Rust library

Huginn Net: Multi-Protocol Passive Fingerprinting

A Rust library for passive analysis of TCP, HTTP, and TLS traffic

Huginn Net is a modular ecosystem of Rust libraries for passive fingerprinting and analysis of multiple network protocols, including TCP, HTTP, and TLS.
Inspired by p0f and JA4, Huginn Net extends passive OS fingerprinting and TLS fingerprinting to support modern detection standards and multi-protocol analysis.
The ecosystem consists of 5 specialized crates that can be used independently or together. It leverages pnet, pcap-file, and tls-parser to analyze raw packets.
This ecosystem is under active development. Feedback and contributions welcome.

Documentation View on GitHub

Key Features

Modular architecture: five crates; use the full suite or only TCP, HTTP, TLS, and matching as needed.
Passive analysis: no probes or endpoint agents; works for pcap review and live capture.
Multi-protocol: TCP, HTTP/1.x, HTTP/2, and TLS together.
TLS and JA4: ClientHello parsing and JA4 (FoxIO-style), SNI, ALPN, GREASE.
Akamai HTTP/2: frame parsing and Akamai-style fingerprints from SETTINGS/HEADERS order (Blackhat EU 2017 spec).
p0f-style TCP: OS fingerprinting, MTU, uptime hints, signature databases.
Rust performance: memory-safe concurrency for high-volume capture and batch PCAP.
Flexible input: live interfaces or pcap files, same pipeline for lab and production.

Huginn Net Ecosystem

Crate	Description
huginn-net	Complete multi-protocol analysis suite for TCP, HTTP, and TLS fingerprinting
huginn-net-tcp	TCP fingerprinting and OS detection when you only need TCP/OS analysis
huginn-net-http	HTTP analysis and browser detection when you only need HTTP analysis
huginn-net-tls	JA4 TLS client fingerprinting when you only need TLS/JA4 analysis
huginn-net-db	P0f database parser and matching engine for advanced custom signature parsing

Network Stack (OSI Model)

Layer	Name	Protocol / Feature	Example in Huginn Net
7	Application Layer	TLS	JA4 (FoxIO-style)
7	Application Layer	HTTP	HTTP/1.1 & HTTP/2, Headers, Cookies, Referer, User-Agent, Lang
4	Transport Layer	TCP	OS Fingerprinting (p0f-style)

Getting Started

Choose your approach: Use the complete suite or individual protocol crates.

Multi-Protocol Analysis

For complete network analysis (TCP + HTTP + TLS):

[dependencies]
huginn-net = "…"

Protocol-Specific Analysis

For targeted analysis with better performance:

[dependencies]
huginn-net-tcp = "…"   # TCP/OS fingerprinting only
huginn-net-http = "…"  # HTTP analysis only
huginn-net-tls = "…"   # TLS/JA4 analysis only

For changes, refer to the release notes.