Developer documentation

NetOtter is about 12,600 lines of C (headers included), about 500 functions in 73 files, with no dependency besides OpenSSL's libcrypto. One source tree builds for Linux and Windows. The OS-specific code sits behind a small C "interface", and exactly one backend is compiled in.

Pages

Page	What it covers
Building	Every Makefile rule: debug, release, sanitizers, Windows cross build, docs.
Architecture	The modules, the main loop, and a frame's way from the wire to the packet list.
OS backends	The common_lib.h contract, and how Linux and Windows implement it.
Packet parsing	Link, network and transport decoding, and how to add a protocol.
Packet storage	The packet list, the RAM budget, the payload compressor and the spool.
Save format	The .nto format, byte by byte.
Hostname learning	Names from DNS answers, TLS SNI and decrypted QUIC Initial packets.
Reverse DNS internals	The lookups NetOtter sends, the log and the answer cache.
Filters and analysis internals	Filter matching, the analysis view's output pipeline, renamings.
Coding conventions	Style, helpers to use, commits and branches.
Function explorer	Every function: signature, comment, callers and callees. Also as an interactive page.

Source tree

includes/            shared headers (netotter.h, netotter_types.h, common_lib.h...)
src/entry_point/     main() and netotter(): startup, main loops, cleanup
src/commands/        the interactive commands; src/keys.c dispatches the keys
src/parsers/         command line; link / network / transport decoding; DNS, TLS, QUIC
src/display/         the l list line, the i details, value formatting
src/filters/         display filters and the machine's own addresses
src/analysis/        analysis view: renamings, hostnames, apps, reverse DNS
src/save/            .nto writing and reading
src/helpers/         packet list, frame queue, packet structure, payload store
src/static_data/     name tables (protocols, ports, apps, filters) and constants
libs/utils/          OS-neutral helpers: output, strings, interface list, compressor
libs/linux/          the Linux backend
libs/windows/        the Windows backend, plus the bundled OpenSSL DLL and headers
tools/codemap/       the generator of the function explorer (make docs)

Where to start reading

1. src/entry_point/netotter.c: netotter() is the whole program in about 40 lines.
2. includes/common_lib.h: everything the core asks of the OS.
3. src/parsers/raw_to_f.c: how a raw frame becomes a packet.
4. includes/netotter_types.h: fpacket_t and the header structures.