Skip to content

PCAP Processing

The sniffer can analyze local packet capture files as well as live interfaces — useful for analysis, testing, and forensics.

Supported Inputs

  • .pcap
  • .pcapng
  • file:///... style file paths

If the input does not match one of those forms, the runtime treats it as a live interface name.

Basic PCAP Workflow

Set the capture interface to a file path:

capture:
  interface: "/data/captures/sample.pcap"
  mode: "local"
  bpf_filter: "tcp or udp or proto 47 or ip6 proto 0 or ip6 proto 43 or ip6 proto 44 or ip6 proto 51 or ip6 proto 60 or ip6 proto 135"

Run the sniffer:

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --foreground

Tip

PCAP processing is often the safest way to verify output shape and parsing behavior before moving to live capture.

File URL Example

capture:
  interface: "file:///data/captures/sample.pcapng"
  mode: "local"

Notes for Offline File Processing

  • The file must be readable by the current user
  • Replay does not preserve original wall-clock timing
  • Output still follows the same NDJSON rules as live offline capture
  • --dry-run prevents output writes even in PCAP workflows
  • Captures that begin mid-flow are processed. A connection whose TCP handshake is not in the file is still tracked and analysed, and its client/server roles are inferred from whatever evidence the capture does contain — a later SYN, or a ServerHello, which can only travel server-to-client. The heartbeat reports how often this happens as mid-flow adoptions and role corrections.
  • Flows where the direction cannot be determined at all — no handshake and no ServerHello — are not written, because their source and destination could be reversed. A warning names how many were affected. Capture from before the flows start to avoid it.

Good Use Cases

  • validate parser behavior with known traffic
  • generate NDJSON for downstream tooling
  • run repeatable protocol tests without live capture access
  • inspect sample PQC handshakes in lab environments