Struct HuginnNetHttp 

pub struct HuginnNetHttp { /* private fields */ }

An HTTP-focused passive fingerprinting analyzer.

Extracts HTTP/1.x and HTTP/2 observable signals and optionally matches them against a signature database for browser and web-server identification.

Examples

Sequential: raw HTTP signals, no database:

use huginn_net_http::HuginnNetHttp;
use std::sync::mpsc;

let (tx, rx) = mpsc::channel();
HuginnNetHttp::new(1000).analyze_pcap("capture.pcap", tx, None).unwrap();
for result in rx {
    if let Some(req) = result.http_request { println!("{req}"); }
}

Sequential with browser/server matching (huginn-net-db):

use huginn_net_http::HuginnNetHttp;
use huginn_net_db::{Database, SharedHttpSignatureMatcher};
use std::sync::{mpsc, Arc};

let db = Database::load_default().unwrap();
let matcher = Arc::new(SharedHttpSignatureMatcher::from_database(&db));
let (tx, rx) = mpsc::channel();
HuginnNetHttp::new(1000)
    .with_matcher(matcher)
    .analyze_pcap("capture.pcap", tx, None)
    .unwrap();

Parallel: flow-based routing so HTTP reassembly state stays per-worker:

use huginn_net_http::HuginnNetHttp;
use std::sync::mpsc;

let (tx, rx) = mpsc::channel();
let mut analyzer = HuginnNetHttp::new(1000).with_parallel(2, 100, 16, 10);
// Results are delivered via the sender given to init_pool.
analyzer.init_pool(tx.clone()).unwrap();
analyzer.analyze_pcap("capture.pcap", tx, None).unwrap();

Implementations

impl HuginnNetHttp

pub fn new(max_connections: usize) -> Self

Creates a new instance of HuginnNetHttp in sequential mode.

Parameters

• max_connections: Maximum number of HTTP flows to track

pub fn with_parallel( self, num_workers: usize, queue_size: usize, batch_size: usize, timeout_ms: u64, ) -> Self

Enable parallel processing (builder pattern).

Parameters

• num_workers: Number of worker threads (recommended: 2 for HTTP due to flow tracking)
• queue_size: Size of each worker’s packet queue (typical: 100-200)
• batch_size: Maximum packets to process in one batch (typical: 8-32, recommended: 16)
• timeout_ms: Worker receive timeout in milliseconds (typical: 5-20, recommended: 10)

pub fn with_matcher(self, matcher: SharedHttpMatcher) -> Self

Plug a signature matcher (e.g. huginn_net_db::SharedHttpSignatureMatcher).

Without a matcher, analyze_* still returns observable HTTP signals but every match quality is reported as Disabled.

pub fn with_filter(self, config: FilterConfig) -> Self

Configure packet filtering (builder pattern)

pub fn init_pool( &mut self, result_tx: Sender<HttpAnalysisResult>, ) -> Result<(), HuginnNetHttpError>

Initializes the worker pool for parallel processing.

Must be called after with_parallel and before calling analyze_network or analyze_pcap.

pub fn worker_pool(&self) -> Option<Arc<WorkerPool>>

Returns a reference to the worker pool if initialized.

pub fn stats(&self) -> Option<PoolStats>

Returns current worker pool statistics if parallel mode is active.

pub fn analyze_network( &mut self, interface_name: &str, sender: Sender<HttpAnalysisResult>, cancel_signal: Option<Arc<AtomicBool>>, ) -> Result<(), HuginnNetHttpError>

Analyzes network traffic from a live network interface for HTTP packets.

pub fn analyze_pcap( &mut self, pcap_path: &str, sender: Sender<HttpAnalysisResult>, cancel_signal: Option<Arc<AtomicBool>>, ) -> Result<(), HuginnNetHttpError>

Analyzes HTTP packets from a PCAP file.