Crate seehandshake 

SeeHandshake

seehandshake is a passive TLS handshake observer for the terminal.

This crate provides both a library (used by the seehandshake binary and available for downstream consumers) and a binary. The library is organized into loosely coupled modules that can be exercised independently of live packet capture, which makes the parser and reassembly logic testable from recorded byte fixtures.

Modules

• model: Shared, dependency-free data types (connection keys, handshake info, TLS enumerations).
• parser: TLS record and handshake decoders.
• tracker: Per-connection state, TCP payload reassembly, stale connection eviction.
• capture: The capture::PacketSource trait plus a libpcap-backed live implementation.
• origin: Per-connection process attribution (Linux /proc walker).
• ui: Ratatui three-panel terminal interface.
• cli: Command-line argument definitions and top-level dispatch.
• error: The crate’s error::Error type.

Example

Parsing a recorded TLS ClientHello without any network activity:

use seehandshake::parser::parse_client_hello;

let bytes: &[u8] = &[/* raw TLS record bytes */];
if let Ok(hello) = parse_client_hello(bytes) {
    println!("SNI: {:?}", hello.sni);
}

Re-exports

pub use error::permission_denied_hint;

pub use error::Error;

pub use error::Result;

Modules

capture

Packet capture backends.

cli

Command-line interface for seehandshake.

error

Crate-wide error type.

model

Shared, dependency-free data types.

origin

Per-connection process attribution.

parser

TLS record and handshake decoders.

tracker

Per-connection state, TCP payload reassembly, and stale-connection eviction.

ui

Terminal user interface (Ratatui + crossterm).

util

Small shared helpers used across the crate.