tcp-save-syn

Retrieve the raw SYN packet bytes from accepted TCP connections on Linux via TCP_SAVE_SYN/TCP_SAVED_SYN.

Overview

When TCP_SAVE_SYN is enabled on a listening socket, the Linux kernel saves the raw SYN packet (including IP headers) for each accepted connection. This packet can be retrieved with TCP_SAVED_SYN and used for TCP fingerprinting or analysis.

This crate provides a simple interface to these socket options. On non-Linux platforms, all functions are no-ops that succeed silently, so your code compiles and runs everywhere.

Usage

use std::net::TcpListener;
use tcp_save_syn::{enable_save_syn, get_saved_syn};

let listener = TcpListener::bind("0.0.0.0:8080")?;
enable_save_syn(&listener)?;

let (stream, _addr) = listener.accept()?;
if let Some(syn_bytes) = get_saved_syn(&stream) {
    // syn_bytes contains the raw IP + TCP headers from the SYN packet
    println!("SYN packet: {} bytes", syn_bytes.len());
    // Parse with etherparse, pnet, or your preferred packet parser
}

Works with any socket type implementing AsRawFd, including tokio::net::TcpListener/TcpStream.

Platform Support

Packet Format

The returned bytes start with the IP header:

• IPv4: First nibble is 4, IHL field gives header length
• IPv6: First nibble is 6, fixed 40-byte header

TCP header follows immediately after. The packet may be truncated if TCP Fast Open includes data in the SYN, but headers are always present.

License

Apache-2.0