tcp

type IPHeader struct {
	Version    uint8  // IP version (4 or 6)
	TTL        uint8  // Time to Live
	TotalLen   uint16 // Total length
	Flags      uint8  // Flags (DF, MF, RF)
	FragOffset uint16 // Fragment offset
	ID         uint16 // Identifier
	Protocol   uint8  // Protocol number (6=TCP, 17=UDP)
	Checksum   uint16 // Checksum
	Src        string // Source IP
	Dst        string // Destination IP
}

type OSFingerprint struct {
	Name           string  // Operating system name (e.g., "Windows 11")
	Family         string  // OS family (Windows, Linux, macOS, etc.)
	Version        string  // Version number
	DefaultTTL     int     // Default TTL value
	WindowSizes    []int   // Common window sizes (ascending order)
	MSS            int     // Typical MSS value
	TCPOptions     string  // TCP option characteristics
	IPFlags        uint8   // IP flag characteristics
	Quirks         string  // OS quirks and peculiarities
	SYNACKSequence string  // SYN-ACK sequence characteristics
	Probability    float64 // Match probability
}

type TCPFlags struct {
	SYN bool // Synchronize flag (connection establishment)
	ACK bool // Acknowledgment flag
	FIN bool // Finish flag
	RST bool // Reset flag
	PSH bool // Push flag
	URG bool // Urgent flag
}

type TCPIPAnalyzer struct {
	// contains filtered or unexported fields
}

type TCPIPResult struct {
	// Operating system identification
	OS            string   // Identified operating system
	OSFamily      string   // Operating system family
	Confidence    float64  // Identification confidence
	CandidateOSes []string // Candidate operating system list

	// Network characteristics
	InitialTTL        int   // Initial TTL value
	AverageWindowSize int   // Average window size
	MSS               int   // Maximum Segment Size
	NetworkLatency    int64 // Network latency (milliseconds)

	// TCP behavior
	SeqNumberBehavior string // Sequence number generation behavior
	AckBehavior       string // ACK number behavior
	ResetBehavior     string // Reset behavior

	// Security indicators
	RiskScore      float64  // Risk score
	AnomaliesFound []string // Detected anomalies
	IsVPN          bool     // Whether VPN is used
	IsProxy        bool     // Whether proxy is used
	IsNAT          bool     // Whether NAT is used

	// Detailed signature
	Signature TCPIPSignature
}

type TCPIPSignature struct {
	Hash              string            // MD5 hash
	RawSignature      string            // Raw signature string
	OS                string            // Identified operating system
	OSVersion         string            // Operating system version
	Confidence        float64           // Confidence level (0.0-1.0)
	MatchedProfiles   []string          // Matched fingerprint profiles
	TTLValue          int               // TTL value
	WindowSizeFamily  string            // Window size family (e.g., "Linux", "Windows")
	MSS               int               // Maximum Segment Size
	OptimizationLevel string            // Optimization level
	Features          map[string]string // Additional features
}

type TCPOptions struct {
	MSS           *uint16 // Maximum Segment Size
	WindowScale   *uint8  // Window scale factor
	SACK          bool    // Selective Acknowledgment
	Timestamps    bool    // Timestamps
	SAckPermitted bool    // SACK Permitted
	NoOperation   int     // NOP count
	EndOfOptions  bool    // End of option list
	WindowSize    uint16  // Window size
	OptionsMD5    string  // Options hash fingerprint
}

type TCPPacket struct {
	// IP layer
	IPHeader IPHeader

	// TCP layer
	SrcPort    uint16   // Source port
	DstPort    uint16   // Destination port
	SeqNum     uint32   // Sequence number
	AckNum     uint32   // Acknowledgment number
	Flags      TCPFlags // Flags
	WindowSize uint16   // Window size
	Checksum   uint16   // TCP checksum
	UrgentPtr  uint16   // Urgent pointer
	DataLen    uint16   // Data length

	// TCP options
	Options TCPOptions

	// Timing and statistics
	Timestamp   int64 // Packet timestamp
	RoundTripMs int64 // Round-trip time (milliseconds)
}