# SNF — Shadow Network Fingerprinting Engine
100% offline. Air-gap-native. Written entirely in Rust.
SNF captures raw packets, reconstructs TCP/UDP flows, and runs them through
14 deterministic protocol analyzers. It detects C2 beacons, DGA domains, DNS
tunnels, lateral movement, data exfiltration, and full ICS/SCADA protocol abuse
across Modbus, S7comm, EtherNet/IP, PROFINET, and DNP3.
Every run produces structured NDJSON with a determinism guarantee — same PCAP,
same config, same version, SHA-256 identical output every time. ...