NDJSON Output¶

Offline mode writes one JSON object per line in NDJSON format.

Each line is a self-contained event with network, protocol, and PQC metadata.

Typical Field Groups¶

@timestamp
event.*
source.*
destination.*
network.*
observer.*
tcp.*
tls.*
ssh.*
pqc.*
tychon.crypto.*

Example Record¶

{"@timestamp":"2026-05-11T18:40:13.141Z","event":{"id":"192.168.64.3-69.194.240.13_443-TCP","category":["network"],"type":["connection","protocol"]},"source":{"ip":"192.168.64.3","port":43864,"bytes":1915,"packets":4},"destination":{"ip":"69.194.240.13","port":443,"bytes":4380,"packets":4},"network":{"bytes":6295,"packets":8,"protocol":"https","transport":"tcp"},"observer":{"name":"sniffer-prod-01","product":"Automated Cryptography Discovery & Inventory (ACDI) Sniffer","type":"sniffer","vendor":"Tychon"},"tls":{"cipher":"TLS_AES_128_GCM_SHA256","established":true,"version_protocol":"1.3"},"pqc":{"quantum_safety":"Vulnerable","readiness_score":13,"has_pqc_kex":true,"has_pqc_sig":false,"pqc_downgrade_detected":true},"tags":["customer-12345"]}

Output Destination Rules¶

If the configured path ends with /, the runtime appends connections.ndjson.

Example:

offline_output:
  output_file: "/var/log/pqc-sniffer/"

Effective output:

/var/log/pqc-sniffer/connections.ndjson

If a full file path is provided, that exact file is used.

Performance Notes¶

Writes are buffered by default
flush_per_connection: true is safer but slower
rotation can be enabled to bound disk usage

Practical Reading Pattern¶

tail -f /var/log/pqc-sniffer/connections.ndjson