TPT Open Source

tpt-fathom

Rust
0 stars0 forks0 watchersApache License 2.0
View on GitHub

Languages

Rust94.0%Python5.1%PowerShell0.9%
README

TPT Fathom

A memory-safe, highly extensible, and declarative network protocol analyzer and packet inspection engine — a spiritual successor to Wireshark.

Why

Wireshark's C dissectors parse untrusted, malformed network packets. A single buffer overflow in a C dissector can let a maliciously crafted packet execute arbitrary code on a security analyst's machine, and writing a new dissector in C takes days of boilerplate.

TPT Fathom's dissectors are described by a Declarative Schema (YAML), compiled into a safe parser at runtime by a Rust engine built on zerocopy. Adding a new protocol is a matter of writing (or AI-generating) a schema file, not writing unsafe C.

Status

Early scaffolding — see todo.md for the full build-out checklist and docs/SCHEMA.md (once written) for the schema format.

Project layout

  • crates/fathom-schema — Declarative Schema YAML format: types, loader, validator
  • crates/fathom-engine — zerocopy-based dissection engine (schema + bytes -> field tree)
  • crates/fathom-capture — pcap/pcapng file reading and live capture (Npcap + tokio)
  • crates/fathom-cli — CLI: dissect a file or live interface, print/export JSON
  • crates/fathom-gui — egui desktop app: packet list, hex view, field-tree detail pane
  • schemas/ — hand-written YAML protocol schemas (Ethernet, IPv4, TCP, UDP, DNS, HTTP/2, SMB)
  • tools/ai-extractor — Claude-API tool that derives a draft YAML schema from a protocol spec (RFC text) — deliberately does not ingest Wireshark's GPL-licensed C source
  • tools/fuzz — scapy-based malformed-packet generator for manual robustness testing
  • tests/ — pcap fixtures and integration tests

Building (Windows)

fathom-capture's live-capture support links against the Npcap SDK. Before building, fetch it once (headers + import libs only, ~1 MB, no admin rights needed):

pwsh tools/fetch-npcap-sdk.ps1

This is build-time only. Plain file-mode decoding (fathom-cli capture.pcap) works with nothing else installed; --interface/--list-interfaces additionally need the Npcap runtime installed (https://npcap.com/#download) to actually run.

Tech stack

Rust, zerocopy, tokio, serde, egui, pcap (Npcap on Windows); Python + scapy for fuzz-input generation and Python + the Claude API for the AI schema-extraction tool.

License

Apache-2.0 — see LICENSE.