Home
One self-contained JSON event per line.
Live interfaces and `.pcap` or `.pcapng` inputs.
Indexed rotation with bounded disk usage.
Start Here¶
The fastest path is to validate an offline YAML file, run the sniffer in the foreground, and confirm that a `connections*.ndjson` output file is being written where you expect.
Overview
Understand what the sniffer does, how it captures traffic, and what it produces.
Quick Start
Get from a fresh install to working NDJSON capture in just a few commands.
Install the Sniffer
Install from the RPM package (or manually), configure, and start the service.
Running Offline
Understand live-capture runtime behavior, CLI overrides, and validation rules.
Documentation¶
YAML Reference
Review offline-mode settings for sniffer identity, capture sources, logging, and output.
Command Reference
Use the core commands for validation, setup, foreground execution, and overrides.
PCAP Processing
Process `.pcap`, `.pcapng`, and `file:///...` inputs for repeatable offline analysis.
Configuration Examples
Start from tested offline-mode YAML patterns for live capture, PCAP processing, and safer flushing.
Troubleshooting
Diagnose missing output files, permission issues, PCAP problems, and failed validation.
Output Format¶
NDJSON Output
See how records are written, what field groups to expect, and where files land.
NDJSON Schema Reference
Review emitted fields for top-talkers, TLS handshakes, KEX methods, and PQC safety.
Rotation and Retention
Understand circular index rollover and how `max_size_mb` and `max_files` affect disk usage.
Default Output Location¶
If offline_output.output_file is set to a directory path, the sniffer uses
connections.ndjson as the base output name:
/var/log/pqc-sniffer/connections.ndjson
With rotation enabled, which is the default in the examples, output is written to indexed files such as:
/var/log/pqc-sniffer/connections.0.ndjson
/var/log/pqc-sniffer/connections.1.ndjson
/var/log/pqc-sniffer/connections.2.ndjson
Deployment and Management¶
Install the Sniffer
Install from the RPM package or manually, then configure and start the service.
Deployment & Management
Run the sniffer as a managed systemd service: start, enable, monitor, and upgrade.
FAQ
Answer the most common operator questions about behavior, file output, and capture inputs.
Integrations¶
Elastic Agent (Fleet — Custom NDJSON)
Enroll an Elastic Agent in Fleet and configure a Custom Logs integration to parse connections*.ndjson.
Splunk Universal Forwarder
Manually configure a Splunk UF to monitor and forward offline connection records to an indexer.
Splunk Dashboards
Browse the Splunk Dashboard Studio versions of the six reference dashboards, including shared conventions, panel intent, and field usage.
Elastic Dashboards
Understand the six PQC dashboards — posture, vulnerability analysis, device inventory, migration tracking, compliance, and threat detection.
Latest Updates¶
Documentation site refresh
The offline-mode guide now uses ACDI Sniffer branding, a reference-style homepage, structured navigation, and a static HTML build pipeline with MkDocs Material.
Info
Do not use --dry-run if you expect NDJSON files to be written. It suppresses offline file output.