inventory.rs"
required-features = ["asset", "arp", "pcap"]

# ── 03 security / detection ──────────────────────────
[[example]]
name = "port_scan_detector"
path = "examples/03-detection/port_scan_detector.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "dns_tunnel_detector"
path = "examples/03-detection/dns_tunnel_detector.rs"
required-features = ["pcap", "dns", "extractors"]

[[example]]
name = "c2_beacon_finder"
path = "examples/03-detection/c2_beacon_finder.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "dga_finder"
path = "examples/03-detection/dga_finder.rs"
required-features = ["pcap", "dns", "extractors"]

[[example]]
name = "failed_auth_burst"
path = "examples/03-detection/failed_auth_burst.rs"
required-features = ["pcap", "http"]

[[example]]
name = "tcp_retransmit_audit"
path = "examples/04-observability/tcp_retransmit_audit.rs"
required-features = ["pcap", "extractors", "reassembler"]

[[example]]
name = "tcp_evasion_detector"
path = "examples/03-detection/tcp_evasion_detector.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler"]

[[example]]
name = "composite_c2"
path = "examples/03-detection/composite_c2.rs"
required-features = ["pcap", "extractors", "tracker", "dns", "tls", "emit-eve"]

[[example]]
name = "flow_analysis"
path = "examples/03-detection/flow_analysis.rs"
required-features = ["analysis", "tls", "dns", "emit-eve"]

[[example]]
name = "flow_analysis_driver"
path = "examples/03-detection/flow_analysis_driver.rs"
required-features = ["analysis", "tls", "dns", "pcap", "emit-eve"]

# ── 04 observability / SRE ───────────────────────────
[[example]]
name = "top_talkers"
path = "examples/04-observability/top_talkers.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "top_talkers_topk"
path = "examples/04-observability/top_talkers_topk.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "http_error_rate"
path = "examples/04-observability/http_error_rate.rs"
required-features = ["pcap", "http"]

[[example]]
name = "flow_duration_histogram"
path = "examples/04-observability/flow_duration_histogram.rs"
required-features = ["pcap", "aggregate"]

[[example]]
name = "conversation_timeline"
path = "examples/04-observability/conversation_timeline.rs"
required-features = ["pcap", "extractors", "reassembler"]

# 0.14 cycle (plan 174) — three runnable examples for the 0.14 surface.
[[example]]
name = "bandwidth_by_app"
path = "examples/04-observability/bandwidth_by_app.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "icmp_explained_drops"
path = "examples/04-observability/icmp_explained_drops.rs"
required-features = ["pcap", "icmp", "extractors", "tracker"]

[[example]]
name = "direction_skew_anomaly"
path = "examples/04-observability/direction_skew_anomaly.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "tap_merge_orientation"
path = "examples/04-observability/tap_merge_orientation.rs"
required-features = ["extractors", "tracker", "test-helpers"]

[[example]]
name = "ml_features_pipeline"
path = "examples/04-observability/ml_features_pipeline.rs"
required-features = ["pcap", "ml-features", "serde"]

# ── 05 data export ───────────────────────────────────
[[example]]
name = "flow_csv_export"
path = "examples/05-export/flow_csv_export.rs"
required-features = ["pcap", "emit"]

[[example]]
name = "flow_json_export"
path = "examples/05-export/flow_json_export.rs"
required-features = ["pcap", "emit-ndjson"]

[[example]]
name = "zeek_style_conn_log"
path = "examples/05-export/zeek_style_conn_log.rs"
required-features = ["pcap", "emit"]

[[example]]
name = "eve_writer"
path = "examples/05-export/eve_writer.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler", "emit-eve"]

[[example]]
name = "prometheus_exporter"
path = "examples/05-export/prometheus_exporter.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler", "metrics"]

[[example]]
name = "tracing_subscriber"
path = "examples/05-export/tracing_subscriber.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler", "tracing"]

[[example]]
name = "nprint_export"
path = "examples/05-export/nprint_export.rs"
required-features = ["pcap", "extractors", "tracker", "ml-features-nprint"]

[[example]]
name = "ml_features_libsvm"
path = "examples/05-export/ml_features_libsvm.rs"
required-features = ["pcap", "extractors", "tracker", "ml-features"]

[[example]]
name = "ipfix_udp_collector"
path = "examples/05-export/ipfix_udp_collector.rs"
required-features = ["pcap", "extractors", "tracker", "ipfix-export"]

[[example]]
name = "pcap_dir_tail"
path = "examples/05-export/pcap_dir_tail.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler", "emit-eve"]

[[example]]
name = "allocations_per_packet"
path = "examples/08-performance/allocations_per_packet.rs"
required-features = ["pcap", "extractors", "tracker"]

[[example]]
name = "ipfix_wire_export"
path = "examples/05-export/ipfix_wire_export.rs"
required-features = ["pcap", "ipfix-export"]

[[example]]
name = "detector_to_eve"
path = "examples/05-export/detector_to_eve.rs"
required-features = ["pcap", "extractors", "tracker", "emit-eve"]

# ── 06 custom protocols ──────────────────────────────
[[example]]
name = "length_prefixed_pcap"
path = "examples/06-custom-protocols/length_prefixed_pcap.rs"
required-features = ["pcap", "session"]

[[example]]
name = "redis_protocol"
path = "examples/06-custom-protocols/redis_protocol.rs"
required-features = ["pcap", "extractors", "reassembler"]

[[example]]
name = "accumulating_line_parser"
path = "examples/06-custom-protocols/accumulating_line_parser.rs"
required-features = ["pcap", "extractors", "session"]

