1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
//! p0f-style passive TCP/IP stack fingerprint.
//!
//! Gated by the `tcp_fingerprint` feature. License-clean
//! alternative to FoxIO's `JA4T` / `JA4TS` (FoxIO-licensed) —
//! the *technique* is in the public domain; flowscope ships
//! the field extraction and the p0f-3 signature-string
//! formatter, not any pre-built signature database.
//!
//! # Inputs
//!
//! [`fingerprint_from_layers`] takes a per-packet
//! [`crate::layers::Layers`] view and returns a
//! [`TcpFingerprint`] when the packet is a SYN (client) or
//! SYN-ACK (server) over IPv4 or IPv6. Anything else returns
//! `None`.
//!
//! # Output shape
//!
//! [`TcpFingerprint`] surfaces the operationally-interesting
//! fields directly (initial TTL, guessed hop class, window
//! size, MSS, window scale, option layout, DF bit, quirks),
//! and [`TcpFingerprint::to_p0f_signature`] formats them as
//! the p0f-3 string `ver:ittl:olen:mss:wsize,scale:olayout:quirks:pclass`
//! consumers can match against a signature database.
//!
//! # Out of scope
//!
//! - **No signature database.** p0f's DB is LGPL and stale;
//! consumers bring their own (Recog, custom).
//! - **No per-flow caching.** Each call is stateless; the
//! caller decides which packets to fingerprint (typically
//! the first SYN and SYN-ACK of every flow).
//!
//! Issue #9 (0.18).
pub use ;
// JA4T / JA4TS — FoxIO-licensed JA4+ TCP fingerprint. Opt-in via the
// `ja4plus` feature (issue #77).
pub use ;