Default Output

NDJSON

One self-contained JSON event per line.

Capture Sources

2

Live interfaces and `.pcap` or `.pcapng` inputs.

Retention Model

Circular

Indexed rotation with bounded disk usage.

Start Here

The fastest path is to validate an offline YAML file, run the sniffer in the foreground, and confirm that `connections.ndjson` is being written where you expect.

Overview

Understand the offline-only scope, output model, and recommended bring-up flow.

Quick Start

Get from configuration file to a working offline capture in just a few commands.

Build and Preview

Install prerequisites, build the sniffer, and generate the local HTML docs preview.

Running Offline

Understand live-capture runtime behavior, CLI overrides, and validation rules.

Documentation

YAML Reference

Review offline-mode settings for sniffer identity, capture sources, logging, and output.

Command Reference

Use the core commands for validation, setup, foreground execution, and overrides.

PCAP Processing

Process `.pcap`, `.pcapng`, and `file:///...` inputs for repeatable offline analysis.

Configuration Examples

Start from tested offline-mode YAML patterns for live capture, PCAP processing, and safer flushing.

Troubleshooting

Diagnose missing output files, permission issues, PCAP problems, and failed validation.

Output Format

NDJSON Output

See how records are written, what field groups to expect, and where files land.

Rotation and Retention

Understand circular index rollover and how `max_size_mb` and `max_files` affect disk usage.

Default Output Location

If offline_output.output_file is set to a directory path, the sniffer writes to:

/var/log/pqc-sniffer/connections.ndjson

When rotation is enabled, output is written to indexed files such as:

/var/log/pqc-sniffer/connections.0.ndjson
/var/log/pqc-sniffer/connections.1.ndjson
/var/log/pqc-sniffer/connections.2.ndjson

Deployment and Management

Local Preview and Build

Preview the site locally with MkDocs and generate deployable HTML output.

Service Deployment Notes

Use the repo’s existing Linux service and packaging assets while keeping the docs scope offline-only.

FAQ

Answer the most common operator questions about offline behavior, file output, and capture inputs.

Latest Updates

Documentation site refresh

The offline-mode guide now uses ACDI Sniffer branding, a reference-style homepage, structured navigation, and a static HTML build pipeline with MkDocs Material.

View current release notes

Info

Do not use --dry-run if you expect NDJSON files to be written. It suppresses offline file output.