# ── 07 multi-protocol pipelines ──────────────────────
[[example]]
name = "multi_parser_pipeline"
path = "examples/07-multi-protocol/multi_parser_pipeline.rs"
required-features = ["pcap", "extractors", "reassembler", "session"]

[[example]]
name = "multi_protocol_monitor"
path = "examples/07-multi-protocol/multi_protocol_monitor.rs"
required-features = ["l7", "pcap"]

# ── 08 performance ───────────────────────────────────
[[example]]
name = "layer_fast_path"
path = "examples/08-performance/layer_fast_path.rs"
required-features = ["pcap", "extractors"]

[[example]]
name = "threaded_slot_drain"
path = "examples/08-performance/threaded_slot_drain.rs"
required-features = ["pcap", "http"]

[[example]]
name = "sharded_capture"
path = "examples/08-performance/sharded_capture.rs"
required-features = ["pcap", "http"]

[[example]]
name = "broadcast_subscribers"
path = "examples/00-getting-started/broadcast_subscribers.rs"
required-features = ["pcap", "http"]

# ── 09 reassembly / low-level ────────────────────────
[[example]]
name = "pcap_flow_summary"
path = "examples/09-low-level/pcap_flow_summary.rs"
required-features = ["pcap"]

[[example]]
name = "pcap_flow_keys"
path = "examples/09-low-level/pcap_flow_keys.rs"
required-features = ["pcap"]

[[example]]
name = "overflow_policy"
path = "examples/09-low-level/overflow_policy.rs"
required-features = ["pcap", "extractors", "tracker", "reassembler"]

[[example]]
name = "pcap_buffered_reassembly"
path = "examples/09-low-level/pcap_buffered_reassembly.rs"
required-features = ["pcap", "reassembler"]

# ── utilities (fixture generators) ───────────────────
[[example]]
name = "gen_fixtures"
path = "examples/utilities/gen_fixtures.rs"
required-features = ["test-helpers"]

[[example]]
name = "gen_length_prefixed_pcap"
path = "examples/utilities/gen_length_prefixed_pcap.rs"
required-features = ["test-helpers", "pcap"]

[[test]]
name = "http_parser"
required-features = ["http"]

[[test]]
name = "http_pcap"
required-features = ["http", "pcap"]

[[test]]
name = "tls_parser"
required-features = ["tls"]

[[test]]
name = "dns_parser"
required-features = ["dns"]

[[test]]
name = "pcap_integration"
required-features = ["pcap"]

[[test]]
name = "pcap_fixtures"
required-features = ["pcap", "test-helpers"]

[[test]]
name = "proptest_invariants"
required-features = ["test-helpers", "tracker"]

[[test]]
name = "parser_proptest"
required-features = ["http", "tls", "dns"]

[[test]]
name = "metrics_integration"
required-features = ["metrics", "extractors", "reassembler", "test-helpers"]

[[test]]
name = "length_prefixed_example"
required-features = ["pcap", "session", "extractors"]

[[test]]
name = "round_trip"
required-features = ["pcap", "session", "reassembler", "extractors", "test-helpers"]

[[test]]
name = "pcap_l7_iterators"
required-features = ["pcap", "session", "reassembler", "extractors"]

[[test]]
name = "display_impls"
required-features = ["tracker"]

[[test]]
name = "http_accessors"
required-features = ["http"]

[[test]]
name = "severity"
required-features = ["reassembler"]

[[test]]
name = "icmp_parser"
required-features = ["icmp"]

[[test]]
name = "parser_kind_constants"
required-features = ["session"]

[[test]]
name = "iter_active"
required-features = ["tracker", "extractors", "test-helpers"]

[[test]]
name = "force_close"
required-features = ["tracker", "extractors", "test-helpers"]

[[test]]
name = "dns_resolution_cache"
required-features = ["dns"]

[[test]]
name = "serde_round_trip"
required-features = ["serde", "tracker"]

[[test]]
name = "emit_csv"
required-features = ["emit"]

[[test]]
name = "emit_ndjson"
required-features = ["emit-ndjson"]

[[test]]
name = "emit_zeek"
required-features = ["emit"]

[[test]]
name = "emit_eve"
required-features = ["emit-eve", "tracker"]

[[test]]
name = "parser_helpers"
required-features = ["session"]

[[test]]
name = "http_exchange"
required-features = ["http"]

[[test]]
name = "dns_exchange"
required-features = ["dns"]

[[test]]
name = "driver"
required-features = ["test-helpers", "extractors", "session", "reassembler"]

[[test]]
name = "anomaly_fields"
required-features = ["extractors", "tracker"]

[[test]]
name = "key_fields"
required-features = ["extractors", "tracker"]

[[test]]
name = "driver_send"
required-features = ["test-helpers", "extractors", "session", "reassembler"]

[[bench]]
name = "extractor"
harness = false
required-features = ["extractors", "test-helpers"]

[[bench]]
name = "tracker"
harness = false
required-features = ["tracker", "extractors", "test-helpers"]

[[bench]]
name = "reassembler"
harness = false
required-features = ["reassembler"]

[[bench]]
name = "session_driver"
harness = false
required-features = ["session", "reassembler", "extractors", "test-helpers"]

[[bench]]
name = "dedup"
harness = false
required-features = ["tracker"]

[[bench]]
name = "zero_alloc"
harness = false
required-features = [
    "session",
    "reassembler",
    "extractors",
    "http",
    "dns",
    "tls",
    "test-helpers",
]