Skip to content

Overview

The Automated Cryptography Discovery & Inventory (ACDI) Sniffer is a passive network sensor that discovers the cryptography in use on your network and assesses its readiness for the post-quantum era. It analyzes handshakes across TLS, QUIC, DTLS, SSH and IKEv2, identifies a dozen further protocols on the wire, records what algorithms are being negotiated, and flags what is quantum-safe and what is not.

What It Does

  • Discovers cryptography in traffic. It passively observes encrypted sessions and extracts the protocols, cipher suites, key-exchange groups, and signature algorithms actually negotiated on the wire.
  • Assesses quantum readiness. Each observed handshake is classified for quantum safety, so you can see where classical, at-risk algorithms are still in use versus where post-quantum protection is already in place.
  • Builds an inventory. Results are written as structured records you can search, dashboard, and report on — a living inventory of your network's cryptographic posture rather than a one-time scan.
  • Supports compliance. Findings map to recognized guidance (FIPS, NIST, CNSA 2.0) to support migration planning and audit.

It is passive and non-invasive: it captures a copy of traffic and never injects, proxies, or terminates connections.

How It Works

The sniffer reads packets from a live network interface or from captured .pcap / .pcapng files, analyzes the cryptographic handshakes it sees, and writes one structured NDJSON record per connection. Those records are self-contained and ready for downstream review or ingestion into a SIEM or analytics platform.

Capture Sources
Live & PCAP

Network interfaces or captured packet files.

Analyzes
TLS · QUIC · DTLS · SSH

Deep handshake analysis, with IKEv2 and a dozen more protocols identified.

Output
NDJSON

One self-contained record per connection.

Protocols It Covers

Coverage is not uniform, because a passive observer sees different parts of each protocol.

Full cryptographic analysis. The handshake is parsed, and its key exchange, cipher and signature algorithms are assessed for quantum safety.

  • TLS 1.0 through 1.3, and the protocols carried over it: HTTPS, DNS-over-TLS, DNS-over-HTTPS and SMTPS
  • QUIC version 1 and HTTP/3
  • DTLS 1.0, 1.2 and 1.3
  • SSH 2.0
  • IKEv2 and IPsec, from the cleartext IKE_SA_INIT exchange
  • SMTP upgraded in place with STARTTLS, analysed after the upgrade
  • NTS key establishment on TCP 4460

Identified and inventoried. These either carry no cryptography to assess, or negotiate it where a passive observer cannot see it. They are still recorded, with their posture reported, so they show up in the inventory instead of being silently absent from it.

  • HTTP, plaintext MQTT, NTP, RADIUS and TACACS+
  • WireGuard, whose post-quantum variant is currently detectable only in an experimental lab format

Which post-quantum algorithms are visible in each protocol differs by protocol, and the NDJSON Schema Reference gives the per-protocol detail. The default capture filter is chosen to admit everything listed above, so read Choosing a capture filter before narrowing it: anything the filter excludes is not analysed, not counted and not reported.

What You Can Do With the Output

Records are designed to flow into the tools you already run:

  • Forward to Elastic or Splunk for search and alerting.
  • Drive the Kibana PQC dashboards for fleet posture, vulnerability analysis, and migration tracking.
  • Feed your own pipelines — every record is a single self-contained JSON line.

About This Guide

This guide covers running the sniffer as a standalone sensor that writes NDJSON to local files. This release is offline-only — connected (PostgreSQL) mode is not available, and sniffer.mode: connected is rejected at startup.

Get Started

  1. Install the sniffer from the RPM package.
  2. Set your identity and capture interface in the configuration file.
  3. Validate the configuration, then start the service.
  4. Confirm connections.ndjson is being written, and review the output.