A Rust library for passive analysis of TCP, HTTP, and TLS traffic
Huginn Net is a Rust library for passive fingerprinting and analysis of multiple network protocols, including TCP, HTTP, and TLS.
Inspired by p0f and JA4, Huginn Net extends passive OS fingerprinting and TLS fingerprinting to support modern detection standards and multi-protocol analysis.
It leverages pnet, pcap-file, and tls-parser to analyze raw packets and extract protocol-specific features for robust, non-intrusive network monitoring.
Specifically, Huginn Net does not require any client-side software installation and can be used to analyze traffic on any network interface or via pcap files.
This library is under active development. Feedback and contributions welcome.
Key Features
- Passive Analysis: Monitor network traffic without sending probes or installing client software
- Multi-Protocol Support: TCP, HTTP/1.x, HTTP/2, and TLS fingerprinting in one library
- Modern Standards: Implements JA4 for TLS and p0f-style TCP OS fingerprinting
- Rust Performance: Memory-safe, concurrent processing of high-volume traffic
- Flexible Input: Analyze live network interfaces or pcap files
Network Stack (OSI Model)
| Layer | Name | Protocol / Feature | Example in Huginn Net |
|---|---|---|---|
| 7 | Application Layer | TLS | JA4 (FoxIO-style) |
| 7 | Application Layer | HTTP | HTTP/1.1 & HTTP/2, Headers, Cookies, Referer, User-Agent, Lang |
| 4 | Transport Layer | TCP | OS Fingerprinting (p0f-style) |
Getting Started
To get started with Cargo, simply add the following line to your Cargo.toml file.
[dependencies]
huginn-net = ""
For changes, refer to the release notes.