Overview

The Automated Cryptography Discovery & Inventory (ACDI) Sniffer offline mode captures traffic locally and writes ECS-style NDJSON for downstream review or pipeline ingestion.

Offline-Only Scope

This documentation set is limited to:

• live interface capture
• .pcap and .pcapng processing
• local file output
• offline YAML configuration
• file rotation and retention
• validation and troubleshooting

It intentionally does not cover connected-mode database workflows or QC-integrated ingestion.

What Offline Mode Produces

Offline mode emits one self-contained NDJSON record per event, including:

• connection metadata
• network and protocol details
• TLS or SSH information when available
• PQC and quantum-readiness metadata
• customer and observer tagging

Typical Workflow

1. Create or generate an offline YAML configuration.
2. Validate the config before first use.
3. Run the sniffer in the foreground.
4. Review connections.ndjson and logs.
5. Move to a long-running deployment pattern if needed.

Read Next

• Quick Start
• YAML Reference
• NDJSON Output