Configuration Examples

Use these examples as starting points for common offline-mode scenarios.

Minimal Live Capture

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "acdi-offline-01"
  mode: "offline"

capture:
  interface: "eth0"
  mode: "local"
  bpf_filter: "tcp or udp"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 64
  flush_per_connection: false
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10

logging:
  level: "info"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    max_size_mb: 100
    max_files: 10
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"

PCAP Processing

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "acdi-pcap-01"
  mode: "offline"

capture:
  interface: "/data/captures/sample.pcap"
  mode: "local"
  bpf_filter: "tcp or udp"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32

offline_output:
  output_file: "/tmp/pqc-sniffer/"
  append_mode: false
  buffer_size_kb: 64
  flush_per_connection: true
  rotation_enabled: false
  max_size_mb: 100
  max_files: 10

logging:
  level: "debug"
  file:
    path: "/tmp/pqc-sniffer.log"
    max_size_mb: 20
    max_files: 2
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"

High-Safety Flush Pattern

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 32
  flush_per_connection: true
  rotation_enabled: true
  max_size_mb: 50
  max_files: 20

Use this when immediate persistence matters more than write throughput.