Crate guess 

Wire-protocol classifier for TCP / TLS streams.

Given the first bytes of a freshly accepted connection, classify runs a detector cascade and reports one of:

• DetectedProtocol::TlsClientHello — the prefix is a complete TLS ClientHello (parsed via rustls’s Acceptor); SNI and ALPN are extracted into PeekResult::tls.
• DetectedProtocol::Http2Preface — the bytes match the 24-byte HTTP/2 connection preface from RFC 7540 §3.5.
• DetectedProtocol::Http1 — the bytes start with a known HTTP/1 method and the request line carries an HTTP/1.0 or HTTP/1.1 version marker.
• DetectedProtocol::Unknown — every detector ruled itself out.

The cascade is three-state: a detector can also say “I’d be willing to commit if I saw a few more bytes.” When any detector returns that, classify surfaces detected = None so the caller can read more bytes (up to MAX_PEEK_BYTES) and call again. When every detector has ruled itself out, the result is Unknown and further reads cannot change the outcome.

Types-only consumers

The default classify feature pulls in rustls (for the TLS parse) and memchr (for the HTTP/1 scan). Disable defaults to get only the result types — useful when a downstream crate wants to describe a peek without performing one:

guess = { version = "0.2", default-features = false }

Structs

PeekResult

Outcome of one peek-buffer classification. buffer is the bytes that were classified (kept on the result so consumers can replay them to a downstream decoder via, e.g., peeked-stream). detected is None when at least one detector wants more bytes; the caller should read more and call classify again.

TlsClientHello

Enums

DetectedProtocol

Constants

MAX_PEEK_BYTES

Maximum number of bytes a peek prelude should accumulate before declaring the connection’s prefix Unknown. 8 KiB matches what most servers can read in a single non-blocking syscall and covers any realistic TLS ClientHello (with SNI + ALPN + GREASE).

Functions

classify

Run the detector cascade against the current peek buffer.