FAQ

Common questions about the Automated Cryptography Discovery & Inventory (ACDI) Sniffer offline mode.

Does offline mode require PostgreSQL?

No. Offline mode writes NDJSON locally and does not require database connectivity.

Can it process capture files instead of live traffic?

Yes. Use a .pcap, .pcapng, or file:///... input in capture.interface.

Why am I not seeing connections.ndjson?

The most common causes are:

• sniffer.mode is not offline
• --dry-run was used
• the output path is invalid or not writable
• traffic did not match the BPF filter

Does --dry-run help me test offline output?

No. --dry-run suppresses writes, so it is useful for parser flow validation but not for verifying NDJSON generation.

Is rotation timestamp-based?

No. Offline NDJSON rotation is circular and index-based.

Can I ship the output elsewhere later?

Yes. Offline mode is a good fit when you want to capture locally first and move or ingest NDJSON later using your own pipeline.