Crate huginn_net_tcp 

TCP fingerprinting primitives.

This crate is intentionally independent of any signature database. It exposes:

• tcp pure data types describing a TCP fingerprint.
• TcpObservation what was observed on the wire.
• matcher_api::TcpMatcher the trait any database/matcher implements to provide OS/MTU matches.
• HuginnNetTcp the high-level capture/processing entry point that plugs an arbitrary matcher in.

In the default workspace setup, huginn-net-db provides TcpSignatureMatcher, which loads p0f-style signatures and implements matcher_api::TcpMatcher.

Cargo Features

All features are opt-in: the default build is an empty shell that exposes only the traits and entry points. Pick the analyses you actually consume, or use the convenience full alias to opt into everything this version offers (including future axes added in later releases).

Feature	Default	Description
full	No	Convenience alias for “everything this version offers” (currently syn + syn-ack + mtu + uptime). Stable across version upgrades; additions land here automatically.
syn	No	TCP SYN OS fingerprinting (client → server, request side). Gates [SynTCPOutput].
syn-ack	No	TCP SYN+ACK OS fingerprinting (server → client, response side). Gates [SynAckTCPOutput].
mtu	No	MTU extraction from the TCP MSS option. Gates [mtu] and [MTUOutput].
uptime	No	Uptime estimation from TCP timestamps for both client and server sides. Gates [uptime] and pulls in ttl_cache.
json	No	Enables [serde::Serialize] on TcpAnalysisResult and TCP output types for JSON/NDJSON consumers. Not included in full.

When a build disables every feature that would consume a packet’s side (request or response), visit_tcp short-circuits before parsing TCP options. SYN-only builds therefore pay zero per-packet cost for SYN+ACK traffic, and SYN+ACK-only builds skip the request-side work entirely.

Common opt-in examples:

# Everything this version offers (forward-compatible).
huginn-net-tcp = { version = "2.0.0", features = ["full"] }

# Cherry-pick only what you need (smallest possible build).
huginn-net-tcp = { version = "2.0.0", features = ["syn"] }

Re-exports

pub use analyzer::HuginnNetTcp;

pub use analyzer::SharedTcpMatcher;

pub use process::process_ipv4_packet;

pub use process::process_ipv6_packet;

pub use process::ConnectionTracker;

pub use process::DispatchResult;

pub use process::PoolStats;

pub use process::WorkerPool;

pub use process::WorkerStats;

pub use tcp::observable::ObservableTcp;

pub use tcp::observable::TcpObservation;

pub use error::*;

pub use filter::*;

pub use output::*;

Modules

analyzer

display

error

filter

ip_options

matcher_api

Matching boundary between this crate and any database/matcher implementation.

observable

output

packet_hash

packet_parser

parallel

parser

process

raw_filter

syn_options

tcp

tcp_process

ttl

window_size