Struct TcpFingerprint 

#[non_exhaustive]
pub struct TcpFingerprint {

    pub direction: TcpDirection,
    pub ip_version: u8,
    pub observed_ttl: u8,
    pub guessed_initial_ttl: u8,
    pub options_length: u8,
    pub df: bool,
    pub window_size: u16,
    pub mss: Option<u16>,
    pub window_scale: Option<u8>,
    pub sack_permitted: bool,
    pub timestamps: bool,
    pub option_layout: String,
    pub quirks: Quirks,
}

Available on crate feature tcp_fingerprint only.

One passive TCP/IP fingerprint capture.

Pre-formatted accessors stay in plain types so consumers can match / index without parsing the p0f signature string.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

direction: TcpDirection

Whether this is the client’s SYN or the server’s SYN+ACK.

ip_version: u8

IP version (4 or 6).

observed_ttl: u8

Observed TTL / hop-limit on the wire.

guessed_initial_ttl: u8

p0f-3 guessed initial TTL — observed_ttl rounded up to the next of {32, 64, 128, 255}. The number of hops the packet traversed is guessed - observed.

options_length: u8

Length of TCP options in bytes (post fixed 20-byte header). 0 when no options.

df: bool

IPv4 Don’t-Fragment bit (false for IPv6 — DF doesn’t exist there).

window_size: u16

TCP advertised window size.

mss: Option<u16>

MSS from option 2 if present.

window_scale: Option<u8>

Window-scale shift from option 3 if present.

sack_permitted: bool

SACK-Permitted (option 4) was sent.

timestamps: bool

TCP timestamps (option 8) were sent.

option_layout: String

Compact p0f-3 option layout — comma-separated tokens preserving wire order. Tokens: mss, nop, ws, sok, sack, ts, eol+N (N pad bytes after EOL), ?KIND for unknown kinds.

quirks: Quirks

Quirk bits — see Quirks.

Implementations

impl TcpFingerprint

pub fn to_p0f_signature(&self) -> String

Format as a p0f-3 signature string: ver:ittl:olen:mss:wsize,scale:olayout:quirks:pclass.

• ver = 4 or 6.
• ittl = guessed initial TTL.
• olen = options length in bytes.
• mss = MSS, or * when absent.
• wsize = literal window when scale present, else *.
• scale = window-scale shift, or * when absent.
• olayout = comma-separated option-token list.
• quirks = comma-separated quirk slugs.
• pclass = 0 (SYN has no payload by definition).

Trait Implementations

impl Clone for TcpFingerprint

fn clone(&self) -> TcpFingerprint

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TcpFingerprint

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TcpFingerprint

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for TcpFingerprint

impl PartialEq for TcpFingerprint

fn eq(&self, other: &TcpFingerprint) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for TcpFingerprint

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TcpFingerprint