Crate huginn_net 

Multi-protocol passive fingerprinting library: TCP/HTTP (p0f-style) + TLS (JA4) analysis.

Cargo Features

All features are opt-in: the default build is an empty shell. Pick the analyses you actually consume, or use the convenience full alias to opt into everything this version offers (including future axes added in later releases).

Feature	Default	Description
full	No	Convenience alias for “everything this version offers” (currently db + every tcp-* + every http-* + tls-stable-v1). Stable across version upgrades; additions land here automatically.
db	No	Pulls in huginn_net_db and enables p0f signature matching for TCP and HTTP. Combine with any tcp-* / http-* for label-producing builds; omit for an observation-only build (e.g. JA4-only or downstream consumers that bring their own matcher implementation).
tcp-syn	No	Pass-through for huginn-net-tcp/syn: TCP SYN fingerprinting (FingerprintResult::tcp_syn).
tcp-syn-ack	No	Pass-through for huginn-net-tcp/syn-ack: TCP SYN+ACK fingerprinting (FingerprintResult::tcp_syn_ack).
tcp-mtu	No	Pass-through for huginn-net-tcp/mtu: MTU detection (FingerprintResult::tcp_mtu).
tcp-uptime	No	Pass-through for huginn-net-tcp/uptime: uptime estimation for both client and server (FingerprintResult::tcp_client_uptime / tcp_server_uptime).
http-p0f-request	No	Pass-through for huginn-net-http/p0f-request: HTTP request fingerprinting (FingerprintResult::http_request, HttpRequestOutput, Browser, BrowserQualityMatched).
http-p0f-response	No	Pass-through for huginn-net-http/p0f-response: HTTP response fingerprinting (FingerprintResult::http_response, HttpResponseOutput, WebServer, WebServerQualityMatched).
tls-stable-v1	No	Adds JA4_s1 / JA4_rs1 fingerprints via huginn_net_tls, ephemeral extensions excluded for stable fingerprints.
json	No	Enables serde::Serialize on FingerprintResult and analysis output types (pass-through to huginn-net-tcp/json, huginn-net-http/json, huginn-net-tls/json). Not included in full.

Each tcp-* / http-* feature gates the corresponding field on FingerprintResult and the matching re-exports. Disabling a feature removes its field at compile time and shrinks the result struct. The underlying parser also early-exits when none of the consumers for a packet’s side are enabled, so disabling features is a zero-cost optimization, not just a build configuration.

Common opt-in examples:

# Everything this version offers (forward-compatible).
huginn-net = { version = "2.0.0", features = ["full"] }

# p0f-style TCP+HTTP fingerprinting with database matching.
huginn-net = { version = "2.0.0", features = ["db", "tcp-syn", "tcp-syn-ack", "http-p0f-request", "http-p0f-response"] }

# Observation-only TCP SYN (no database, no matching).
huginn-net = { version = "2.0.0", features = ["tcp-syn"] }

Re-exports

pub use analyzer::AnalysisConfig;

pub use analyzer::HuginnNet;

pub use error::HuginnNetError;

pub use output::FingerprintResult;

pub use huginn_net_tcp;

pub use huginn_net_http;

pub use huginn_net_tls;

Modules

analyzer

db_matching_traitdb

error

http

matcher

output

packet_parser

parser

process

tcp

Macros

quality_match

Macro for quality matching pattern. This macro provides a zero-cost abstraction for the common pattern of conditional quality matching based on matcher_enabled configuration.

simple_quality_match

Simplified quality matching macro for cases where the matcher call is straightforward.

Structs

Browser

Represents a browser identified from an HTTP request signature.

BrowserQualityMatchedhttp-p0f-request

Databasedb

Composite p0f database holding both TCP and HTTP sub-databases.

FilterConfig

Combined filter configuration

HttpFilterConfig

Combined filter configuration

HttpIpFilter

IP address filter configuration

HttpPortFilter

Port filter configuration

HttpRequestOutputhttp-p0f-request

Holds information derived from analyzing HTTP request headers.

HttpResponseOutputhttp-p0f-response

Holds information derived from analyzing HTTP response headers.

HttpSubnetFilter

Subnet filter configuration (CIDR notation)

IpFilter

IP address filter configuration

Labeldb

Represents a label associated with a signature, which provides metadata about the signature, such as type, class, name, and optional flavor details.

MTUOutputtcp-mtu

Holds information about the estimated Maximum Transmission Unit (MTU) of a link.

MTUQualityMatchedtcp-mtu

OSQualityMatchedtcp-syn-ack or tcp-syn

The operative system with the highest quality that matches the packet.

ObservableHttpRequesthttp-p0f-request

Public-facing HTTP request observation: includes the matching payload plus raw signal fields useful to consumers (lang, UA, headers, cookies, …).

ObservableHttpResponsehttp-p0f-response

ObservableTcptcp-syn-ack or tcp-syn

ObservableTlsClient

Observable TLS Client signals

OperativeSystem

Represents an operative system.

PortFilter

Port filter configuration

SubnetFilter

Subnet filter configuration (CIDR notation)

SynAckTCPOutputtcp-syn-ack

Holds information derived from analyzing a TCP SYN+ACK packet (server response).

SynTCPOutputtcp-syn

Holds information derived from analyzing a TCP SYN packet (client initiation).

TlsClientOutput

Holds information derived from analyzing TLS ClientHello packets.

TlsFilterConfig

Combined filter configuration

TlsIpFilter

IP address filter configuration

TlsPortFilter

Port filter configuration

TlsSubnetFilter

Subnet filter configuration (CIDR notation)

UptimeOutputtcp-uptime

Holds uptime information derived from TCP timestamp analysis.

WebServer

Represents a web server identified from an HTTP response signature.

WebServerQualityMatchedhttp-p0f-response

Enums

HttpMatchQuality

Quality classification for an HTTP match.

HttpOsKind

Whether a matched browser/web server label was a specified (concrete) or generic (catch-all) entry in the underlying database.

TcpMatchQuality

Outcome of matching an observation against a fingerprint database.

TcpOsKind

Marker telling whether a fingerprint is a “specific” definition or a “generic” fall-back. Equivalent to p0f’s s / g label prefix but expressed as a TCP-local enum, so this crate stays decoupled from any particular database format.

Ttl

Time To Live (TTL) representation used for OS fingerprinting and network-distance estimation.

UptimeRoletcp-uptime

Represents the role of the host in the connection for uptime tracking.