A Rust library for passive analysis of TCP, HTTP, and TLS traffic
Huginn Net is a modular ecosystem of Rust libraries for passive fingerprinting and analysis of multiple network protocols, including TCP, HTTP, and TLS.
Inspired by p0f and JA4, Huginn Net extends passive OS fingerprinting and TLS fingerprinting to support modern detection standards and multi-protocol analysis.
The ecosystem consists of 5 specialized crates that can be used independently or together, providing maximum flexibility for your network analysis needs.
It leverages pnet, pcap-file, and tls-parser to analyze raw packets and extract protocol-specific features for robust, non-intrusive network monitoring.
This ecosystem is under active development. Feedback and contributions welcome.
Key Features
- Modular Architecture: 5 specialized crates for maximum flexibility and performance
- Passive Analysis: Monitor network traffic without sending probes or installing client software
- Multi-Protocol Support: TCP, HTTP/1.x, HTTP/2, and TLS fingerprinting
- Modern Standards: Implements JA4 for TLS and p0f-style TCP OS fingerprinting
- Rust Performance: Memory-safe, concurrent processing of high-volume traffic
- Flexible Input: Analyze live network interfaces or pcap files
Huginn Net Ecosystem
| Crate | Purpose | Use When |
|---|---|---|
| huginn-net | Complete multi-protocol analysis suite | You need TCP + HTTP + TLS analysis |
| huginn-net-tcp | TCP fingerprinting & OS detection | You only need TCP/OS analysis |
| huginn-net-http | HTTP analysis & browser detection | You only need HTTP analysis |
| huginn-net-tls | JA4 TLS client fingerprinting | You only need TLS/JA4 analysis |
| huginn-net-db | P0f database parser & matching engine | Advanced custom signature parsing |
Network Stack (OSI Model)
| Layer | Name | Protocol / Feature | Example in Huginn Net |
|---|---|---|---|
| 7 | Application Layer | TLS | JA4 (FoxIO-style) |
| 7 | Application Layer | HTTP | HTTP/1.1 & HTTP/2, Headers, Cookies, Referer, User-Agent, Lang |
| 4 | Transport Layer | TCP | OS Fingerprinting (p0f-style) |
Getting Started
Choose your approach: Use the complete suite or individual protocol crates.
Multi-Protocol Analysis
For complete network analysis (TCP + HTTP + TLS):
[dependencies]
huginn-net = ""
Protocol-Specific Analysis
For targeted analysis with better performance:
[dependencies]
huginn-net-tcp = "" # TCP/OS fingerprinting only
huginn-net-http = "" # HTTP analysis only
huginn-net-tls = "" # TLS/JA4 analysis only
For changes, refer to the release notes.