docs: add project scope, fix RustNet capitalization, list missing DPI protocols (#270)

ARCHITECTURE.md

@@ -68,6 +68,9 @@ Multiple worker threads (up to 4 by default, based on CPU cores) that parse pack
   - DNS queries and responses
   - SSH connections with version detection
   - QUIC protocol with CONNECTION_CLOSE frame detection
+  - MQTT with packet types, version, and client identifier
+  - BitTorrent handshakes and DHT messages
+  - STUN for WebRTC and NAT traversal
   - NTP with version, mode, and stratum
   - mDNS and LLMNR for local name resolution
   - DHCP with message types and hostnames

CONTRIBUTING.md

@@ -1,6 +1,18 @@
-# Contributing to rustnet
+# Contributing to RustNet
 
-Pull requests are very welcome! Whether you're fixing bugs, adding features, improving documentation, or providing feedback, all contributions help make rustnet better.
+Pull requests are very welcome! Whether you're fixing bugs, adding features, improving documentation, or providing feedback, all contributions help make RustNet better.
+
+## Project Scope
+
+RustNet aims to stay small and fast. Not every protocol or feature belongs in the core tool, even when a contribution is well-written.
+
+For Deep Packet Inspection in particular, we lean toward protocols that:
+
+- A meaningful share of RustNet users will actually encounter on their networks.
+- Produce visible, useful information (the plaintext window is wide enough to extract real metadata, not just to confirm the protocol exists before everything goes TLS).
+- Fit the existing architecture without disproportionate maintenance cost.
+
+If a protocol is rarely seen in modern traffic, almost always TLS-wrapped, or niche to a single user base, we may still close the PR with thanks even if the code is correct. Please open an issue first for any new protocol so we can sanity-check fit before you invest implementation time.
 
 ## Development Workflow
 

CONTRIBUTORS.md

@@ -1,6 +1,6 @@
 # Contributors
 
-We would like to thank the following people for their contributions to rustnet:
+We would like to thank the following people for their contributions to RustNet:
 
 ## Maintainer
 
@@ -16,6 +16,6 @@ We would like to thank these people for their valuable contributions:
 
 ## Contributing
 
-We welcome and appreciate all contributions! Whether you're fixing bugs, adding features, improving documentation, or helping with ideas and feedback, your contributions make rustnet better.
+We welcome and appreciate all contributions! Whether you're fixing bugs, adding features, improving documentation, or helping with ideas and feedback, your contributions make RustNet better.
 
 See our [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to contribute.

INSTALL.md

@@ -34,13 +34,13 @@ Pre-built packages are available for each release on the [GitHub Releases](https
 2. **Open the DMG** and drag Rustnet.app to your Applications folder
 
 3. **Bypass Gatekeeper** (for unsigned builds):
-   - When you first try to open Rustnet, macOS will block it because the app is not signed
+   - When you first try to open RustNet, macOS will block it because the app is not signed
    - Go to **System Settings → Privacy & Security**
-   - Scroll down to find the message about Rustnet being blocked
+   - Scroll down to find the message about RustNet being blocked
    - Click **"Open Anyway"** to allow the application to run
    - You may need to confirm this choice when launching the app again
 
-4. **Run Rustnet**:
+4. **Run RustNet**:
    - Double-click Rustnet.app to launch it in a Terminal window with sudo
    - Or run from command line: `sudo /Applications/Rustnet.app/Contents/MacOS/rustnet`
 
@@ -70,7 +70,7 @@ Pre-built packages are available for each release on the [GitHub Releases](https
 
 3. **Run the installer** and follow the installation wizard
 
-4. **Run Rustnet**:
+4. **Run RustNet**:
    - Open Command Prompt or PowerShell
    - Run: `rustnet.exe`
    - If Npcap is not installed or not in WinPcap compatible mode, RustNet will display a helpful error message with installation instructions

README.md

@@ -29,7 +29,7 @@
 ## Features
 
 - **Per-process attribution**: Every TCP, UDP, and QUIC connection mapped to its owning process, via eBPF on Linux, PKTAP on macOS, native APIs on Windows and FreeBSD. Wireshark and tcpdump can't do this; `netstat` / `ss` can't show live state.
-- **Deep packet inspection**: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, QUIC, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors.
+- **Deep packet inspection**: Identify HTTP, HTTPS/TLS with SNI, DNS, SSH, QUIC, MQTT, BitTorrent, STUN, NTP, mDNS, LLMNR, DHCP, SNMP, SSDP, and NetBIOS, without external dissectors.
 - **Security sandboxing**: Landlock (Linux 5.13+), Seatbelt (macOS), token privilege drop + job-object child-process block (Windows). Drops privileges immediately after libpcap initializes. See [SECURITY.md](SECURITY.md).
 - **TCP network analytics**: Real-time retransmissions, out-of-order packets, and fast-retransmit detection, per-connection and aggregate.
 - **Smart connection lifecycle**: Protocol-aware timeouts with white → yellow → red staleness indicators. Toggle `t` to keep historic (closed) connections visible for forensics.

README.zh-CN.md

@@ -29,7 +29,7 @@
 ## 功能特性
 
 - **进程级归属识别**：每一条 TCP、UDP、QUIC 连接都能追溯到所属进程。Linux 使用 eBPF，macOS 使用 PKTAP，Windows 与 FreeBSD 则走原生 API。Wireshark 与 tcpdump 做不到这一点；`netstat` / `ss` 也无法展示实时状态。
-- **深度包检测**：无需外部解析器即可识别 HTTP、带 SNI 的 HTTPS/TLS、DNS、SSH、QUIC、NTP、mDNS、LLMNR、DHCP、SNMP、SSDP 及 NetBIOS。
+- **深度包检测**：无需外部解析器即可识别 HTTP、带 SNI 的 HTTPS/TLS、DNS、SSH、QUIC、MQTT、BitTorrent、STUN、NTP、mDNS、LLMNR、DHCP、SNMP、SSDP 及 NetBIOS。
 - **安全沙箱**：Linux 5.13+ 使用 Landlock，macOS 使用 Seatbelt，Windows 通过 token 降权 + job-object 阻止子进程创建。libpcap 初始化完成后立即丢弃特权。详见 [SECURITY.md](SECURITY.md)。
 - **TCP 网络分析**：实时统计重传、乱序包、快重传，既有逐连接视图也有汇总视图。
 - **智能连接生命周期**：按协议设置超时，以白 → 黄 → 红的颜色指示过期程度。按 `t` 可保留历史（已关闭）连接以便事后追溯。