cisco/mercury ? reverse-engineered prompt

Build me a network traffic capture and analysis tool called Mercury.

I want a standalone app that can watch packets on Linux and macOS, extract useful metadata, and write the results as JSON. It should also be able to save matching packets as PCAP if I choose that instead. The main thing I care about is fingerprinting common traffic like TLS, DTLS, SSH, HTTP, and TCP, then showing those fingerprints clearly in the output. If possible, include basic process or app identification from the fingerprint and destination context too.

Make it work well for live capture, not just reading files, and keep it fast enough to handle busy networks without falling over. A simple config file, sensible defaults, and a way to run it from the command line would be great. If you need to check current library or build docs online while implementing, go ahead.