Skip to content

Installation

Install the Automated Cryptography Discovery & Inventory (ACDI) Sniffer on a Linux host. Most operators should use the RPM package, which installs the binary, a systemd service, and a default configuration in one step. A manual install is also documented for environments where the RPM cannot be used.

Requirements

Item Requirement
Operating system RHEL 8 or Rocky Linux 8
Architecture x86_64 or aarch64
Privileges root (or sudo) to install and to capture live traffic
Network access A capture interface, or .pcap / .pcapng files to process

The sniffer captures live traffic using the CAP_NET_RAW capability. Installing the package configures this for you; the manual install sets it explicitly.

Note

The RPM's runtime dependencies (libpcap, postgresql-libs, openssl-libs, systemd, libcap) are pulled from the standard RHEL/Rocky repositories during installation. The host must be able to reach those repositories, or have the packages already present.

Install from RPM

This is the recommended path.

1. Obtain the package

You will be provided an ACDI Sniffer RPM for your architecture, named like:

pqc-sniffer-linux-amd64-2.0.0.97.beta1.rpm      # x86_64
pqc-sniffer-linux-arm64-2.0.0.97.beta1.rpm      # aarch64

Copy it to the target host, for example:

scp pqc-sniffer-linux-amd64-2.0.0.97.beta1.rpm user@host:/tmp/

2. Install the package

Use dnf so runtime dependencies resolve automatically. Point it at the local file with a ./ (or absolute) path:

sudo dnf install ./pqc-sniffer-linux-amd64-2.0.0.97.beta1.rpm

Installation places the following on the system:

Path Purpose
/usr/bin/pqc-sniffer The sniffer binary (on PATH)
/etc/pqc-sniffer/config.yaml Active configuration (preserved on upgrade)
/etc/pqc-sniffer/config.yaml.example Reference configuration
/usr/lib/systemd/system/pqc-sniffer.service systemd service unit
/var/log/pqc-sniffer/ Default output and log directory

The package also grants the binary packet-capture capability (setcap cap_net_raw+eip) so it can capture without running the whole process as an unconfined root user.

3. Verify the install

pqc-sniffer --version

4. Configure

The installed config.yaml is a starter file. This guide runs the sniffer in offline mode, where it writes NDJSON to local files. Replace the configuration with the minimal offline setup below, then set your identity and capture interface:

sudo nano /etc/pqc-sniffer/config.yaml

sniffer:
  customer_id: "your-customer-id"
  sniffer_id: "sniffer-prod-01"
  mode: "offline"            # write NDJSON to file (not to a database)

capture:
  interface: "eth0"          # your capture interface — see `ip link`
  mode: "local"
  bpf_filter: "tcp or udp"
  promiscuous: true

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 64
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10

logging:
  level: "info"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    rotation_enabled: true
    max_size_mb: 100
    max_files: 10
  database:
    enabled: false           # required for file-only output

monitoring:
  heartbeat_interval_seconds: 60
  metrics:
    enabled: false

Important

sniffer.mode must be offline for file output. Left unset, the sniffer defaults to connected mode and expects a PostgreSQL database instead of writing connections.ndjson.

See the YAML Reference for every setting, and Configuration Examples for ready-to-adapt patterns. Validate your changes before starting the service:

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --validate-config

5. Start the service

sudo systemctl start pqc-sniffer      # start now
sudo systemctl enable pqc-sniffer     # start automatically on boot

Check status and logs:

systemctl status pqc-sniffer
sudo journalctl -u pqc-sniffer -f

Confirm output is being written:

With rotation_enabled: true, the sniffer writes indexed files such as connections.0.ndjson, connections.1.ndjson, and so on. With rotation_enabled: false, it writes the base file connections.ndjson.

latest_output=$(ls -t /var/log/pqc-sniffer/connections*.ndjson | head -n 1)
tail -5 "$latest_output"

The service restarts automatically on failure. See Running the Sniffer for runtime behavior and Deployment & Management for operational guidance.

Upgrade

Install the newer RPM the same way; dnf performs an upgrade in place:

sudo dnf install ./pqc-sniffer-linux-amd64-<new-version>.rpm
sudo systemctl restart pqc-sniffer

Your /etc/pqc-sniffer/config.yaml is preserved across upgrades. A new reference file is always written to config.yaml.example so you can compare against the latest defaults.

Uninstall

sudo dnf remove pqc-sniffer

Removal stops and disables the service. The log directory /var/log/pqc-sniffer/ is cleaned up on a full uninstall (it is retained across upgrades).

Manual install

Use this path only when the RPM cannot be used. It performs the same essential steps by hand, starting from a standalone pqc-sniffer binary for your architecture.

1. Place the binary

sudo install -m 0755 pqc-sniffer /usr/bin/pqc-sniffer

2. Confirm runtime libraries are present

ldd /usr/bin/pqc-sniffer | grep "not found"

No output means every shared library is resolved. If anything is reported as not found, install the matching package (libpcap, postgresql-libs, openssl-libs, libcap) from your OS repositories.

3. Grant capture capability

sudo setcap cap_net_raw+eip /usr/bin/pqc-sniffer
pqc-sniffer --version

4. Create the configuration

sudo mkdir -p /etc/pqc-sniffer /var/log/pqc-sniffer
sudo cp example.yaml /etc/pqc-sniffer/config.yaml
sudo nano /etc/pqc-sniffer/config.yaml

Set sniffer.customer_id, sniffer.sniffer_id, and capture.interface as shown above, then validate:

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --validate-config

5. Run it

For a quick foreground test:

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground

To run it as a managed service, install the systemd unit and enable it — see Deployment & Management for the unit file and the systemctl steps.

Next steps