Running Offline¶

Offline mode runs the sniffer without database connectivity. Instead of writing connection records to PostgreSQL, the sniffer writes ECS-style NDJSON to local files.

Live Interface Capture¶

Example command:

sudo ./build/pqc-sniffer --config /etc/pqc-sniffer/offline.yaml --foreground

Use --foreground during setup and validation so logs stay visible in the terminal.

Interactive Configuration¶

The setup wizard can create a configuration interactively:

./build/pqc-sniffer --setup --config /etc/pqc-sniffer/offline.yaml

Override Settings from the CLI¶

You can override selected values at runtime:

sudo ./build/pqc-sniffer \
  --config ./offline.yaml \
  --foreground \
  --interface eth1 \
  --customer-id customer-12345 \
  --sniffer-id lab-offline-01

Important Runtime Note¶

Warning

Do not use --dry-run if you expect offline NDJSON files to be written.

--dry-run is useful for parser and flow validation, but it suppresses actual persistence.

Use this:

sudo ./build/pqc-sniffer --config ./offline.yaml --foreground

Not this:

sudo ./build/pqc-sniffer --config ./offline.yaml --foreground --dry-run

Output Path Behavior¶

If offline_output.output_file ends with /, the runtime appends connections.ndjson.

Example:

offline_output:
  output_file: "/var/log/pqc-sniffer/"

Effective file path:

/var/log/pqc-sniffer/connections.ndjson

If you provide a full file path, that exact file is used instead.

Validation Rules That Matter Most¶

sniffer.mode must be offline
offline_output.output_file cannot be empty
offline_output.output_file must be an absolute path
offline_output.output_file cannot contain ..
offline_output.buffer_size_kb must be between 1 and 1024
if rotation is enabled, max_size_mb and max_files must stay within allowed ranges

Recommended Bring-Up Flow¶

Validate the configuration with --validate-config.
Run in the foreground for first use.
Confirm that log output and NDJSON output both look correct.
Only then move the process into a longer-running deployment pattern.