Skip to content

Overview

The Automated Cryptography Discovery & Inventory (ACDI) Sniffer is a passive network sensor that discovers the cryptography in use on your network and assesses its readiness for the post-quantum era. It watches TLS, SSH, and QUIC handshakes, records what algorithms are being negotiated, and flags what is — and is not — quantum-safe.

What It Does

  • Discovers cryptography in traffic. It passively observes encrypted sessions and extracts the protocols, cipher suites, key-exchange groups, and signature algorithms actually negotiated on the wire.
  • Assesses quantum readiness. Each observed handshake is classified for quantum safety, so you can see where classical, at-risk algorithms are still in use versus where post-quantum protection is already in place.
  • Builds an inventory. Results are written as structured records you can search, dashboard, and report on — a living inventory of your network's cryptographic posture rather than a one-time scan.
  • Supports compliance. Findings map to recognized guidance (FIPS, NIST, CNSA 2.0) to support migration planning and audit.

It is passive and non-invasive: it captures a copy of traffic and never injects, proxies, or terminates connections.

How It Works

The sniffer reads packets from a live network interface or from captured .pcap / .pcapng files, analyzes the cryptographic handshakes it sees, and writes one structured NDJSON record per connection. Those records are self-contained and ready for downstream review or ingestion into a SIEM or analytics platform.

Capture Sources
Live & PCAP

Network interfaces or captured packet files.

Analyzes
TLS · SSH · QUIC

Handshakes assessed for quantum safety.

Output
NDJSON

One self-contained record per connection.

What You Can Do With the Output

Records are designed to flow into the tools you already run:

  • Forward to Elastic or Splunk for search and alerting.
  • Drive the Kibana PQC dashboards for fleet posture, vulnerability analysis, and migration tracking.
  • Feed your own pipelines — every record is a single self-contained JSON line.

About This Guide

This guide covers running the sniffer as a standalone sensor that writes NDJSON to local files — the most common way to deploy it. Connected-mode workflows that write directly to a PostgreSQL-backed platform are documented separately.

Get Started

  1. Install the sniffer from the RPM package.
  2. Set your identity and capture interface in the configuration file.
  3. Validate the configuration, then start the service.
  4. Confirm connections.ndjson is being written, and review the output.