Expand description
Standalone HTTP fingerprinting (p0f-style) analyzer.
huginn-net-http is intentionally independent of any signature database:
you can use it to extract observable HTTP signals from raw traffic without
pulling in huginn-net-db. To enable matching against the bundled
signatures, plug a HttpMatcher implementation
(huginn-net-db provides SharedHttpSignatureMatcher) via
HuginnNetHttp::with_matcher.
§Cargo Features
All features are opt-in: the default build is an empty shell that
exposes only the always-on raw parsers and the matcher trait surface.
Pick the analyses you actually consume, or use the convenience
full alias to opt into everything this version
offers (including future axes added in later releases).
| Feature | Default | Description |
|---|---|---|
full | No | Convenience alias for “everything this version offers” (currently p0f-request + p0f-response + akamai). Stable across version upgrades. |
p0f-request | No | p0f-style fingerprinting of HTTP request side (client → server): header order, Accept-Language, User-Agent, browser matching. Gates [HttpRequestOutput]. |
p0f-response | No | p0f-style fingerprinting of HTTP response side (server → client): header order, web-server matching. Gates [HttpResponseOutput]. |
akamai | No | Akamai HTTP/2 client fingerprinting from SETTINGS/WINDOW_UPDATE/PRIORITY frames. Standalone API surface ([Http2FingerprintExtractor], [AkamaiFingerprint], extract_akamai_fingerprint*); not invoked by the p0f path. |
json | No | Enables [serde::Serialize] on HttpAnalysisResult and HTTP output types for JSON/NDJSON consumers. Not included in full. |
When a build disables every feature that would consume a packet’s side
(request or response), process_tcp_packet short-circuits at the top:
no flow-cache lookup, no SYN insertion, no payload reassembly. The
akamai feature is orthogonal to that pipeline: it only exposes the
standalone [Http2FingerprintExtractor] / extract_akamai_fingerprint*
API for callers that parse HTTP/2 frames themselves, and is never
invoked from process_tcp_packet regardless of the other features.
The always-on raw parsers (parse_http1_request, parse_http2_request,
Http1Processor, Http2Processor, the HttpParser/HttpProcessor
traits) and the HttpMatcher trait surface stay compiled regardless of
the feature set so external consumers can keep using them.
Common opt-in examples:
# Everything this version offers (forward-compatible).
huginn-net-http = { version = "2.0.0", features = ["full"] }
# Observation-only client side, no `akamai`.
huginn-net-http = { version = "2.0.0", features = ["p0f-request"] }
# Akamai HTTP/2 fingerprinting only, no p0f path compiled in at all.
huginn-net-http = { version = "2.0.0", features = ["akamai"] }Re-exports§
pub use analyzer::HuginnNetHttp;pub use http::common::HttpProcessor;pub use http1::process::build_absent_headers_from_new_parser;pub use http1::process::convert_headers_to_http_format;pub use http1::process::parse_http1_request;pub use http1::process::Http1Processor;pub use http2::process::parse_http2_request;pub use http2::process::Http2Processor;pub use http2::Http2Frame;pub use http2::Http2FrameType;pub use http2::Http2Parser;pub use http2::HTTP2_CONNECTION_PREFACE;pub use matcher_api::HttpMatcher;pub use matcher_api::HttpRequestMatch;pub use matcher_api::HttpResponseMatch;pub use matcher_api::UaOsMatch;pub use process::process_ipv4_packet;pub use process::process_ipv6_packet;pub use process::DispatchResult;pub use process::PoolStats;pub use process::WorkerPool;pub use process::WorkerStats;pub use process::FlowKey;pub use process::HttpProcessors;pub use process::TcpFlow;pub use error::*;pub use filter::*;pub use http::observable::*;pub use output::*;