Huginn Net — Passive multi protocol fingerprinting to…

Pitch

Description

Comments

About this project

Huginn Net is a multi-protocol passive fingerprinting library that allows for the identification of operating systems and services through TCP, HTTP, and TLS traffic analysis without active probes. Built in Rust and compliant with open-source specifications, it's designed for high efficiency with minimal latency, providing reliable insights from network traffic.

Huginn Net is a robust multi-protocol passive fingerprinting library designed for the analysis of TCP, HTTP, and TLS traffic, leveraging open-source methodologies. Built entirely in Rust, Huginn Net delivers fast and reliable data extraction from network packets without actively probing the environment. By employing p0f for TCP and JA4 for TLS protocols, it provides unparalleled accuracy and efficiency, with an impressive average processing time of approximately 3.1ms per packet.

Key Features

Huginn Net excels in the following areas:

Operating System Identification: Utilizing TCP fingerprinting inspired by p0f, Huginn Net can discern the OS type, version, and network stack of remote hosts.
Application and Browser Detection: By examining HTTP headers and implementing JA4 TLS client fingerprinting, it accurately identifies applications and web browsers.
Network Infrastructure Insights: The library is capable of detecting intermediary devices such as proxies and load balancers.
Client Capabilities Profiling: Insights into supported TLS versions, cipher suites, and extensions are provided, enhancing understanding of client capabilities.

OSI Model Analysis

The Huginn Net library supports comprehensive network stack analysis:

Layer	Protocol / Feature	Description
7	TLS	JA4 (FoxIO-style) + new TLS stable signatures
7	HTTP	Analysis of HTTP/1 & HTTP/2 protocols via headers, User-Agent, and language detection
4	TCP	OS Fingerprinting inspired by p0f

Available Crates

Huginn Net includes several specialized crates to cater to different analysis needs:

Crate	Description	Documentation
huginn-net	Comprehensive Multi-Protocol Analysis	Usage Guide
huginn-net-tcp	TCP Analysis focused on OS fingerprinting and MTU detection	TCP Guide
huginn-net-http	HTTP Analysis for browser and web server detection	HTTP Guide
huginn-net-tls	TLS Client Analysis using JA4 fingerprinting, including the stable variant JA4_s1 / JA4_s1r	TLS Guide

Performance Metrics

Huginn Net has been optimized for speed and can achieve impressive throughput across various protocols:

Protocol	Detection Speed	Full Analysis Speed	Primary Use Case
TCP	83.3M pps	975.6K pps	OS fingerprinting, MTU detection
HTTP	142.9M pps	526.6K pps	Browser/server detection
TLS	48M pps	45K pps	JA4 fingerprinting, TLS analysis

Advanced Features

In addition to basic fingerprinting capabilities, Huginn Net offers advanced functionalities:

Custom Signature Databases: Users can define or contribute their own signatures to enhance detection accuracy.
Packet Filtering: Optional filtering by port/IP address boosts performance before full packet analysis.
Quality Matching Scores: Each match is evaluated based on a quality scoring system, ensuring precision in identification.

Additional Tools

For users interested in more interactive and visual data analysis, Huginn Net offers companion projects:

huginn-net-profiler:A real-time web profiling for testing that visualizes fingerprint data. Using huginn-net as sidecar container.
huginn-proxy: An experimental high-performance reverse proxy that integrates advanced fingerprinting functionalities.

Huginn Net represents a significant stride in passive fingerprinting methodologies, ensuring developers and network analysts have the tools they need to effectively analyze traffic patterns in a secure and efficient manner.