Command Reference¶

The core CLI commands for the ACDI Sniffer. These assume the RPM install, where pqc-sniffer is on the PATH and the configuration lives at /etc/pqc-sniffer/config.yaml.

Display Help¶

pqc-sniffer --help

Display Version¶

pqc-sniffer --version

Generate a Config Interactively¶

sudo pqc-sniffer --setup --config /etc/pqc-sniffer/config.yaml

The generated file is mode 0600 because it can hold a database password. Run under sudo it is given to pqc-sniffer, the account the service reads it as. On builds before 2.0.0-12 it stayed owned by root and the service could not read it — if you hit that, sudo chown pqc-sniffer:pqc-sniffer /etc/pqc-sniffer/config.yaml.

Convert Legacy Credentials¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --migrate-credentials

Rewrites every legacy b64: credential in the file to the encrypted aes: form, in place, and exits. Comments and formatting are preserved and the file is replaced atomically, so an interrupted run cannot leave a half-written configuration. It is safe to run when there is nothing to do — it says so and exits 0.

--config is required here as it is everywhere else; the command does not fall back to the default path. A configuration still holding b64: values will not load at all, so this is what to reach for when the service refuses to start with that error — the full procedure, including the file-ownership cases and why the password should be rotated afterwards, is under Service Will Not Start: "the 'b64:' credential format has been removed".

Validate a Config File¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --validate-config

Check a Config Without Starting Capture¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --test

In this release --test validates the configuration and exits. It makes no database connection, because connected (PostgreSQL) mode is not available — see Configuration. For a config-only check that does not load the rest of the runtime, use --validate-config as shown above.

Run in Foreground¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground

Override the Capture Interface¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground --interface eth1

Override Deployment Metadata¶

sudo pqc-sniffer \
  --config /etc/pqc-sniffer/config.yaml \
  --foreground \
  --customer-id customer-12345 \
  --sniffer-id lab-01

Raise the Log Level¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground --log-level debug

Overrides logging.level for this run only; the configuration file is not modified. The value must be one of debug, info, warn or error — anything else is rejected when the merged configuration is validated, and the sniffer exits 1 with logging.level must be one of: debug, info, warn, error.

--debug (-d) is shorthand for the same thing. It is applied after --log-level, so if you pass both, --debug wins whichever order they appear in.

Notes¶

--config is required unless you are running --setup
--foreground is recommended during setup and troubleshooting; for normal operation use the systemd service (systemctl start pqc-sniffer)
--dry-run parses packets without writing them to the configured output, and is not the normal NDJSON workflow

Common Operator Pattern¶

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --validate-config
sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground
latest_output=$(ls -t /var/log/pqc-sniffer/connections*.ndjson | head -n 1)
tail -5 "$latest_output"