PitchHut logo
Passive multi-protocol fingerprinting to accurately detect OS, browsers, and network services.
Pitch

Huginn Net is a multi-protocol passive fingerprinting library that allows for the identification of operating systems and services through TCP, HTTP, and TLS traffic analysis without active probes. Built in Rust and compliant with open-source specifications, it's designed for high efficiency with minimal latency, providing reliable insights from network traffic.

Description

Huginn Net is a robust multi-protocol passive fingerprinting library designed for the analysis of TCP, HTTP, and TLS traffic, leveraging open-source methodologies. Built entirely in Rust, Huginn Net delivers fast and reliable data extraction from network packets without actively probing the environment. By employing p0f for TCP and JA4 for TLS protocols, it provides unparalleled accuracy and efficiency, with an impressive average processing time of approximately 3.1ms per packet.

Key Features

Huginn Net excels in the following areas:

  • Operating System Identification: Utilizing TCP fingerprinting inspired by p0f, Huginn Net can discern the OS type, version, and network stack of remote hosts.
  • Application and Browser Detection: By examining HTTP headers and implementing JA4 TLS client fingerprinting, it accurately identifies applications and web browsers.
  • Network Infrastructure Insights: The library is capable of detecting intermediary devices such as proxies and load balancers.
  • Client Capabilities Profiling: Insights into supported TLS versions, cipher suites, and extensions are provided, enhancing understanding of client capabilities.

OSI Model Analysis

The Huginn Net library supports comprehensive network stack analysis:

LayerProtocol / FeatureDescription
7TLSJA4 (FoxIO-style) + new TLS stable signatures
7HTTPAnalysis of HTTP/1 & HTTP/2 protocols via headers, User-Agent, and language detection
4TCPOS Fingerprinting inspired by p0f

Available Crates

Huginn Net includes several specialized crates to cater to different analysis needs:

CrateDescriptionDocumentation
huginn-netComprehensive Multi-Protocol AnalysisUsage Guide
huginn-net-tcpTCP Analysis focused on OS fingerprinting and MTU detectionTCP Guide
huginn-net-httpHTTP Analysis for browser and web server detectionHTTP Guide
huginn-net-tlsTLS Client Analysis using JA4 fingerprinting, including the stable variant JA4_s1 / JA4_s1rTLS Guide

Performance Metrics

Huginn Net has been optimized for speed and can achieve impressive throughput across various protocols:

ProtocolDetection SpeedFull Analysis SpeedPrimary Use Case
TCP83.3M pps975.6K ppsOS fingerprinting, MTU detection
HTTP142.9M pps526.6K ppsBrowser/server detection
TLS48M pps45K ppsJA4 fingerprinting, TLS analysis

Advanced Features

In addition to basic fingerprinting capabilities, Huginn Net offers advanced functionalities:

  • Custom Signature Databases: Users can define or contribute their own signatures to enhance detection accuracy.
  • Packet Filtering: Optional filtering by port/IP address boosts performance before full packet analysis.
  • Quality Matching Scores: Each match is evaluated based on a quality scoring system, ensuring precision in identification.

Additional Tools

For users interested in more interactive and visual data analysis, Huginn Net offers companion projects:

  • huginn-net-profiler:A real-time web profiling for testing that visualizes fingerprint data. Using huginn-net as sidecar container.
  • huginn-proxy: An experimental high-performance reverse proxy that integrates advanced fingerprinting functionalities.

Huginn Net represents a significant stride in passive fingerprinting methodologies, ensuring developers and network analysts have the tools they need to effectively analyze traffic patterns in a secure and efficient manner.

0 comments

No comments yet.

Sign in to be the first to comment.