Project scope: when do we add a new protocol?

[domcyrus]

A note for current and prospective contributors.

RustNet aims to stay small and fast. As the project picks up more contributions I want to be explicit about how I think about adding new Deep Packet Inspection protocols, so we do not spend each other's time.

The criteria I lean on:

1. Real-world prevalence. A meaningful share of RustNet users should actually see this protocol on their networks. Niche or legacy-only protocols are not automatically a no, but the bar is higher.
2. Plaintext window. Most modern protocols are TLS-wrapped from the first byte. If realistic traffic is almost always encrypted (e.g., IMAP, RDP, modern XMPP), the DPI module catches very little in practice and the maintenance cost outweighs the value.
3. Architectural fit. Detection should be cheap, unambiguous, and not balloon the core code path.

If you would like to contribute a new protocol, please open an issue first describing the protocol, the expected real-world prevalence, and the plaintext data you expect to extract. That lets us reach alignment before implementation work happens. The same guidance is captured in CONTRIBUTING.md under "Project Scope".

Feedback on these criteria is welcome.