A Rust library for passive analysis of TCP, HTTP, and TLS traffic
Huginn Net is a Rust library for passive fingerprinting and analysis of multiple network protocols, including TCP, HTTP, and TLS.
Inspired by p0f and JA4, Huginn Net extends passive OS fingerprinting and TLS fingerprinting to support modern detection standards and multi-protocol analysis.
It leverages pnet, httparse, pcap-file, and tls-parser to analyze raw packets and extract protocol-specific features for robust, non-intrusive network monitoring.
Specifically, Huginn Net does not require any client-side software installation and can be used to analyze traffic on any network interface or via pcap files.
This library is under active development. Feedback and contributions welcome.
Network Stack (OSI Model)
| Layer | Name | Protocol / Feature | Example in Huginn Net |
|---|---|---|---|
| 7 | Application Layer | TLS | JA4 (FoxIO-style) |
| 7 | Application Layer | HTTP | Headers, User-Agent, Lang |
| 4 | Transport Layer | TCP | OS Fingerprinting (p0f-style) |
Getting Started
To get started with Cargo, simply add the following line to your Cargo.toml file.
[dependencies]
huginn-net = ""
For changes, refer to the release notes.