Protocol Analyzer

Opens a raw socket in promiscuous mode and manually unencapsulates every layer: the 14-byte Ethernet header, the variable-length IP header (length derived from the IHL nibble), and TCP parsing covering sequence numbers, ACKs, flags, and window size, enough to pretty-print a full SYN/SYN-ACK/ACK handshake in real time, watching sequence numbers increment exactly as the RFC says they should.

Added a BPF-style filter syntax so capture can be restricted to specific ports, IPs, or protocol combinations without processing every packet in userspace, expressions like 'tcp and port 443' compile down to a small bytecode interpreter that runs against each packet before any real parsing happens, keeping overhead low on busy interfaces.