PCAP Processing

Offline mode supports local packet capture files for analysis, testing, and forensics.

Supported Inputs

• .pcap
• .pcapng
• file:///... style file paths

If the input does not match one of those forms, the runtime treats it as a live interface name.

Basic PCAP Workflow

Set the capture interface to a file path:

capture:
  interface: "/data/captures/sample.pcap"
  mode: "local"
  bpf_filter: "tcp or udp"

Run the sniffer:

./build/pqc-sniffer --config ./offline-pcap.yaml --foreground

Tip

PCAP processing is often the safest way to verify output shape and parsing behavior before moving to live capture.

File URL Example

capture:
  interface: "file:///data/captures/sample.pcapng"
  mode: "local"

Notes for Offline File Processing

• The file must be readable by the current user
• Replay does not preserve original wall-clock timing
• Output still follows the same NDJSON rules as live offline capture
• --dry-run prevents output writes even in PCAP workflows

Good Use Cases

• validate parser behavior with known traffic
• generate NDJSON for downstream tooling
• run repeatable protocol tests without live capture access
• inspect sample PQC handshakes in lab environments