Skip to content

Release Notes 1.0.0.0

Release history for the Automated Cryptography Discovery & Inventory (ACDI) Sniffer.

  • Version: 1.0.0.0
  • Release Type: Baseline release
  • Artifacts: Initial RPM/package baseline for the ACDI Sniffer

Baseline Capabilities

Version 1.0.0.0 establishes the initial sniffer baseline for offline network cryptography discovery and local NDJSON output. It provides the core runtime, configuration, capture, parsing, and output paths used by later releases.

Capture and Processing

  • Live packet capture from local interfaces.
  • Offline processing of packet capture files through .pcap, .pcapng, and file:///... inputs.
  • Configurable BPF filtering for targeted capture.
  • TCP connection tracking with source/destination address, port, byte, and packet counters.
  • Protocol classification for supported crypto and application protocols.

Offline Output

  • Offline mode for local operation without PostgreSQL connectivity.
  • ECS-style NDJSON output with one JSON object per line.
  • Configurable output path, append behavior, buffering, and per-connection flushing.
  • Circular indexed NDJSON rotation with configurable maximum file size and file count.
  • Customer and observer metadata tagging through customer_id and sniffer_id.

TLS, SSH, QUIC, and PQC Telemetry

  • TLS ClientHello and ServerHello parsing when handshake data is available.
  • TLS cipher suite, version, SNI, ALPN, supported groups, and signature algorithm telemetry.
  • SSH banner and key-exchange metadata when observed.
  • QUIC version metadata when observed.
  • PQC readiness fields under the custom pqc.* namespace.
  • Overall quantum-safety and readiness-score fields for downstream review.

Configuration and Operation

  • YAML-based configuration for sniffer identity, capture source, offline output, logging, monitoring, resource limits, and crash handling.
  • Interactive setup support for generating configuration files.
  • Configuration validation before runtime.
  • Foreground operation for first-run validation and troubleshooting.
  • Logging to local files with rotation controls.

Documentation Baseline

  • Offline-mode quick start.
  • YAML configuration reference.
  • Command reference.
  • PCAP processing guidance.
  • NDJSON output overview.
  • Rotation and retention guidance.
  • Troubleshooting and FAQ pages.

Known Notes

  • This baseline release establishes the initial documented behavior. Later releases add stricter TLS classification, expanded schema documentation, SBOM automation, containerized RPM build guidance, and generated release SBOMs.