Quick Start¶

This is the fastest path to running the sniffer in offline mode and generating local NDJSON output.

1. Create an Offline Configuration¶

sniffer:
  customer_id: "customer-12345"
  sniffer_id: "sniffer-offline-01"
  mode: "offline"

capture:
  interface: "eth0"
  mode: "local"
  bpf_filter: "tcp or udp"
  promiscuous: false
  queue_size: 10000
  timeout_ms: 1000
  snaplen: 65535
  pcap_buffer_size_mb: 32

offline_output:
  output_file: "/var/log/pqc-sniffer/"
  append_mode: true
  buffer_size_kb: 64
  flush_per_connection: false
  rotation_enabled: true
  max_size_mb: 100
  max_files: 10

logging:
  level: "info"
  file:
    path: "/var/log/pqc-sniffer/pqc-sniffer.log"
    max_size_mb: 100
    max_files: 10
    rotation_enabled: true
  database:
    enabled: false
    level: "warn"

monitoring:
  heartbeat_interval_seconds: 60
  metrics:
    enabled: false

resource_limits:
  max_memory_mb: 0
  max_cpu_percent: 0
  max_disk_mb: 0

crash_handler:
  enabled: true
  crash_log_dir: ""
  generate_core_dump: false
  include_memory_stats: true
  include_recent_activity: true
  max_backtrace_frames: 50

2. Validate the YAML¶

./build/pqc-sniffer --config ./offline.yaml --validate-config

3. Start Live Capture¶

sudo ./build/pqc-sniffer --config ./offline.yaml --foreground

4. Confirm Output¶

tail -5 /var/log/pqc-sniffer/connections.ndjson

First-Run Notes¶

Tip

sniffer.mode must be offline, offline_output.output_file must be an absolute path, and live capture usually requires elevated privileges.

Warning

--dry-run is not the normal offline file-writing workflow because it suppresses writes.

Process a PCAP Instead¶

Use a capture file path in capture.interface:

Path Inputfile:// Input

capture:
  interface: "/data/captures/sample.pcap"
  mode: "local"
  bpf_filter: "tcp or udp"

capture:
  interface: "file:///data/captures/sample.pcapng"
  mode: "local"
  bpf_filter: "tcp or udp"

Then run:

./build/pqc-sniffer --config ./offline-pcap.yaml --foreground

Quick Checklist¶

Build the binary.
Create an offline YAML file.
Validate it with --validate-config.
Run in the foreground.
Confirm connections.ndjson is being written.