Huginn Net: Multi-Protocol Passive Fingerprinting
A Rust library for passive analysis of TCP, HTTP, and TLS traffic
Huginn Net is a modular ecosystem of Rust libraries forpassive fingerprinting and analysis of multiple network protocols, includingTCP, HTTP, and TLS.
Inspired by p0f and JA4, Huginn Net extends passive OS fingerprinting and TLS fingerprinting to support modern detection standards and multi-protocol analysis.
The ecosystem consists of 5 specialized crates that can be used independently or together. It leveragespnet,pcap-file, andtls-parser to analyze raw packets.
This ecosystem is under active development. Feedback and contributions welcome.
Key Features
- Modular architecture: five crates; use the full suite or only TCP, HTTP, TLS, and matching as needed.
- Passive analysis: no probes or endpoint agents; works for pcap review and live capture.
- Multi-protocol: TCP, HTTP/1.x, HTTP/2, and TLS together.
- TLS and JA4: ClientHello parsing and JA4 (FoxIO), SNI, ALPN, GREASE, plus an optional additional stable signature.
- Akamai HTTP/2: frame parsing and Akamai fingerprints from SETTINGS/HEADERS order (Blackhat EU 2017 spec).
- p0f-style TCP: OS fingerprinting, MTU, uptime hints, signature databases.
- Typed signatures: observations are typed structs, so you can build your own database instead of using p0f's.
- Rust performance: memory-safe concurrency for high-volume capture and batch PCAP.
- Raw packets: fingerprints come from the wire or a pcap, not from logs or a tshark/Wireshark pipeline.
Huginn Net Ecosystem
| Crate | Description |
|---|---|
| huginn-net | Complete multi-protocol analysis suite for TCP, HTTP, and TLS fingerprinting |
| huginn-net-tcp | TCP fingerprinting and OS detection when you only need TCP/OS analysis |
| huginn-net-http | HTTP analysis and browser detection when you only need HTTP analysis |
| huginn-net-tls | JA4 TLS client fingerprinting when you only need TLS/JA4 analysis |
| huginn-net-db | P0f database parser and matching engine for advanced custom signature parsing |
Network Stack (OSI Model)
| Layer | Name | Protocol / Feature | Example in Huginn Net |
|---|---|---|---|
| 7 | Application Layer | TLS | JA4 (FoxIO-style) |
| 7 | Application Layer | HTTP | HTTP/1.1 & HTTP/2, Headers, Cookies, Referer, User-Agent, Lang |
| 4 | Transport Layer | TCP | OS Fingerprinting (p0f-style) |
Getting Started
Choose your approach: Use the complete suite or individual protocol crates.
Multi-Protocol Analysis
For complete network analysis (TCP + HTTP + TLS):
[dependencies]
huginn-net = "…"Protocol-Specific Analysis
For targeted analysis with better performance:
[dependencies]
huginn-net-tcp = "…" # TCP/OS fingerprinting only
huginn-net-http = "…" # HTTP analysis only
huginn-net-tls = "…" # TLS/JA4 analysis onlyFor changes, refer to the release notes.