Struct HuginnNet 

pub struct HuginnNet<'a> {
    pub tcp_matcher: Option<SignatureMatcher<'a>>,
    pub http_matcher: Option<SignatureMatcher<'a>>,
    /* private fields */
}

A multi-protocol passive fingerprinting library inspired by p0f with JA4 TLS client fingerprinting.

The HuginnNet struct acts as the core component of the library, handling TCP, HTTP, and TLS packet analysis and matching signatures using a database of known fingerprints, plus JA4 TLS client analysis following the official FoxIO specification.

Fields

tcp_matcher: Option<SignatureMatcher<'a>>

http_matcher: Option<SignatureMatcher<'a>>

Implementations

impl<'a> HuginnNet<'a>

pub fn new( database: Option<&'a Database>, max_connections: usize, config: Option<AnalysisConfig>, ) -> Result<Self, HuginnNetError>

Creates a new instance of HuginnNet.

Parameters

• database: Optional reference to the database containing known TCP/Http signatures from p0f. Only loaded if matcher_enabled is true and HTTP or TCP analysis is enabled. Not needed for TLS-only analysis or when fingerprint matching is disabled.
• max_connections: The maximum number of connections to maintain in the connection tracker and HTTP flows.
• config: Optional configuration specifying which protocols to analyze. If None, uses default (all enabled). When matcher_enabled is false, the database won’t be loaded and no signature matching will be performed.

Returns

A new HuginnNet instance initialized with the given database, max connections, and configuration.

Errors

Returns HuginnNetError::MissConfiguration if matcher_enabled is true but no database is provided.

pub fn analyze_network( &mut self, interface_name: &str, sender: Sender<FingerprintResult>, cancel_signal: Option<Arc<AtomicBool>>, ) -> Result<(), Box<dyn Error>>

Captures and analyzes packets on the specified network interface.

Sends FingerprintResult through the provided channel.

Parameters

• interface_name: The name of the network interface to analyze.
• sender: A Sender to send FingerprintResult objects back to the caller.
• cancel_signal: Optional Arc<AtomicBool> to signal graceful shutdown.

Errors

• If the network interface cannot be found or a channel cannot be created.

pub fn analyze_pcap( &mut self, pcap_path: &str, sender: Sender<FingerprintResult>, cancel_signal: Option<Arc<AtomicBool>>, ) -> Result<(), Box<dyn Error>>

Analyzes packets from a PCAP file.

Parameters

• pcap_path: The path to the PCAP file to analyze.
• sender: A Sender to send FingerprintResult objects back to the caller.
• cancel_signal: Optional Arc<AtomicBool> to signal graceful shutdown.

Errors

• If the PCAP file cannot be opened or read.

pub fn analyze_tcp(&mut self, packet: &[u8]) -> FingerprintResult

Analyzes a TCP packet and returns a FingerprintResult object.

Parameters

• packet: A reference to the TCP packet to analyze.

Returns

A FingerprintResult object containing the analysis results.