Configuration Examples

Use these examples as starting points for common offline-mode scenarios.

Minimal Live Capture

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "acdi-offline-01"
  mode: "offline"

capture:
  interface: "eth0"
  mode: "local"
  bpf_filter: "tcp or udp or proto 47 or ip6 proto 0 or ip6 proto 43 or ip6 proto 44 or ip6 proto 51 or ip6 proto 60 or ip6 proto 135"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 512
  flush_per_connection: false
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10

logging:
  level: "info"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    max_size_mb: 100
    max_files: 10
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"

PCAP Processing

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "acdi-pcap-01"
  mode: "offline"

capture:
  interface: "/data/captures/sample.pcap"
  mode: "local"
  bpf_filter: "tcp or udp or proto 47 or ip6 proto 0 or ip6 proto 43 or ip6 proto 44 or ip6 proto 51 or ip6 proto 60 or ip6 proto 135"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: false
  buffer_size_kb: 512
  flush_per_connection: true
  rotation_enabled: false
  max_size_mb: 100
  max_files: 10

logging:
  level: "debug"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    max_size_mb: 20
    max_files: 2
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"

Note

Output and log paths must resolve within an allowed service directory (see Output path security). To write to a non-standard location such as a scratch or data mount, set PQC_SNIFFER_ALLOWED_OUTPUT_DIRS in the service environment.

High-Safety Flush Pattern

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 32
  flush_per_connection: true
  rotation_enabled: true
  max_size_mb: 50
  max_files: 20

Use this when immediate persistence matters more than write throughput.

The buffer_size_kb: 32 here is deliberate, and is the one example on this page that sits below the 512 default: with flush_per_connection: true every record reaches the file immediately, so a large buffer buys nothing. Do not copy that value into a throughput-oriented configuration — see Write buffer and batching for what happens when the writer cannot drain the queue fast enough.