# cloudflare/wirefilter

An execution engine for Wireshark-like filters

Repository: https://github.com/cloudflare/wirefilter
Canonical: https://ross.abutalabs.com/products/wirefilter
Homepage: https://blog.cloudflare.com/building-fast-interpreters-in-rust/
Language: Rust
License: MIT
License Family: permissive
Topics: rust, wireshark, filters, engine, compiler, firewall, firewall-rules, firewall-configuration
Last push: 2026-08-20T09:52:07+00:00

## Health v2 (maintenance only)
Score: 76/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 98, release rhythm 35, longevity 100
- inputs: {"age_days": 2753, "days_push": 13, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1154, forks 120 (observed 2026-08-28T04:03:47.518791+00:00)

## What it is
A Rust library implementing an execution engine for Wireshark-like filter expressions, including parsing, compilation, and fast evaluation. It powers Cloudflare's firewall rules and can be embedded in other products.

## Use cases
- evaluate wireshark-style filter expressions in my application
- embed a fast packet filter DSL in a Rust service
- compile and run firewall rule expressions
- parse network filter syntax into an AST
- build custom filtering rules for traffic matching

## When to choose
- you need Wireshark-compatible filter syntax with high-performance evaluation
- you want a memory-safe Rust engine to embed in other languages
- you're building firewall or traffic-matching rule engines

## When to avoid
- you need a full packet capture or analysis tool rather than a filter engine
- you want a ready-made firewall application with a UI
- your filters are simple enough for plain boolean logic without a DSL

## Facets
- artifact type: library
- maturity: active
- function: parser, compiler, interpreter
- domain: networking, security, developer-tools
- platform: rust, cross-platform
- tags: wireshark-syntax, filter-engine, dsl, firewall-rules, packet-filtering

## Member repositories
- cloudflare/wirefilter (main) score 76

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:47.518791+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:33:21.759976+00:00, confidence not recorded.
  - readme: https://github.com/cloudflare/wirefilter (fetched 2026-08-28T04:03:47.518791+00:00, sha 78692e5a5d79)
  - homepage: https://blog.cloudflare.com/building-fast-interpreters-in-rust/ (fetched 2026-08-29T12:37:40.494665+00:00, sha 9b8666a07d98)
  - site_page: https://blog.cloudflare.com/tag/developer-documentation (fetched 2026-08-29T12:37:40.504271+00:00, sha 12bb2ca0cd87)
- Data as of 2026-08-30T08:39:29.467469+00:00.