Skip to content

NDJSON Output

Offline mode writes one JSON object per line in NDJSON format.

Each line is a self-contained event with network, protocol, and PQC metadata.

For a field-by-field contract, see NDJSON Schema Reference.

Typical Field Groups

  • @timestamp
  • event.*
  • source.*
  • destination.*
  • network.*
  • observer.*
  • tcp.*
  • tls.*
  • ssh.*
  • pqc.*

Example Record

{"@timestamp":"2026-05-11T18:40:13.141Z","event":{"id":"192.168.64.3-69.194.240.13_443-TCP","category":["network"],"type":["connection","protocol"]},"source":{"ip":"192.168.64.3","port":43864,"bytes":1915,"packets":4},"destination":{"ip":"69.194.240.13","port":443,"bytes":4380,"packets":4},"network":{"bytes":6295,"packets":8,"protocol":"https","transport":"tcp"},"observer":{"name":"sniffer-prod-01","product":"Automated Cryptography Discovery & Inventory (ACDI) Sniffer","type":"sniffer","vendor":"Tychon"},"tls":{"cipher":"TLS_AES_128_GCM_SHA256","established":true,"version_protocol":"TLSv1.3"},"pqc":{"quantum_safety":"Vulnerable","readiness_score":13,"has_pqc_kex":true,"has_pqc_sig":false,"pqc_downgrade_detected":true},"tags":["customer-12345"]}

Emission Rules

  • TLS records are written when enough handshake data is available for protocol and PQC assessment.
  • Plain HTTP records can be written before TCP close once request and response payloads have both been observed.
  • Generic non-TLS records are written only when the application protocol is known.
  • Unknown plain traffic, including plain DNS/UDP that is not classified as a supported crypto protocol, may be skipped intentionally.

Output Destination Rules

If the configured path ends with /, the runtime uses connections.ndjson as the base output name.

Example:

offline_output:
  output_file: "/var/log/pqc-sniffer/"

Base output path:

/var/log/pqc-sniffer/connections.ndjson

When rotation is enabled, the writer uses indexed files derived from that base path:

/var/log/pqc-sniffer/connections.0.ndjson
/var/log/pqc-sniffer/connections.1.ndjson

If rotation is disabled, the base path is used directly. If a full file path is provided, that file path becomes the base path.

Performance Notes

  • Writes are buffered by default
  • flush_per_connection: true is safer but slower
  • rotation can be enabled to bound disk usage

Practical Reading Pattern

latest_output=$(ls -t /var/log/pqc-sniffer/connections*.ndjson | head -n 1)
tail -f "$latest_output"