Skip to content

YAML Reference

This page lists the configuration fields that matter for offline mode.

Required Sections

At minimum, define:

  • sniffer
  • capture
  • offline_output
  • logging

sniffer

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "sniffer-offline-01"
  mode: "offline"
  • customer_id: identifies the deployment and tags output records
  • sniffer_id: used in runtime metadata and observer output
  • mode: must be offline

capture

capture:
  interface: "eth0"
  mode: "local"
  bpf_filter: "tcp or udp"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32
  enable_raw_sockets: false
  raw_socket_filter: ""
  capture_incomplete_handshakes: false
  pre_capture:
    enabled: false
    tcpdump_binary: "tcpdump"
    initialization_delay_seconds: 5
    pcap_output_path: "/tmp/pqc-sniffer-precap.pcap"
    buffer_size_mb: 16
    keep_pcap_file: false
  • interface: live interface name or a .pcap or .pcapng file path
  • mode: one of local, span, tap, aws_vpc_mirror, gcp_packet_mirror, azure_vtap
  • bpf_filter: libpcap filter expression
  • promiscuous: enables or disables promiscuous capture
  • queue_size: internal packet queue size
  • timeout_ms: capture timeout in milliseconds
  • snaplen: packet snapshot length
  • pcap_buffer_size_mb: libpcap buffer size
  • enable_raw_sockets: enables early AF_PACKET capture
  • raw_socket_filter: optional filter just for raw-socket capture
  • capture_incomplete_handshakes: allows partial handshake emission in supported flows

pre_capture

  • enabled
  • tcpdump_binary
  • initialization_delay_seconds
  • pcap_output_path
  • buffer_size_mb
  • keep_pcap_file

offline_output

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 64
  flush_per_connection: false
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10
  • output_file: absolute path only; directory paths ending in / receive connections.ndjson
  • append_mode: append on startup instead of truncating the current file
  • buffer_size_kb: write buffer size
  • flush_per_connection: flush after each event write
  • rotation_enabled: enable circular rotation
  • max_size_mb: per-file size threshold before rollover
  • max_files: number of indexed files retained in the circular set

logging

logging:
  level: "info"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    max_size_mb: 100
    max_files: 10
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"
  • logging.level: debug, info, warn, or error
  • logging.file.path
  • logging.file.max_size_mb
  • logging.file.max_files
  • logging.file.rotation_enabled
  • logging.database.enabled: set to false for offline-only deployments
  • logging.database.level

monitoring

monitoring:
  heartbeat_interval_seconds: 60
  metrics:
    enabled: false
  • monitoring.heartbeat_interval_seconds
  • monitoring.metrics.enabled

resource_limits

resource_limits:
  max_memory_mb: 0
  max_cpu_percent: 0
  max_disk_mb: 0

0 means unlimited for these fields.

crash_handler

crash_handler:
  enabled: true
  crash_log_dir: ""
  generate_core_dump: false
  include_memory_stats: true
  include_recent_activity: true
  max_backtrace_frames: 50
  • enabled
  • crash_log_dir
  • generate_core_dump
  • include_memory_stats
  • include_recent_activity
  • max_backtrace_frames

Validation Rules

  • offline_output.output_file must be an absolute path
  • offline_output.output_file cannot contain ..
  • offline_output.buffer_size_kb must be between 1 and 1024
  • offline_output.max_size_mb must be between 1 and 10240 when rotation is enabled
  • offline_output.max_files must be between 1 and 1000 when rotation is enabled

Info

For offline-only deployments, keep logging.database.enabled: false and do not rely on --dry-run for real file generation.